Kopia - Backblaze B2 Kopia - Backblaze B2

[SSO] Backups Using the Cloud Storage You Pick

Encrypted, Compressed, and Deduplicated Backups Using the Cloud Storage You Pick Cross-platform backup tool for Windows, macOS & Linux with fast, incremental backups, client-side end-to-end encryption, compression and data deduplication. CLI and GUI included.

This instance’s repository is configured for Backbaze B2 storage

Links:

Authentik ForwardAuth

Authentik ForwardAuth is Kopia B2’s browser access gate for the admins group. Kopia’s repository password remains separate from browser authentication. The service depends on the isolated backup-kopia network and Traefik as its sole UI path.

Setup

scripts/authentik-apps.py --application kopia-b2 --apply
scripts/labctl.py service recreate backup/kopia-b2

Keep the router middleware as localaccess-authentik@file, Traefik connected to backup-kopia, and no Kopia UI host port published. The current Kopia server flags deliberately disable its own browser login because the network boundary and ForwardAuth are required; do not reuse this configuration where direct network access is possible.

Verify

Confirm an admins member can use the UI, a non-member is denied, group removal applies after session refresh, recovery works, and no direct container or host path reaches the UI.

name: kopia-b2
services:
  kopia-b2:
    image: kopia/kopia:0.23.1
    container_name: kopia-b2
    restart: "unless-stopped"
    user: "0:0"
    # kics-scan ignore-line
    privileged: true
    cap_add:
      - SYS_ADMIN
    # kics-scan ignore-line
    security_opt:
      - apparmor:unconfined
    devices:
      - /dev/fuse:/dev/fuse:rwm
    command:
      - server
      - start
      # The UI is reachable only through Traefik and Authentik ForwardAuth.
      - --disable-csrf-token-checks
      - --insecure
      - --without-password
      - --address=0.0.0.0:80
      - --allow-extremely-dangerous-unauthenticated-server-on-the-network
    environment:
      USER: ${ADMIN_USER}
      KOPIA_PASSWORD: ${KOPIA_B2_REPOSITORY_PASSWORD}
      TZ: ${TIMEZONE}

    # kics-scan ignore-block
    volumes:
      - ${DOCKER_VOLUMES}/kopia-b2/config:/app/config
      - ${DOCKER_VOLUMES}/kopia-b2/cache:/app/cache
      - ${DOCKER_VOLUMES}/kopia-b2/logs:/app/logs

      # Local (source)
      - /etc:/sources/nest/etc:ro
      - ${DOCKER_VOLUMES}:/sources/nest/docker-volumes:ro
      - ${ADMIN_HOME}/repos:/sources/nest/repos:ro

      # Sources will be migrated ho hostname-neutral path
      - /etc:/sources/local/etc:ro
      - ${DOCKER_VOLUMES}:/sources/local/docker-volumes:ro
      - ${ADMIN_HOME}/repos:/sources/local/repos:ro

      # NAS (source)
      - ${STORAGE_FAMILYMEDIA}:/sources/nas/family-media:ro
      - ${STORAGE_MEDIA}:/sources/nas/media:ro

    networks:
      - backup-kopia

    labels:
      traefik.enable: true
      traefik.docker.network: backup-kopia
      traefik.http.routers.kopia-b2.middlewares: localaccess-authentik@file
      traefik.http.services.kopia-b2.loadbalancer.server.port: 80
      homepage.group: Storage
      homepage.name: Kopia - Backblaze B2
      homepage.icon: kopia.png
      homepage.href: https://kopia-b2.${MYDOMAIN}/
      homepage.description: "[SSO] Backups Using the Cloud Storage You Pick"

networks:
  backup-kopia:
    external: true