Duplicati: S3 backups with a web UI

Duplicati is a free, cross-platform backup client with a web UI. It makes incremental, encrypted, deduplicated backups on a schedule and can write straight to serverplus S3 object storage. It suits those who don't want to fiddle with scripts: everything is configured in the browser through a wizard in a few steps.

1. Installation

Where to deploy: on the server itself or on a separate VM?

Duplicati is a client: it backs up the files and folders it sees locally and sends them to S3. Hence a simple rule:

• The usual case — on the server you're backing up. Duplicati sits next to the data (or in a container on the same host with the folders mounted in), reads them directly and ships them to the cloud. One instance per server — simple and reliable.
• A separate backup VM — only if it can see the data. Duplicati on another machine can back up a remote server only if its files are mounted over the network (NFS/SMB/SSHFS). That adds fragility: open files, DB consistency, network speed. Usually not worth it.

For several servers there are two working approaches: install Duplicati on each, or prepare the data on the source (DB dumps, archives) and upload it to S3 directly (then Duplicati isn't required — rclone or a script is enough).

"On the same server" is not a recovery risk. Even if the source server fails entirely, you restore from any fresh Duplicati (or via the CLI): just point it at the same S3 destination and provide the passphrase. The backup is self-contained and independent of the source machine — Duplicati can rebuild its local database from the data in the cloud.

Option A. Package (Windows / macOS / Linux)

Download the installer from duplicati.com (current stable branch — 2.x) and install it. Duplicati runs as a background service and its control panel opens in the browser:

http://localhost:8200

Option B. Docker (on the server)

Convenient for headless servers. The container runs on the same host whose folders are mounted inside:

docker run -d --name duplicati \
  -p 8200:8200 \
  -v /opt/duplicati/config:/data \
  -v /var/www:/source/www:ro \
  duplicati/duplicati:latest

• /data — Duplicati settings and database (don't lose it).
• /source/www — the data being backed up, mounted read-only (ro).

Web-UI password. In current versions Duplicati asks you to set a panel password on first login — be sure to set it. For headless deployments the password can be passed via --webservice-password.

2. First login and panel access

• Open http://localhost:8200 and set the UI password.
• Don't expose port 8200 to the internet. Keep it on localhost, and for remote access use an SSH tunnel (ssh -L 8200:localhost:8200 user@server) or a reverse proxy with auth and HTTPS.

3. Configuring a backup job to S3 serverplus

In the panel click "Add backup" → "Configure a new backup" and go through the wizard.

Step 1. General

• Give the job a name.
• Encryption: leave AES-256 and choose a passphrase. It encrypts all content before it goes to the cloud.

The passphrase cannot be recovered. If you lose it, the backups can't be decrypted. Store it safely, separate from the server.

Step 2. Destination — S3 serverplus

Storage Type: "S3 Compatible". Fill in the fields:

Server (custom):       object-store.serverplus.uz
Bucket name:           my-backups
Folder path:           duplicati
AWS Access Key ID:     <ACCESS_KEY>
AWS Secret Access Key: <SECRET_KEY>
Use SSL:               yes

Use "Test connection" to verify access. Create the bucket in advance in the cloud.serverplus.uz panel, and get the keys under "Access" → "S3/EC2 credentials".

Step 3. Source data and Schedule

• Select the folders to back up (for example /source/www in Docker or the needed directories in the package).
• Enable a schedule, for example daily at 03:00.

Step 4. Options (retention)

• Backup retention: "Smart backup retention" is convenient — it keeps frequent copies for recent days and increasingly sparse ones for older periods. Or set your own rule.

Click "Save" — the job is created.

4. The same as a string (for automation)

If you prefer the CLI or config export, the destination in Duplicati's terms looks like this:

s3://my-backups/duplicati?s3-servername=object-store.serverplus.uz&use-ssl=true&aws-access-key-id=<ACCESS_KEY>&aws-secret-access-key=<SECRET_KEY>

If the S3 connection is finicky. For some S3-compatible storage, switching the client to Minio helps — the --s3-client=minio option (in the GUI: Advanced options). It is more compatible than the built-in AWS library.

5. Run and verify

• Click "Run now" on the job and wait for the first (full) backup to finish.
• Check the job log (Show log) and the objects in the bucket via the panel or aws s3 ls.

6. Restore

1. Restore → pick the job and the version (date) of the backup.
2. Select the needed files or the whole folder.
3. Choose where to restore — to the original location or another directory — and run it.

Run restore drills regularly: a backup you've never restored is not yet a backup.

Security

• The passphrase is paramount. Losing it = no recovery. Store it separately and securely.
• A web-panel password and no external access to port 8200 (localhost / SSH tunnel / proxy with auth).
• Separate S3 keys for Duplicati and a private bucket for backups; revoke unused keys.
• Use SSL always on — data travels over https.

FAQ

Test connection to S3 fails. Check that Server = object-store.serverplus.uz, Use SSL is on, the keys are correct and the bucket already exists. If that doesn't help, add --s3-client=minio in Advanced options.

I forgot the encryption passphrase. The data can't be recovered — this is by design. That's exactly why the passphrase must be stored in advance and separately.

I forgot the web-panel password. It can be reset: in a package install via the service settings, in Docker by recreating the container with a new --webservice-password. The backup data is not lost.

The panel on 8200 is unreachable. The service isn't running, the port is taken or blocked by a firewall. In Docker, check the container is up and the port is published (-p 8200:8200).

Related: "S3 object storage on serverplus" and "Backup strategy".