Duplicati Encrypted Backup on AWS User Guide

Overview

This image runs Duplicati, a free open-source backup application that makes encrypted, deduplicated, incremental backups of your files and sends them to local folders, network shares or a wide range of cloud storage providers. Duplicati encrypts every backup with AES-256 on the client before anything leaves the machine, then splits the data into deduplicated blocks so only changed blocks are ever uploaded, keeping backups fast and storage small. Everything is driven from a modern web UI where you create backup jobs, schedule them, set retention, and browse and restore individual files or whole directories.

Duplicati runs as a systemd service that serves its web UI and REST API on the loopback interface at 127.0.0.1:8200, fronted by nginx as a reverse proxy which terminates TLS on port 443 with a per-instance self-signed certificate and redirects plain HTTP on port 80. The Duplicati server binds to loopback only and is never exposed directly to the network. The web UI uses a WebSocket for live task and progress updates, and nginx is already configured to proxy it. The server configuration database and the default local backup destination live under /var/lib/duplicati on a dedicated EBS data volume, independently resizable and separate from the operating system disk.

On the first boot of every deployed instance, a one-shot service generates a web password unique to that instance, a per-instance TLS certificate, and a per-instance database encryption key, and starts Duplicati with authentication required. Before it records anything it proves the result: it confirms that an unauthenticated API request is refused, that a wrong password is refused, that the generated password is accepted, and that a real backup and restore round-trip matches byte for byte. It then writes the password to /root/duplicati-credentials.txt with mode 0600 and marks first boot complete. No shared or default credentials ship in the image, and the health endpoint used by load balancers stays open while the UI and API require the generated password.

Connecting to your instance

Connect over SSH as the default login user for your operating system variant. This listing currently ships the following variant:

Prerequisites

Before you deploy this image you need:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups, and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group allowing inbound port 22 from your management network and inbound port 443 from the networks your operators will reach the Duplicati UI on (port 80 is only used to redirect to HTTPS and to answer load-balancer health checks)
• The AWS CLI (version 2) installed locally if you plan to deploy from the command line

Step 1: Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images choose AWS Marketplace AMIs and search for Duplicati. Select the cloudimg listing and choose Select, then Continue on the subscription summary.

Choose an instance type (the listing recommends m5.large), select your key pair, and configure a security group as described in the prerequisites. Leave the storage at the defaults: the AMI carries a dedicated data volume for the configuration database and local backup destination in addition to the operating system disk. Choose Launch instance.

Step 2: Launch the Instance from the AWS CLI

To deploy from the command line, first find the AMI ID for the listing in your Region, then launch it. Replace the placeholder values with your own.

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key-pair \
  --security-group-ids sg-xxxxxxxxxxxxxxxxx \
  --subnet-id subnet-xxxxxxxxxxxxxxxxx \
  --metadata-options 'HttpTokens=required,HttpEndpoint=enabled' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=duplicati}]' \
  --region us-east-1

The instance metadata options request IMDSv2 (HttpTokens=required); the first-boot service uses IMDSv2 to discover the instance's public IP address for the TLS certificate and the credentials file.

Step 3: Connect and Retrieve the Web Password

Once the instance has finished its first boot, connect over SSH as the login user for your variant (for the Ubuntu 24.04 variant this is ubuntu) and read the generated credentials file:

ssh -i your-key.pem ubuntu@<public-ip>
sudo cat /root/duplicati-credentials.txt

The file contains the web URL and the per-instance password:

DUPLICATI_URL=https://<public-ip>/
DUPLICATI_PASSWORD=<generated-password>

You can confirm the stack is healthy from the shell. The service and reverse proxy are both active, the health endpoint answers without authentication, and the REST API returns 401 until you present the password:

systemctl is-active duplicati nginx
curl -sk https://127.0.0.1/healthz
curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/api/v1/backups

You should see active twice, then ok, then 401. You can also confirm the listeners: Duplicati serves the web UI on loopback 127.0.0.1:8200, and nginx listens on ports 80 and 443:

sudo ss -tlnp | grep -E ':443|:80|:8200'

Step 4: First Sign-in

Open the web URL from the credentials file in your browser (https://<public-ip>/). Because the certificate is a per-instance self-signed certificate, your browser warns on the first visit; accept it to continue (Step 8 covers installing a CA-signed certificate for production). Sign in with the generated password.

After signing in, Duplicati offers to connect to its optional hosted console; you can proceed without it to use the fully self-hosted server. The home screen shows your backup jobs, with quick actions to create a backup or start a restore.

Step 5: Create an Encrypted Backup Job

Choose Add backup in the sidebar, then Add a new backup, to open the backup wizard. Give the job a name and a strong encryption passphrase, choose the source files and folders to protect, pick a destination, and set a schedule and retention policy.

For the destination you can use a local folder on the dedicated data volume, a network share, or a cloud provider such as S3-compatible object storage or Backblaze B2. A ready-to-use local destination is provided at /var/lib/duplicati/backups on the data disk. Whatever destination you choose, Duplicati encrypts and deduplicates the data before it is written, so the destination only ever sees encrypted blocks, and your passphrase is required to restore.

Keep your passphrase safe. The backup passphrase you set is required to restore your data and is not recoverable if lost. Store it somewhere secure and separate from the instance.

Step 6: Restore Files

Choose Restore in the sidebar to recover files. You can restore directly from an existing job, from backup files at a destination, or from an exported job configuration, then browse any previous version to restore individual files or a whole set. Duplicati asks for the job's passphrase before it decrypts and restores.

Step 7: Verify a Backup and Restore Round-trip

The image ships a self-test you can run at any time. It confirms that the web API requires the per-instance password (an unauthenticated request and a wrong password are both refused, the correct password is accepted) and performs a real backup and restore round-trip via the Duplicati engine: it encrypts a canary file to a destination on the dedicated data volume, restores it to a fresh directory, and confirms the restored contents match byte for byte by SHA-256, while a restore with the wrong passphrase is refused.

sudo /opt/duplicati-cloudimg/duplicati-selftest.sh

A successful run prints a line beginning OK: and exits zero. The configuration database and backup data live on the dedicated data volume; you can confirm it is a separate disk mounted at /var/lib/duplicati:

findmnt /var/lib/duplicati

Step 8: Review the Server Settings

Choose Settings in the sidebar to review the server configuration. Here you can change the server passphrase, set the interface theme and language, and manage the optional console connection. The Duplicati server this image runs is fully self-hosted and requires the per-instance password generated on first boot.

Step 9: Add a CA-signed Certificate

The image serves the UI over HTTPS with a per-instance self-signed certificate straight away. For production, point a DNS name at the instance, open port 443 in the security group to your operators' networks, and replace the certificate with a CA-signed one, for example with certbot. On the Ubuntu variant:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-duplicati-host.example.com

certbot obtains a certificate, edits the nginx site to serve TLS on port 443, and sets up automatic renewal. The reverse-proxy configuration that fronts Duplicati, including the WebSocket upgrade, is preserved.

Step 10: Change the Web Password

The per-instance web password is stored in the Duplicati service configuration on the instance. To change it, edit the --webservice-password value in /etc/default/duplicati and restart the service:

sudo sed -i 's/--webservice-password=[^ "]*/--webservice-password=<new-password>/' /etc/default/duplicati
sudo systemctl restart duplicati

You can also change the server passphrase from the Settings screen shown in Step 8. Either way, the new password takes effect immediately and the old one stops working.

Support

cloudimg provides 24/7 technical support by email and chat for this image, including help with deployment, HTTPS and reverse-proxy configuration, backup destination and retention planning, and storage sizing and upgrades. Contact details are available on the AWS Marketplace listing and at www.cloudimg.co.uk.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.