# Connect client to repository server

**URL:** https://kopia.discourse.group/t/connect-client-to-repository-server/3780
**Category:** General Topics
**Created:** [March 4, 2025, 8:24am UTC](https://kopia.discourse.group/t/connect-client-to-repository-server/3780 "2025-03-04T08:24:57Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![traezi](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@traezi](https://kopia.discourse.group/u/traezi)
#### Post date: [March 4, 2025, 8:24am UTC](https://kopia.discourse.group/t/connect-client-to-repository-server/3780/1 "2025-03-04T08:24:57Z")

</div>

Hey everyone,

actually i’m going my first steps with Kopia at all and trying to figure out what i’m doing wrong when connecting my first client to the repository server.

My way to go was:

1. install the repository server with the linux debian way:  
docs/installation/#linux-installation-using-apt-debian-ubuntu

2. starting the server the first time:

```auto
/usr/bin/kopia server start --tls-generate-cert --tls-cert-file /etc/ssl/certs/kopia.cert --tls-key-file /etc/ssl/certs/kopia.key --address 0.0.0.0:51515 --server-username=kopia --server-password='my_secret_$assword' --enable-actions

```

1. stopping and starting with my prepared systemd.service:

```auto
[Unit]
Description=Kopia Repository Backup Server
After=syslog.target
After=network.target

[Service]
User=root
Type=simple
ExecStart=/usr/bin/kopia server start --tls-cert-file /etc/ssl/certs/kopia.cert --tls-key-file /etc/ssl/certs/kopia.key --address 0.0.0.0:51515 --server-username=kopia --server-password='my_secret_$assword' --enable-actions
ExecStop=/usr/bin/kopia server shutdown
RemainAfterExit=true
StandardOutput=journal
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target

```

1. creating a nginx reverse proxy for [https://kopia.domain.tld](https://kopia.domain.tld) → [https://my.kopia.srv.ip:51515](https://my.kopia.srv.ip:51515) with Let’s Encrypt certificate

2. creating a repository: (the path is a mounted storage pool)

```auto
kopia repository create filesystem --path=/opt/kopia/repository

```

1. checking the UI with the user from the start command:  
works

2. creating new user for the client:

```auto
kopia server user add root@testclient --user-password='my_super_secret_client_$assword'

```

1. trying to connect the user to the repository server:

```auto
kopia repository connect server --url=https://kopia.domain.tld

Connecting to server 'https://kopia.domain.tld' as 'root@testclient'...
Enter password to open repository: 

ERROR failed to open repository: unable to establish session for purpose=: error establishing session: Session(): failed to exit idle mode: dns resolver: missing port after port-separator colon
ERROR error connecting to API server: unable to establish session for purpose=: error establishing session: Session(): failed to exit idle mode: dns resolver: missing port after port-separator colon

```

(thats not nice - why using a port when using a reverse proxy?)

1. trying again to connect the client with a port:

```auto
kopia repository connect server --url=https://kopia.domain.tld:443

Connecting to server 'https://kopia.domain.tld:443' as 'root@testclient'...
Enter password to open repository:

ERROR failed to open repository: unable to establish session for purpose=: error establishing session: unable to initialize session: rpc error: code = Internal desc = stream terminated by RST_STREAM with error code: PROTOCOL_ERROR: EOF
ERROR error connecting to API server: unable to establish session for purpose=: error establishing session: unable to initialize session: rpc error: code = Internal desc = stream terminated by RST_STREAM with error code: PROTOCOL_ERROR: EOF

```

It’s loading for a long time (about 1-2 minutes?) and then the error comes up. Further it’s not that nice that i need to input the password interactive, cause we would like to automate this with ansible as soon as we have a working way.

Is there someone who would like to give me a hint about what i’m facing here?

Best regards

---

<div class="post-metadata">

### Author: ![traezi](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@traezi](https://kopia.discourse.group/u/traezi)
#### Post date: [March 4, 2025, 9:39am UTC](https://kopia.discourse.group/t/connect-client-to-repository-server/3780/2 "2025-03-04T09:39:54Z")

</div>

So i tested now to give the self signed certificate for grpc the kopia.domain.tld name while generating it and checked it with `openssl x509 -noout -text -in /etc/ssl/certs/kopia.cert` and the name was correct added, then i tried to connect again but unfortunately i’m now facing `failed to verify certificate: x509: certificate signed by unknown authority` …

---

<div class="post-metadata">

### Author: ![dimejo](https://yyz2.discourse-cdn.com/free1/user_avatar/kopia.discourse.group/dimejo/32/287_2.png) [@dimejo](https://kopia.discourse.group/u/dimejo)
#### Post date: [March 4, 2025, 10:26am UTC](https://kopia.discourse.group/t/connect-client-to-repository-server/3780/3 "2025-03-04T10:26:56Z")

</div>

> [@traezi](#):
>
> Hey everyone,

Welcome 👋

Some general notes from me:

> [@traezi](#):
>
> `User=root`

Running your service as root is a really bad habit. There is no need for it when using an unprivileged port.

> [@traezi](#):
>
> `ExecStop=/usr/bin/kopia server shutdown`

This command won’t do anything as it requires authentication. You can add authentication by using environment variables in your systemd service:

```auto
Environment="KOPIA_PASSWORD=repositoryPASSWORD"
Environment="KOPIA_SERVER_ADDRESS=https://[::]:51515"
Environment="KOPIA_SERVER_CERT_FINGERPRINT=yourCERTfingerprint"
Environment="KOPIA_SERVER_CONTROL_PASSWORD=adminPASSWORD"
Environment="KOPIA_SERVER_CONTROL_USER=admin"
Environment="KOPIA_SERVER_PASSWORD=adminPASSWORD"
Environment="KOPIA_SERVER_USERNAME=admin"
ExecStart=kopia server start --address :51515 --tls-cert-file /etc/ssl/certs/kopia.cert --tls-key-file /etc/ssl/certs/kopia.key
ExecReload=kopia server refresh
ExecStop=kopia server shutdown

```

> [@traezi](#):
>
> checking the UI with the user from the start command:  
> works

So the kopia server is working. Great!

> [@traezi](#):
>
> trying to connect the user to the repository server:

Can you connect to the server directly without reverse proxy?

```auto
kopia repository connect server --url=https://my.kopia.srv.ip:51515 

```

> [@traezi](#):
>
> Further it’s not that nice that i need to input the password interactive, cause we would like to automate this with ansible as soon as we have a working way.

You can use the `KOPIA_PASSWORD` environment variable.

> [@traezi](#):
>
> Is there someone who would like to give me a hint about what i’m facing here?

Unfortunately I’ve never used Kopia with a reverse proxy so can’t help you with that. But this issue indicates that it is possible:

> <https://github.com/kopia/kopia/issues/4382>
>
> I have a reverse proxy exposed using tailscale which exposes my privately hosted… kopia docker-compose:
> 
> \<img width="848" alt="Image" src="https://github.com/user-attachments/assets/9ab3eebe-8890-4e5d-8bcd-50d8db213ca1" /\>
> 
> The Kopia server has a repository backed by a local FS and snapshots of another local directory are being backed up correctly. 
> 
> The Kopia server is defined using (modified from https://kopia.io/docs/installation/#docker-images):
> 
> \`\`\`yaml
> services:
> kopia:
> image: kopia/kopia:latest
> hostname: Hostname
> container\_name: Kopia
> restart: unless-stopped
> command:
> - server
> - start
> - --disable-csrf-token-checks
> - --insecure
> - --address=0.0.0.0:51515
> - --server-username=admin
> - --server-password=${KOPIA\_SERVER\_PASSWORD}
> environment:
> # Set repository password
> KOPIA\_PASSWORD: ${KOPIA\_PASSWORD}
> USER: "User"
> volumes:
> # Mount local folders needed by kopia
> - ${PWD}/config/kopia:/app/config
> - ./${VOLUME\_LIVE}/kopia/logs:/app/logs
> - ./${VOLUME\_LIVE}/kopia/cache:/app/cache
> # Mount local folders to snapshot
> - ./${VOLUME\_BACKUP\_STAGED}/:/data:ro
> # Mount repository location
> - ./${VOLUME\_BACKUP\_ENCRYPTED}/kopia:/repository
> # Mount path for browsing mounted snaphots
> - ${PWD}/kopia\_snapshots:/tmp:shared
> labels:
> traefik.enable: true
> traefik.http.routers.kopia.rule: Host(\`kopia.${DOMAIN}\`)
> traefik.http.services.kopia.loadbalancer.server.port: 51515
> \`\`\`
> 
> This works such that https://kopia.my.domain on my client machine, which has no access to the docker directly shows:
> 
> \<img width="1230" alt="Image" src="https://github.com/user-attachments/assets/73880eee-e269-4de9-ae50-341d2c717981" /\>
> 
> (NOTE: the certificate is generated by lets encrypt via trafiek's integration. The HTTPS certificate is \*not\* available to the kopia server process and the kopia server process is \*not\* started with any TLS directives.
> 
> I've added a username/password for the client, so on the kopia server:
> 
> \`\`\`bash
> root@Hostname:/app# kopia server users list
> \<ME\>@\<CLIENT-MACHINE\>
> \`\`\`
> 
> On the client machine I'm trying to connect to the kopia server and it fails:
> 
> \`\`\` bash
> ❯ kopia repository connect server --url https://kopia.my.domain
> Connecting to server 'https://kopia.my.domain' as '\<ME\>@\<CLIENT-MACHINE\>'...
> Enter password to open repository: 
> 
> ERROR failed to open repository: unable to establish session for purpose=: error establishing session: Session(): failed to exit idle mode: dns resolver: missing port after port-separator colon
> ERROR error connecting to API server: unable to establish session for purpose=: error establishing session: Session(): failed to exit idle mode: dns resolver: missing port after port-separator colon
> \`\`\`
> 
> The \[instructors for connecting to the client\](https://kopia.io/docs/repository-server/) state:
> 
> "kopia repository connect server --url https://\<address\>:51515 \\
> --server-cert-fingerprint 48537cce585fed39fb26c639eb8ef38143592ba4b4e7677a84a31916398d40f7"
> 
> but I don't \_have\_ a certificate fingerprint defined for the server? 
> 
> Can somebody please clarify:
> - is the fact this is reverse proxied with a TLS from letsencrypt a red herring? I assume so.
> - how do I get the server fingerprint
> 
> Thanks!

---

<div class="post-metadata">

### Author: ![traezi](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@traezi](https://kopia.discourse.group/u/traezi)
#### Post date: [March 4, 2025, 11:17am UTC](https://kopia.discourse.group/t/connect-client-to-repository-server/3780/4 "2025-03-04T11:17:11Z")

</div>

> [@dimejo](#):
>
> This command won’t do anything as it requires authentication. You can add authentication by using environment variables in your systemd service:

thanks for that, helped alot to get the start/stop command smaller and working

> [@dimejo](#):
>
> Can you connect to the server directly without reverse proxy?

yep, that worked after i used the fingerprint, before it reported that it is a unknown authority

As we discussed intern, we will stay on that, cause we will use the reverse proxy just for access from our roadwarrior vpn clients to access the ui - we will use the internal address (`my.kopia.srv.ip:51515`) for the clients to connect so we dont need to trust on a working dns

So actually i had successful run creating a snapshot from the client with:

```auto
kopia repository connect server --url=https://my.kopia.srv.ip:51515 --server-cert-fingerprint MYWONDERFULFINGERPRINT

```

---

<div class="post-metadata">

### Author: ![dimejo](https://yyz2.discourse-cdn.com/free1/user_avatar/kopia.discourse.group/dimejo/32/287_2.png) [@dimejo](https://kopia.discourse.group/u/dimejo)
#### Post date: [March 4, 2025, 2:46pm UTC](https://kopia.discourse.group/t/connect-client-to-repository-server/3780/5 "2025-03-04T14:46:35Z")

</div>

Glad you got it working! 🙂

---

<div class="post-metadata">

### Author: ![traezi](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@traezi](https://kopia.discourse.group/u/traezi)
#### Post date: [March 5, 2025, 1:47pm UTC](https://kopia.discourse.group/t/connect-client-to-repository-server/3780/6 "2025-03-05T13:47:14Z")

</div>

Unfortunately i didnt… So i thought i got it so i started to test my first playbook (yeah, its dirty, first version is just to get the right steps in the right order).

```auto
---
- name: Install Kopia and configure server
  hosts: all
  become: true
  tasks:

    - name: Add Kopia GPG key
      ansible.builtin.shell: |
        curl -s https://kopia.io/signing-key | sudo gpg --batch --yes --dearmor -o /etc/apt/keyrings/kopia-keyring.gpg

    - name: Füge Kopia Sources hinzu
      ansible.builtin.template:
        src: kopia.sources.j2
        dest: /etc/apt/sources.list.d/kopia.list
        mode: '0644'
      tags:
        - kopia

    - name: Update apt package list
      ansible.builtin.apt:
        update_cache: yes
        cache_valid_time: 10
      tags:
        - kopia

    - name: Install Kopia
      ansible.builtin.apt:
        name: kopia
        state: present
      tags:
        - kopia

    - name: Get client hostname
      ansible.builtin.set_fact:
        client_hostname: "{{ ansible_hostname }}"

    - name: Delegate to the Kopia server to add user
      delegate_to: "{{ kopia_server }}"
      ansible.builtin.command:
        cmd: "kopia server user add root@{{ client_hostname }} --user-password='lalala123'"
      tags:
        - kopia

    - name: Refresh users
      delegate_to: "{{ kopia_server }}"
      ansible.builtin.shell: |
        kopia server refresh --address=https://kopia.domain.lan:51515 --server-cert-fingerprint 8997392FAE6A276F1169D920178D23BD3F6CB38D54BDE313B5FF5C9A23C4ED65 --server-control-username=kopia --server-control-password='lalala123'

    - name: Connect to Kopia repository
      ansible.builtin.shell: |
        export KOPIA_PASSWORD='lalala123'
        kopia repository connect server --url=https://kopia.domain.lan:51515 --server-cert-fingerprint MYWONDERFULFINGERPRINT
      tags:
        - kopia

```

The connection of the client fails with:

```auto
ERROR failed to open repository: unable to establish session for purpose=: 
error establishing session: unable to initialize session: 
rpc error: code = PermissionDenied desc = access denied for root@dev: EOF

ERROR error connecting to API server: unable to establish session for purpose=: 
error establishing session: unable to initialize session: 
rpc error: code = PermissionDenied desc = access denied for root@dev: EOF

```

Do you can see any issue in the order of the commands?

and yeah…i will change it to other user soon^^ …

---

<div class="post-metadata">

### Author: ![dimejo](https://yyz2.discourse-cdn.com/free1/user_avatar/kopia.discourse.group/dimejo/32/287_2.png) [@dimejo](https://kopia.discourse.group/u/dimejo)
#### Post date: [March 5, 2025, 2:30pm UTC](https://kopia.discourse.group/t/connect-client-to-repository-server/3780/7 "2025-03-05T14:30:02Z")

</div>

> [@traezi](#):
>
> Do you can see any issue in the order of the commands?

Can’t spot any obvious mistakes but you should make sure you are using the same user on the server and the client. Replace `root@{{ client_hostname }}` with a static value and use the same value on the host. You can use `--override-username=root --override-hostname=dev` to override settings when connecting to the client.

Edit: Make sure to lowercase `username@hostname` and remove and domain parts.

---

<div class="post-metadata">

### Author: ![traezi](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@traezi](https://kopia.discourse.group/u/traezi)
#### Post date: [March 6, 2025, 7:17am UTC](https://kopia.discourse.group/t/connect-client-to-repository-server/3780/8 "2025-03-06T07:17:20Z")

</div>

So in the actual case i’m creating a new user for that new client on the repository server which results in this case in `root@dev` (yeah, lowercase, no tld part) - i’ve checked that user existence. Then i refresh the server so the users get loaded up cause i have read anywhere, that otherwise this can take up to 5 minutes. After that i’m trying to connect to the repository from the client where the access denied issue appears.

I’ve tested again this morning after this user now exists nearly 16 hours. Still the same…

//edit…seems like it was a typo in the password…

---

<div class="post-metadata">

### Author: ![dimejo](https://yyz2.discourse-cdn.com/free1/user_avatar/kopia.discourse.group/dimejo/32/287_2.png) [@dimejo](https://kopia.discourse.group/u/dimejo)
#### Post date: [March 6, 2025, 7:23am UTC](https://kopia.discourse.group/t/connect-client-to-repository-server/3780/9 "2025-03-06T07:23:20Z")

</div>

> [@traezi](#):
>
> //edit…seems like it was a typo in the password…

Happens to the best. I’ve already wasted days or weeks of my lifetime because of typos and oversights! 😂