How to properly setup kopia repository server via docker?

[dimejo]

Hey @shalak,

please take a look at this post, which should hopefully answer some questions regarding the Repository Server and password variables.

@shalak

what are the KOPIA_PASSWORD and USER envs?

AFAICT the USER variable is never used. Maybe a copy & paste leftover.

@shalak

what is the basic auth user for? Only for the GUI? What about Clients A & B? Do they need to know those credentials?

Basic auth is only used for WebUI access. Clients don’t need to know this credentials when connected through Repository Server. You can omit this settings and disable the WebUI if you don’t plan on using it.

@shalak

do we really need cache to be persistent?

Persistent cache isn’t necessary but might be helpful when your server is connected to a slow storage backend (e.g. high latency SFTP).

@shalak

why do I need to mount /tmp?

Seems to be used for browsing mounted snapshots.

@shalak

When I start the above, the GUI on :51515 wants me to setup repository and lists all the supported backends (S3, SFTP, etc). Should I add one as “Local Directory or NAS”? Should it be /repository?

You can use the WebUI, but I prefer to use CLI. This command should create the repository and automatically use the KOPIA_PASSWORD from your docker-compose file as repository (master) password.
docker exec kopia kopia repo create filesystem --path=/repository

@shalak

So should I add two repositories (/repository/A for client A, and /repository/B for client B, with their corresponding password)? It feels like any repository I’ll add would be only operational for the very instance of Kopia that runs within this container…

There is no need for 2 repositories as users can only see their own snapshots and policies when ACLs are enabled ( kopia server acl enable).

@shalak

And what’s next? Let’s say on Client A (Windows machine) I install Kopia, and I Select Storage Type as “Kopia Repository Server” - it will ask me to enter trusted server certificate fingerprint printed at server startup - where do I find it?

The server certificate fingerprint is printed to your console/logs when you start the server with the --tls-generate-cert parameter. Please see my post here for a mini-tutorial on this topic.