So I am a new Kopia user. I installed KopiaUI on windows, and am very happy with the results when connecting to my Synology SAN over SMB. Very low CPU usage, 1%, while my WiFi was saturated at 200Mbps
But I was trying to get this to work with a Kopia repository server on the NAS.
So I setup a docker on my NAS. Also setup a reverse proxy with LetsEncrypt for HTTPS, and in the docker/NAS, setup a local repositury to a shared local volume. So far all of that is working.
When I connect to https://backup.example.fake:51515, I get a no security warning, thanks to the LetsEncrypt certificate. And when I logon with the UI user kopia and its password, I get the normal UI in which I setup said local repository
So below image is Kopia running in a docker on the Synology NAS
Next I setup client users from the command line:
However, when I try to connect with the Windows KopiaUI, and I setup a remote repository connection, I of course used above internal user, but that user gets a authority failure
What am I doing wrong?
Copying the error text here for easier reading
Connect Error: INTERNAL: internal server error: connect error: error opening
repository: error connecting to API server: unable to establish session for
purpose=: error establishing session: unable to initialize session: rpc error:
code = Unauthenticated desc = unexpected HTTP status code received from server:
401 (Unauthorized); transport: received unexpected content-type "text/plain;
charset=utf-8": EOF
Some answers I have found with some digging (thanks u/Floss_Patrol_76)
Self-Signed certificate
I was unable to point directly, because I could not figure out what TLS fingerprint was used. But just drop in any fake fingerprint, connect, and the error will tell you it cannot connect because it was expecting fingerprint xyz… Doh!
Also, if you open it in a browser, and inspect the certificate, it wills show the fingerprint, be it that you have to remove the semicolons.
The actual problem
I was using a reverse proxy that only supports HTTP (the Synology build in NGINX based one) but KopiaUI refuses to fall back to HTTP, demands HTTP2/gRPC for its API connection
So KopiaUI tries gRPC authentication, which is a HTTP2 related thing, gets a HTTP1.1 response back, and fails.
The actual solution
Not sure, NGINX does support gRPC, but Synology does not expose it. Either I load the LetsEncrypt certificates directly into Kopia Server (would be best, but how, and how to auto-renew) or I accept the self-signed fingerprint solution. Doing the latter for now.
A little sidenote, but further useful tip that I am dropping here so I can find it back myself:
You can exclude Kopia from MS defender and thus save a LOT of CPU. Because most CPU goes into the malware check of all the reads, not in Kopia itself:
PS C:\Windows\system32> Add-MpPreference -ExclusionProcess C:\Users\<myuser>\AppData\Local\Programs\KopiaUI\resources\server\kopia.exe
Also checking back, I see FreeFileSync already does the same trick.
PS C:\Windows\system32> (Get-MpPreference).ExclusionProcess
C:\Program Files\FreeFileSync\Bin\FreeFileSync_*.exe
C:\Program Files\FreeFileSync\FreeFileSync.exe
C:\Users\<myuser>\AppData\Local\Programs\KopiaUI\resources\server\kopia.exe
