Docker Duplicity Backup

Backup solution for Docker volumes based on Duplicity

Usage

Warning

The following instructions might be outdated, let me know if something doesn't work!

Note

The following instructions assume Google Drive is used as a storage backend; refer to duplicity's man page to find out how to configure different backends!

Backup

Create a new volume in Docker with the name duplicity_credentials:
```
# docker volume create duplicity_credentials
```
Create a new file in the host system with the name /root/secrets/backup/passphrase.txt, and enter in it a secure passphrase to use to encrypt files:
```
# echo 'CorrectHorseBatteryStaple' >> /root/secrets/backup/passphrase.txt
```
Obtain Desktop Application OAuth credentials from the Google Cloud Console.

Create a new file in the host system with the name /root/secrets/backup/client_config.yml, and enter the following content in it:

# edit /root/secrets/backup/client_config.yml

client_config_backend: settings
client_config:
    client_id: "YOUR_GOOGLE_CLIENT_ID_GOES_HERE"
    client_secret: "YOUR_GOOGLE_CLIENT_SECRET_GOES_HERE"
save_credentials: True
save_credentials_backend: file
save_credentials_file: "/var/lib/duplicity/credentials"
get_refresh_token: True

Add the following keys to the compose.yml file of the project you want to backup:

# edit ./compose.yml

Connect the previously created duplicity_credentials volume to the project:

volumes:
    duplicity_credentials:
        external: true

Setup the two previously created files as Docker secrets:

secrets:
    duplicity_passphrase:
        file: "/root/secrets/duplicity/passphrase.txt"
    google_client_config:
        file: "/root/secrets/duplicity/client_config.yml"

Add the following service:

services:
    duplicity:
        image: "ghcr.io/steffo99/backup-duplicity:latest"
        restart: unless-stopped
        secrets:
            - google_client_config
            - duplicity_passphrase
        volumes:
            - "duplicity_credentials:/var/lib/duplicity" 
            # Mount whatever you want to backup in subdirectories of /mnt
            - ".:/mnt/compose"  # Backup the current directory?
            - "data:/mnt/data"  # Backup a named volume?
        environment:
            MODE: "backup"  # Change this to "restore" to restore the latest backup
            DUPLICITY_TARGET_URL: "pydrive://YOUR_GOOGLE_CLIENT_ID_GOES_HERE/Duplicity/this"  # Change this to the Drive directory you want to backup files to https://man.archlinux.org/man/duplicity.1.en#URL_FORMAT
            # Don't touch these, they allow the program to read the secrets
            DUPLICITY_PASSPHRASE_FILE: "/run/secrets/duplicity_passphrase"
            GOOGLE_DRIVE_SETTINGS: "/run/secrets/google_client_config"

# docker compose run -i --entrypoint=/bin/sh duplicity /etc/periodic/daily/backup.sh

Properly start the container with:

# docker compose up -d && docker compose logs -f

Restore

Create a new volume in Docker with the name duplicity_credentials:
```
# docker volume create duplicity_credentials
```
Create a new file in the host system with the name /root/secrets/backup/passphrase.txt, and enter in it a secure passphrase to use to encrypt files:
```
# echo 'CorrectHorseBatteryStaple' >> /root/secrets/backup/passphrase.txt
```
Obtain Desktop Application OAuth credentials from the Google Cloud Console.