Jump to content

Duplicacy S3 Backup to Your Storage Box on PMSS

From Pulsed Media Wiki


Duplicacy S3 Backup to Your Storage Box points Duplicacy — a backup tool built around lock-free deduplication — at a self-hosted S3 endpoint running on your own storage box. You run one small S3 server on the box, then any machine with the duplicacy binary backs up to it over the S3 API: deduplicated and encrypted, restorable to the byte. The repository lives on disk you already pay for, in Pulsed Media's Finnish datacenters, with no per-request and no egress fees.

Duplicacy does the same job as Restic and Kopia; its distinguishing design is lock-free deduplication, which lets many machines and many backups share one repository without a coordinating lock. Note on licensing: the Duplicacy command-line tool is free for personal use — backing up your own data qualifies — while commercial use requires a paid licence. Check the current terms on the project's site before using it in a business.

When Duplicacy over S3

Reach for Duplicacy-over-S3 when you want deduplicated, encrypted backups of one or many machines into a shared repository on disk you control — and its lock-free model appeals (no server process to coordinate concurrent backups). Duplicacy speaks S3-compatible storage natively, so an endpoint on your box is a first-class Duplicacy backend — no cloud provider, no egress bill.

What you need

Two things:

  • An S3 endpoint on your box. The simplest is rclone serve s3 — pre-installed, one command — which is what the walkthrough below uses and was tested against. rclone's S3 server is officially experimental; it handled this backup and restore flawlessly, but for the most battle-tested repository for critical data, MinIO and versitygw work just as well.
  • The duplicacy binary on the machine you back up FROM. It is a single static binary from the releases page.

The backup, verified

Everything below was run end to end on a Pulsed Media storage box: the endpoint started, a repository initialised in it, a backup taken, and the restore came back byte-identical (verified by SHA-256).

A real Duplicacy backup to a self-hosted S3 endpoint on a storage box: init, backup, then a restore whose bytes match the original.

Start the endpoint and point Duplicacy at it. Duplicacy reaches an S3-compatible endpoint over plain HTTP with the minio:// storage scheme; the S3 keys and the repository password go in environment variables: 

# on the box: a one-command S3 endpoint, and a directory that will be the bucket
mkdir -p ~/s3-bucket/dupbackup
rclone serve s3 --addr 127.0.0.1:47021 --auth-key 'MYKEY,MYSECRET' ~/s3-bucket &

export DUPLICACY_S3_ID=MYKEY
export DUPLICACY_S3_SECRET=MYSECRET
export DUPLICACY_PASSWORD="a-strong-repo-passphrase"   # this encrypts everything — keep it safe

Initialise the repository from the directory you want to back up (the -e flag turns on encryption; mydata is this backup's snapshot id), back up, and list: 

$ cd ~/mydata
$ duplicacy init -e mydata minio://us-east-1@127.0.0.1:47021/dupbackup
/home/you/mydata will be backed up to minio://us-east-1@127.0.0.1:47021/dupbackup with id mydata

$ duplicacy backup
Backup for /home/you/mydata at revision 1 completed

$ duplicacy list
Snapshot mydata revision 1 created at 2026-08-17 12:25

Restore. Duplicacy restores into a repository that shares the same snapshot id and storage, so to restore into a fresh directory you init that directory with the same id first, then restore the revision: 

$ cd ~/restored
$ duplicacy init -e mydata minio://us-east-1@127.0.0.1:47021/dupbackup
$ duplicacy restore -r 1 -overwrite
Restoring /home/you/restored to revision 1
Downloaded photo.bin (1048576)
Downloaded docs/notes.txt (26)
Restored /home/you/restored to revision 1

In this test the restored tree was byte-for-byte identical to the original (matching SHA-256 on every file). Inside the bucket you will find Duplicacy's own chunked, deduplicated repository layout — never your plaintext files.

Keep it running

  • Schedule it. Put the export lines and duplicacy backup in a small script and run it from cron. Duplicacy's prune command ages out old revisions when you want to reclaim space.
  • Keep working across a migration. The endpoint's raw address changes if your service is later moved to different hardware. Point the storage URL at your service permalink (<your-label>.mcx.fi) instead of the server name, and scheduled jobs keep pointing at the right endpoint after a move.
  • Many machines, one repo. Duplicacy's lock-free design is built for this — install duplicacy on each machine, init each against the same storage with its own snapshot id, and they deduplicate against each other. Use TLS on your permalink for anything crossing the network.

Security

Duplicacy encrypts on the client, before anything is sent, so the box stores only ciphertext — the repository password never leaves your machine and is not recoverable if lost. Keep the S3 endpoint bound to 127.0.0.1 (or behind TLS on your permalink) rather than exposed, and keep the repository passphrase somewhere separate from the S3 keys.

See also

Retrieved from "https://wiki.pulsedmedia.com/index.php?title=Duplicacy_S3_Backup_to_Your_Storage_Box_on_PMSS&oldid=1004635"