Netgrimoire/Infrastructure/Backups.md

title	description	published	date	tags	editor	dateCreated
Setting Up Kopia		true	2026-01-25T19:01:47.656Z		markdown	2026-01-23T22:14:17.009Z

Configure Kopia on ZNAS

Installed docker on ZNAS SERVER CERT SHA256: 696a4999f594b5273a174fd7cab677d8dd1628f9b9d27e557daa87103ee064b2

1. Used the gui to create the first repository at /srv/vault/kopia_repository
2. Entered the kopia container on znas docker exec -it <name> /bin/sh
3. From the cli inside the container created the user for docker2 kopia server users add --ask-password admin@docker2

Configure Kopia on first client

1. Use wget to get the kopia apt package and install on client
2. use dpkg to install on client
3. If this host has been configured before, remove old repository:

• sudo kopia repository disconnect || true
• sudo rm -rf /root/.config/kopia

4. Add new repository: `sudo kopia repo connect server --url=https://192.168.5.10:51515 --override-username=admin --server-cert-fingerprint=696a4999f594b5273a174fd7cab677d8dd1628f9b9d27e557daa87103ee064b2
5. Create snapshot: sudo kopia snapshot create /DockerVol/
6. Add cronjob: sudo crontab -e added: */180 * * * * /usr/bin/kopia snapshot create /DockerVol >> /var/log/kopia-cron.log 2>&1

Configure Kopia on Cindys desktop

1. wised winget to get the ui and cli version
2. Created user cindy@DESKTOP-QLSVD8P on repository server (password LucyDog123)
3. On windows - kopia repo connect server --url=https://192.168.5.10:51515 --override-username=cindy --server-cert-fingerprint=696a4999f594b5273a174fd7cab677d8dd1628f9b9d27e557daa87103ee064b2
4. Ran first snapshot: kopia snapshot create C:\Users\cindy
5. When createing taks for cindy used password Harvey123=

kopia snapshot create C:\Users\cindy

That’s it — this creates the initial full snapshot.

First run will:

Take the longest

Upload all data

Build indexes

Let it finish.

3️⃣ Watch progress (optional)

Kopia is chatty by default, but you can add more detail:

kopia snapshot create C:\Users\cindy --progress

Or quieter:

kopia snapshot create C:\Users\cindy --log-level=info

4️⃣ Confirm the snapshot exists

After it completes:

kopia snapshot list

You should see an entry like:

Source: C:\Users\cindy

With a snapshot ID and timestamp.

5️⃣ (Strongly recommended) Test a restore

Pick one small file and restore it somewhere safe:

kopia snapshot restore ` --target C:\Temp\KopiaRestoreTest

Open the file. If it works, your backup is legit.

Common first-run gotchas (quick fixes) ❗ Permission errors

If you see access denied:

Run PowerShell as Cindy

Or add:

--ignore-permissions

❗ Massive junk folders

If it’s slow or huge, consider excluding:

kopia policy set --global --add-ignore "\AppData\Local\Temp**" ` --add-ignore "\AppData\Local\Packages**"

What happens next

Future runs = incremental

Nightly backups will be much faster

Repo is deduplicated + encrypted

Useful follow-up commands kopia snapshot diff --latest C:\Users\cindy kopia snapshot verify kopia snapshot list --all

If you want next:

Schedule this via Task Scheduler

Split policies (Documents vs everything else)

Add backup failure notifications

Tune performance for LAN speed

Just say the word.

I would like to schedule a nightly backup

Perfect — let’s wire this up so it just runs every night and you never think about it again 😄 This is the clean, reliable way to schedule Kopia CLI on Windows.

I’ll assume:

Repo is already connected

You want to back up C:\Users\cindy

You’re okay using Windows Task Scheduler (best option)

1️⃣ Create a backup script (recommended)

Create a folder:

C:\Scripts

Create this file:

C:\Scripts\kopia-nightly.ps1

Put this in it:

Set repo password (simplest method)

$env:KOPIA_PASSWORD = "YOUR_REPOSITORY_PASSWORD"

Run backup

kopia snapshot create C:\Users\cindy --progress

🔐 Secure the script

Right-click → Properties → Security

Ensure only your user has read access

This prevents password exposure

If you want a more secure option later, we can move the password to Windows Credential Manager.

2️⃣ Create the scheduled task

Press Win + R → type:

taskschd.msc

Create Task (not “Basic Task”)

General tab

Name: Kopia Nightly Backup

✔ Run whether user is logged on or not

✔ Run with highest privileges

Configure for: your Windows version

Triggers tab

New…

Begin task: On a schedule

Daily

Time: 2:00 AM (or whenever you like)

✔ Enabled

Actions tab

New…

Action: Start a program

Program/script:

powershell.exe

Add arguments:

-ExecutionPolicy Bypass -File C:\Scripts\kopia-nightly.ps1

Start in:

C:\Scripts

Conditions tab (important)

Recommended settings:

✔ Wake the computer to run this task

❌ Stop if the computer switches to battery (your choice)

❌ Start only if on AC power (recommended for laptops)

Settings tab

✔ Allow task to be run on demand

✔ Run task as soon as possible after a scheduled start is missed

❌ Stop the task if it runs longer than… (don’t limit it)

3️⃣ Test the task immediately

Right-click the task → Run

Then check:

kopia snapshot list

You should see a fresh snapshot.

4️⃣ (Strongly recommended) Add logging

Update your script to this:

$env:KOPIA_PASSWORD = "YOUR_REPOSITORY_PASSWORD"

kopia snapshot create C:\Users\cindy --progress | Tee-Object -FilePath C:\Logs\kopia.log -Append

Create the log folder once:

mkdir C:\Logs

Now you have a paper trail if anything ever fails.

5️⃣ Common laptop gotchas (especially Dell Latitudes)

Make sure:

Sleep is disabled or delayed overnight

Lid close action = Do nothing

Network adapter power saving = ❌ disabled

Otherwise the task runs, but the network drops mid-backup.

Quick health checks (monthly) kopia snapshot list kopia snapshot verify kopia repository status

Optional next upgrades

If you want, I can help you:

🔐 Store the password securely (no plaintext)

📧 Email yourself on backup failure

🗂️ Add multiple sources with different policies

🧹 Schedule weekly maintenance automatically

🐧 Verify snapshots from the Linux server

Just tell me how “hands-off” you want this to be — you’re already 90% of the way to a pro-grade backup setup 💪

user does not know her windows password, only her pin

Ah — that’s an important detail 👍