Docker preload file not loading – "Missing encryption key, unable to encrypt your settings database"

Support
1

I’m trying to set up Duplicati in a Docker container using a preload file to initialize the settings encryption key and the web UI password. However, when I start the container, I always get the following error:

duplicati  | Missing encryption key, unable to encrypt your settings database
duplicati  | Please set a value for SETTINGS_ENCRYPTION_KEY and recreate the container

My preload.json looks like this:

{
  "env": {
    "server": {
      "SETTINGS_ENCRYPTION_KEY": "password",
      "DUPLICATI__WEBSERVICE_PASSWORD": "password"
    }
  }
}

The file is located in the same directory as my docker-compose.yml:

/mnt/Rust/configs/dockge/stacks/duplicati

Permissions are:

-rwxrwxrwx 1 root root 140 Jun 28 12:25 preload.json

My docker-compose.yml is:

services:
  duplicati:
    image: lscr.io/linuxserver/duplicati:latest
    container_name: duplicati
    environment:
      - PUID=0
      - PGID=0
      - TZ=Europe/Berlin
      - DUPLICATI_PRELOAD_SETTINGS=/run/secrets/preloadsettings
    volumes:
      - /mnt/Rust/configs/duplicati:/config
      - /mnt/Rust/backups:/backups
      - /mnt/Rust/configs:/source/configs:ro
      - /mnt/Rust/truenas-configs:/source/truenas:ro
    ports:
      - 8200:8200
    restart: unless-stopped
    secrets:
      - preloadsettings

secrets:
  preloadsettings:
    file: ./preload.json

networks: {}

From what I can tell:

  • The preload file is in the correct location.

  • Docker appears to mount the secret without errors.

  • The file permissions seem fine.

Am I missing something in the JSON structure or the Docker configuration?

2

Hi @kazoko, welcome to the forum :waving_hand:

These messages are not from Duplicati, so most likely from the LinuxServer Duplicati image.
My guess is that they check that you have an encryption key configured, but this check does not work correctly with a preload settings file.

An untested AI-generated suggestion is to map explicitly with the LSIO way of mapping secrets, instead of using the preload.json:

services:
  duplicati:
    image: lscr.io/linuxserver/duplicati:latest
    container_name: duplicati
    environment:
      - PUID=0
      - PGID=0
      - TZ=Europe/Berlin
      # LSIO reads these files and populates the env variables BEFORE the check runs
      - FILE__SETTINGS_ENCRYPTION_KEY=/run/secrets/db_key
      - FILE__DUPLICATI__WEBSERVICE_PASSWORD=/run/secrets/ui_password
    volumes:
      - /mnt/Rust/configs/duplicati:/config
      - /mnt/Rust/backups:/backups
      - /mnt/Rust/configs:/source/configs:ro
      - /mnt/Rust/truenas-configs:/source/truenas:ro
    ports:
      - 8200:8200
    restart: unless-stopped
    secrets:
      - db_key
      - ui_password

secrets:
  db_key:
    file: ./db_key.txt
  ui_password:
    file: ./ui_password.txt

networks: {}
3

Thanks for the friendly welcome ^^
I did also see this way of mapping however besides the AI I haven’t found much documentation on it besides this overview from linuxserver: linuxserver/duplicati - Docker Image

I wasn’t sure if this was indeed the correct way to do it and was worried it might break something in the container. So far it does seem to work though, I’ll keep it running for a bit and see if it continues working.

For now this seem to be the only way I know of to use secrets with the linuxserver image of duplicati, much appreciated :slight_smile: