minarca-server --version

minarca-server 6.2.5

dpkg -l minarca-server | tail -1

ii  minarca-server 6.2.5        amd64        Minarca is a self-hosted open source data backup software that allows you to manage your computer and server backups for free from a direct online accessible centralized view of your data with easy retrieval in case of displacement, loss or breakage.

minarca -v

minarca 7.2.0

systemctl is-active minarca-server

active

ss -ltn | grep 8080

LISTEN 0      5            0.0.0.0:8080       0.0.0.0:*

curl -s -u admin:admin123 http://127.0.0.1:8080/api/currentuser/

{"id": 1, "username": "admin", "fullname": "", "email": "admin@ops.example.com", "disk_usage": 383149789184, "disk_quota": 843834499072, "lang": "", "mfa": "", "role": 0, "report_time_range": 0, "repos": [{"name": "client01", "maxage": 0, "keepdays": -1, "ignore_weekday": [], "display_name": "client01", "last_backup_date": "2026-10-21T18:07:38Z", "status": "ok", "encoding": "utf-8"}, {"name": "client02", "maxage": 0, "keepdays": -1, "ignore_weekday": [], "display_name": "client02", "last_backup_date": "2026-10-22T05:51:16Z", "status": "ok", "encoding": "utf-8"}]}

minarca-server --help

usage: minarca-server [-h] [-f FILE] [--database-uri URI] [-d]
                      [--admin-user USERNAME] [--admin-password USERNAME]
                      [--default-lang DEFAULT_LANG]
                      [--default-theme {default,blue,orange,custom}]
                      [--environment {development,production}]
                      [--email-encryption {none,ssl,starttls}]
                      [--email-host HOST] [--email-sender EMAIL]
                      [--email-notification-time TIME]
                      [--email-username USERNAME] [--email-password PASSWORD]
                      [--email-send-changed-notification]
                      [--email-catch-all EMAIL] [--brand-favicon FAVICON]
                      [--brand-logo LOGO] [--brand-header-logo HEADER_LOGO]
                      [--brand-header-name HEADER_NAME]
                      [--brand-link-color LINK_COLOR]
                      [--brand-btn-bg-color BTN_BG_COLOR]
                      [--brand-btn-fg-color BTN_FG_COLOR]
                      [--brand-btn-rounded BTN_ROUNDED]
                      [--brand-navbar-color NAVBAR_COLOR]
                      [--brand-font-family FONT_FAMILY] [--add-missing-user]
                      [--add-user-default-role {admin,maintainer,user}]
                      [--add-user-default-userroot ADD_USER_DEFAULT_USERROOT]
                      [--login-with-email] [--ldap-uri LDAP_URI]
                      [--ldap-base-dn DN]
                      [--ldap-scope {base,onelevel,subtree}] [--ldap-tls]
                      [--ldap-username-attribute ATTRIBUTE]
                      [--ldap-user-filter LDAP_USER_FILTER]
                      [--ldap-required-group CN]
                      [--ldap-group-filter LDAP_GROUP_FILTER]
                      [--ldap-group-attribute ATTRIBUTE]
                      [--ldap-group-attribute-is-dn] [--ldap-bind-dn DN]
                      [--ldap-bind-password PASSWORD] [--ldap-version {2,3}]
                      [--ldap-network-timeout SECONDS]
                      [--ldap-timeout SECONDS] [--ldap-encoding ENCODING]
                      [--ldap-fullname-attribute LDAP_FULLNAME_ATTRIBUTE]
                      [--ldap-firstname-attribute LDAP_FIRSTNAME_ATTRIBUTE]
                      [--ldap-lastname-attribute LDAP_LASTNAME_ATTRIBUTE]
                      [--ldap-email-attribute LDAP_EMAIL_ATTRIBUTE]
                      [--oauth-provider-name OAUTH_PROVIDER_NAME]
                      [--oauth-client-id OAUTH_CLIENT_ID]
                      [--oauth-client-secret OAUTH_CLIENT_SECRET]
                      [--oauth-scope OAUTH_SCOPE]
                      [--oauth-auth-url OAUTH_AUTH_URL]
                      [--oauth-token-url OAUTH_TOKEN_URL]
                      [--oauth-userinfo-url OAUTH_USERINFO_URL]
                      [--oauth-userkey-claim OAUTH_USERKEY_CLAIM]
                      [--oauth-fullname-claim OAUTH_FULLNAME_CLAIM]
                      [--oauth-firstname-claim OAUTH_FIRSTNAME_CLAIM]
                      [--oauth-lastname-claim OAUTH_LASTNAME_CLAIM]
                      [--oauth-email-claim OAUTH_EMAIL_CLAIM]
                      [--oauth-required-claims OAUTH_REQUIRED_CLAIMS]
                      [--log-access-file FILE] [--log-file FILE]
                      [--log-level {ERROR,WARN,INFO,DEBUG}]
                      [--max-depth DEPTH] [--quota-set-cmd COMMAND]
                      [--quota-get-cmd COMMAND] [--quota-used-cmd COMMAND]
                      [--remove-older-time TIME] [--server-host IP]
                      [--server-port PORT] [--external-url URL]
                      [--rate-limit-dir FOLDER] [--rate-limit LIMIT]
                      [--session-idle-timeout MINUTES]
                      [--session-absolute-timeout MINUTES]
                      [--session-persistent-timeout MINUTES]
                      [--ssl-certificate CERT] [--ssl-private-key KEY]
                      [--tempdir FOLDER] [--disable-ssh-keys]
                      [--password-min-length PASSWORD_MIN_LENGTH]
                      [--password-max-length PASSWORD_MAX_LENGTH]
                      [--password-score PASSWORD_SCORE]
                      [--latest-version-url LATEST_VERSION_URL]
                      [--welcome-msg HTML] [--minarca-user-base-dir FOLDER]
                      [--minarca-shell FILE] [--minarca-auth-options OPTIONS]
                      [--minarca-remote-host HOST:PORT]
                      [--minarca-remote-host-identity FOLDER]
                      [--minarca-help-url URL]
                      [--minarca-rdiff-backup-extra-args ARGS]
                      [--minarca-quota-api-url URL] [--version]

Web server to browse and restore backups.

Args that start with '--' can also be set in a config file
(/etc/minarca/minarca-server.conf or /etc/minarca/conf.d/*.conf or specified
via -f). Configuration file syntax allows: key=value, flag=true. In general,
command-line values override environment variables which override config file
values which override defaults.

cat /etc/minarca/minarca-server.conf

# Host name or IP address to bind to.
# If you want to bind to all interface, use 0.0.0.0
# Default: 127.0.0.1
server-host=0.0.0.0

session-dir=/var/lib/minarca

ls -A /etc/minarca/conf.d/

placeholder

systemctl restart minarca-server

systemctl is-active minarca-server

active

ss -ltn | grep 8080

LISTEN 0      5            0.0.0.0:8080       0.0.0.0:*

curl -s -o /dev/null -w "%{http_code}\n" -u admin:admin123 http://127.0.0.1:8080/api/currentuser/repos/

200

printf "bogus-key-demo=1\n" > /etc/minarca/conf.d/zz-bogus.conf
systemctl restart minarca-server

systemctl is-active minarca-server

failed

systemctl is-failed minarca-server

failed

journalctl -u minarca-server --no-pager -n 12 | grep -iE "unrecognized|INVALID" | head -5

Oct 22 06:38:22 minarca-server minarca-server[16983]: minarca-server: error: unrecognized arguments: --bogus-key-demo=1
Oct 22 06:38:22 minarca-server systemd[1]: minarca-server.service: Main process exited, code=exited, status=2/INVALIDARGUMENT

rm -f /etc/minarca/conf.d/zz-bogus.conf
systemctl restart minarca-server

systemctl is-active minarca-server

active

ls -A /etc/minarca/

id_rsa0
id_rsa0.pub
known_hosts0
minarca0.properties
minarca1.properties
patterns0
patterns1

cat > /etc/minarca/conf.d/zz-doc-test.conf <<CONF
server-port=8400
header-name=Ops Backup Center
welcome-msg=Welcome to the Ops Backup Center
default-lang=fr
log-level=DEBUG
remove-older-time=23:59
disable-ssh-keys=True
CONF
systemctl restart minarca-server

systemctl is-active minarca-server

active

ss -ltn | grep -E "8400|8080"

LISTEN 0      5            0.0.0.0:8400       0.0.0.0:*

rm -f /etc/minarca/conf.d/zz-doc-test.conf
systemctl restart minarca-server

ss -ltn | grep 8080

LISTEN 0      5            0.0.0.0:8080       0.0.0.0:*

ls -la /etc/minarca

total 1216
drwxr-x--- 3 minarca minarca    4096 Oct 21 17:51 .
drwxr-xr-x 1 root    root       4096 Oct 21 18:04 ..
drwxr-x--- 2 minarca minarca    4096 Oct 21 17:49 conf.d
-rw-r----- 1 minarca minarca     160 Apr 21  2025 minarca-server.conf
-rw-r--r-- 1 minarca minarca    4096 Oct 21 17:51 rdw.db
-rw-r--r-- 1 minarca minarca   32768 Oct 21 18:12 rdw.db-shm
-rw-r--r-- 1 minarca minarca 1182472 Oct 21 18:11 rdw.db-wal

grep -m 3 "DEBUG" /var/log/minarca/server.log

[2026-10-22 06:04:18,102][DEBUG  ][-][-][MainThread][tzlocal] /etc/timezone found, contents:
[2026-10-22 06:04:18,102][DEBUG  ][-][-][MainThread][tzlocal] /etc/localtime found
[2026-10-22 06:04:18,103][DEBUG  ][-][-][MainThread][tzlocal] 2 found:

tail -3 /var/log/minarca/shell.log

[2026-10-22 05:52:21,699][INFO   ][10.89.66.3][admin][PID:11307][__main__] rdiff-backup terminated successfully
[2026-10-22 06:19:50,009][INFO   ][10.89.66.3][admin][PID:16278][__main__] running command [/usr/bin/rdiff-backup-2.2 --server] in jail [/backups/admin] for: minarca/7.2.0 rdiff-backup/2.2.6 (Linux 6.8.0-138-generic x86_64)
[2026-10-22 06:19:50,145][INFO   ][10.89.66.3][admin][PID:16278][__main__] rdiff-backup terminated successfully

curl -s http://127.0.0.1:8080/login/ | grep -o "your session will last[^\"']*" | head -1

your session will last for 0 hour(s).

curl -s http://127.0.0.1:8080/login/ | grep -o "your session will last[^\"']*" | head -1

your session will last for 2 hour(s).

printf "rate-limit=2\n" > /etc/minarca/conf.d/zz-rl.conf
systemctl restart minarca-server

systemctl is-active minarca-server

active

rm -f /var/lib/minarca/ratelimit-*.txt
systemctl restart minarca-server

curl -s -d "login=admin&password=badpass-one" -o /dev/null -w "bad-login-1=%{http_code}\n" http://127.0.0.1:8080/login/

bad-login-1=200

curl -s -d "login=admin&password=badpass-two" -o /dev/null -w "bad-login-2=%{http_code}\n" http://127.0.0.1:8080/login/

bad-login-2=200

curl -s -d "login=admin&password=admin123" -o /tmp/rl429.html -w "good-login-locked=%{http_code}\n" http://127.0.0.1:8080/login/

good-login-locked=429

grep -o "<h2>[^<]*</h2>" /tmp/rl429.html | head -1

<h2>429 Too Many Requests</h2>

curl -s -d "login=admin&password=admin123" -o /dev/null -w "good-login-after=%{http_code}\n" http://127.0.0.1:8080/login/

good-login-after=303

printf "password-min-length=12\n" > /etc/minarca/conf.d/zz-minlen.conf
systemctl restart minarca-server

curl -s -c /tmp/cml -d "login=admin&password=admin123" -o /dev/null -w "login=%{http_code}\n" http://127.0.0.1:8080/login/

login=303

curl -s -b /tmp/cml -d "action=set_password&current=admin123&new=abc123&confirm=abc123&set_password=" http://127.0.0.1:8080/prefs/general/ -o /tmp/ml.html -w "HTTP=%{http_code}\n"

HTTP=200

grep -o "Password must[^<]*" /tmp/ml.html

Password must have between 12 and 128 characters.

curl -s -o /dev/null -w "api=%{http_code}\n" -u admin:admin123 http://127.0.0.1:8080/api/currentuser/repos/

api=200

rm -f /etc/minarca/conf.d/zz-minlen.conf
systemctl restart minarca-server

curl -s -c /tmp/cw -d "login=admin&password=admin123" -o /dev/null -w "login=%{http_code}\n" http://127.0.0.1:8080/login/

login=303

curl -s -b /tmp/cw -d "action=set_password&current=admin123&new=q1w2e3r4&confirm=q1w2e3r4&set_password=" http://127.0.0.1:8080/prefs/general/ -o /tmp/wk.html -w "HTTP=%{http_code}\n"

HTTP=200

grep -o "Password too weak[^<]*" /tmp/wk.html

Password too weak. This is a very common password. Add another word or two. Uncommon words are better.

curl -s -o /dev/null -w "q1w2e3r4-api=%{http_code}\n" -u admin:q1w2e3r4 http://127.0.0.1:8080/api/currentuser/repos/

q1w2e3r4-api=401

curl -s -o /dev/null -w "admin123-intact=%{http_code}\n" -u admin:admin123 http://127.0.0.1:8080/api/currentuser/repos/

admin123-intact=200

curl -s -c /tmp/cm -d "login=admin&password=admin123" -o /dev/null -w "login=%{http_code}\n" http://127.0.0.1:8080/login/

login=303

curl -s -b /tmp/cm -d "action=set_password&current=admin123&new=T3mp-Passphrase-2026%23x&confirm=T3mp-Passphrase-2026%23x&set_password=" http://127.0.0.1:8080/prefs/general/ -o /dev/null -w "chg1=%{http_code}\n"

chg1=303

curl -s -c /tmp/cn -d "login=admin&password=T3mp-Passphrase-2026%23x" -o /dev/null -w "login=%{http_code}\n" http://127.0.0.1:8080/login/

login=303

curl -s -b /tmp/cn -d "action=set_password&current=T3mp-Passphrase-2026%23x&new=admin123&confirm=admin123&set_password=" http://127.0.0.1:8080/prefs/general/ -o /dev/null -w "chg2=%{http_code}\n"

chg2=200

curl -s -o /dev/null -w "admin123-api=%{http_code}\n" -u 'admin:admin123' http://127.0.0.1:8080/api/currentuser/repos/

admin123-api=401

curl -s -c /tmp/cf -d "login=admin&password=admin123" -o /dev/null -w "login=%{http_code}\n" http://127.0.0.1:8080/login/

login=303

curl -s -b /tmp/cf http://127.0.0.1:8080/prefs/general/ | grep -E 'name="action"|name="current"|name="new"|name="confirm"'

    <input name="action" type="hidden" value="set_profile_info">
    <input name="action" type="hidden" value="set_password">
        <input class="form-control" name="current" required type="password" value="">
        <input class="form-control" name="new" required type="password" value="">
        <input class="form-control" name="confirm" required type="password" value="">
    <input name="action" type="hidden" value="update_repos">

curl -s http://127.0.0.1:8400/login/ | grep -n "Ops Backup Center" | head -2

9:        - Ops Backup Center
55:          <img alt="Ops Backup Center"

curl -s http://127.0.0.1:8400/login/ | head -12

<!DOCTYPE html>
<html lang="fr">
  <head>
    
      <title>
        
  Connexion

        - Ops Backup Center
      </title>
      <meta charset="utf-8" />
      <meta content="noindex" name="robots" />

curl -s http://127.0.0.1:8400/login/ | grep -ioE "connecter|identifier" | head -2

connecter

[2026-10-22 06:07:18,607][INFO   ][127.0.0.1][admin][CP Server Thread-6][cherrypy.error.130827192286720] SMTP cannot send email because SMTP Server is not configured

printf "email-host=127.0.0.1:2525\nemail-sender=minarca@ops.example.com\n" > /etc/minarca/conf.d/zz-doc-test.conf
systemctl restart minarca-server

curl -s -c /tmp/cm -d "login=admin&password=admin123" -o /dev/null -w "login=%{http_code}\n" http://127.0.0.1:8080/login/

login=303

curl -s -b /tmp/cm -d "action=set_profile_info&username=admin&fullname=&email=admin%40ops.example.com&set_profile_info=" http://127.0.0.1:8080/prefs/general/ -o /dev/null -w "setemail=%{http_code}\n"

setemail=303

curl -s -b /tmp/cm -d "action=set_password&current=admin123&new=T3mp-Passphrase-2026%23x&confirm=T3mp-Passphrase-2026%23x&set_password=" http://127.0.0.1:8080/prefs/general/ -o /dev/null -w "chg1=%{http_code}\n"

chg1=303

[2026-10-22 06:06:46,516][INFO   ][127.0.0.1][anonymous][CP Server Thread-4][rdiffweb.core.notification] User admin login to web application
[2026-10-22 06:06:46,570][INFO   ][127.0.0.1][admin][CP Server Thread-6][rdiffweb.core.notification] Email address of the user admin has been changed
[2026-10-22 06:06:46,570][INFO   ][127.0.0.1][admin][CP Server Thread-6][rdiffweb.core.notification] can't sent mail to user [admin] without an email
[2026-10-22 06:06:46,692][INFO   ][127.0.0.1][admin][CP Server Thread-8][rdiffweb.core.notification] User's password admin changed

Traceback (most recent call last):
  File "apscheduler/executors/base.py", line 131, in run_job
  File "rdiffweb/plugins/smtp.py", line 132, in _send_message
  File "smtplib.py", line 255, in __init__
  File "smtplib.py", line 341, in connect
  File "smtplib.py", line 312, in _get_socket
  File "socket.py", line 865, in create_connection
  File "socket.py", line 850, in create_connection
ConnectionRefusedError: [Errno 111] Connection refused

rm -f /etc/minarca/conf.d/zz-doc-test.conf
systemctl restart minarca-server

systemctl is-active minarca-server

active

ss -ltn | grep 8080

LISTEN 0      5            0.0.0.0:8080       0.0.0.0:*

[2026-10-22 06:04:15,419][INFO   ][-][-][MainThread][apscheduler.scheduler] Added job "rdiffweb.core.remove_older:cherrypy.remove_older.remove_older_job" to job store "default"

command="export MINARCA_USERNAME='admin' MINARCA_USER_ROOT='/backups/admin';/opt/minarca-server/minarca-shell",no-port-forwarding,no-X11-forwarding,no-agent-for

dpkg -l | grep rdiff-backup

ii  rdiff-backup-1.2            1.2.8-8                                 amd64        remote incremental backup
ii  rdiff-backup-2.0            2.0.5-12                                amd64        Backup and Restore utility, easy to use, efficient, locally and remotely usable
ii  rdiff-backup-2.2            2.2.6-13                                amd64        Backup and Restore utility, easy to use, efficient, locally and remotely usable

ldap-uri=ldap://ldap.example.com:389
ldap-base-dn=dc=my,dc=domain
ldap-user-filter=(objectClass=person)

minarca configure -d /srv/localbak -n local-dest

Linked successfully

cat /etc/minarca/minarca1.properties

#Thu Oct 22 05:52:20 UTC 2026
repositoryname=local-dest
schedule=24
configured=True
pause_until=1792651939269
check_latest_version=True
localmountpoint=/
localuuid=d3d87d74-2704-46f8-a5e8-f571274ec400
localrelpath=srv/localbak
localcaption=localbak
ignore_hook_errors=False

cat /etc/minarca/minarca0.properties

#Thu Oct 22 05:52:21 UTC 2026
username=admin
repositoryname=client02
remotehost=minarca-server
remoteurl=http\://minarca-server\:8080
remoterole=0
schedule=24
configured=True
maxage=0
ignore_weekday=[]
keepdays=-1
check_latest_version=True
ignore_hook_errors=False
remote_capabilities=[]

tail -6 /etc/minarca/patterns0

# Hidden temporary files
-**/.~*
# Vim temporary files
-**/*~
+/srv/data
-**/*.tmp

minarca exclude '**/*.tmp' --instance 0

minarca patterns --instance 0

-/dev
-/proc
-/sys
-/tmp
-/run
-/mnt
-/media
-**/lost+found
-**/.~*
-**/*~
+/srv/data
-**/*.tmp

minarca schedule --hourly

grep schedule /etc/minarca/minarca0.properties

schedule=1

minarca status | grep frequency

Backup frequency:         every 1h  
Backup frequency:         every 1h  

minarca schedule --daily

grep schedule /etc/minarca/minarca0.properties

schedule=24

crontab -l

7,22,37,52 * * * * /opt/minarca/minarca backup

minarca pause -d 6 --instance 0

grep pause_until /etc/minarca/minarca0.properties

pause_until=1792669940957

minarca status | grep -B 1 "Paused"

Backup instance:          client02  
Paused until:             2026-10-22T11:52:20+0000

minarca pause --clear

grep -c pause /etc/minarca/minarca0.properties

0

minarca status

Verifying connection...
----------------------------------------------------
Backup instance:          client02
Identifier:               0
Remote server:            minarca-server
Backup frequency:         every 24h
Connectivity status:      Connected
Last successful backup:   2026-10-22T05:51:19+0000
Last backup date:         2026-10-22T05:51:19+0000
Last backup status:       SUCCESS
----------------------------------------------------
Backup instance:          local-dest
Identifier:               1
Local device:             localbak
Paused until:             2026-10-22T06:52:19+0000
Backup frequency:         every 24h
Connectivity status:      Connected
Last successful backup:   Never
Last backup date:         Never
Last backup status:       UNKNOWN

# ---- 监听 ----
# 监听所有网卡（实测：默认 127.0.0.1 仅本机可访问）
server-host=0.0.0.0
# 端口按需调整，改后需同步客户端 remoteurl 与防火墙（实测 8400 生效）
server-port=8080

# ---- 日志 ----
log-level=INFO

# ---- 会话与限流 ----
# 默认 20 次/小时；团队共享出口 IP 时可调大
rate-limit=60
# 登录会话不活动超时（默认 15 分钟，按安全基线调整）
session-idle-timeout=30

# ---- 口令策略 ----
# zxcvbn 最低分 1-4，默认 2；要求更强口令可提到 3（实测默认策略拒绝常见弱口令）
password-score=3
password-min-length=10

# ---- 邮件通知 ----
email-host=smtp.example.com:587
email-sender=minarca@example.com
email-encryption=starttls
email-username=minarca@example.com
email-password=CHANGE-ME
email-notification-time=22:00

# ---- SSH 备份通道 ----
# SSH 与 Web 不同端口/不同机时必须下发正确地址
minarca-remote-host=backup.example.com:22