diff --git a/duplicati/.env.dist b/duplicati/.env.dist
new file mode 100644
index 0000000..af72596
--- /dev/null
+++ b/duplicati/.env.dist
@@ -0,0 +1,3 @@
+# see https://hub.docker.com/r/linuxserver/duplicati
+PGID=0
+PUID=0
diff --git a/duplicati/.gitignore b/duplicati/.gitignore
new file mode 100644
index 0000000..2eea525
--- /dev/null
+++ b/duplicati/.gitignore
@@ -0,0 +1 @@
+.env
\ No newline at end of file
diff --git a/duplicati/docker-compose.yml b/duplicati/docker-compose.yml
new file mode 100644
index 0000000..6ee24d1
--- /dev/null
+++ b/duplicati/docker-compose.yml
@@ -0,0 +1,16 @@
+version: '3.7'
+
+services:
+  duplicati:
+    image: linuxserver/duplicati:latest
+    container_name: duplicati
+    restart: always
+    env_file: .env
+    ports:
+      - "127.0.0.1:8200:8200/tcp"
+    volumes:
+      - "duplicati-data:/config"
+      - "/var/backups:/source:ro"
+
+volumes:
+  duplicati-data:
diff --git a/duplicati/etc/nginx/sites-available/duplicati.domain.tld.conf.dist b/duplicati/etc/nginx/sites-available/duplicati.domain.tld.conf.dist
new file mode 100644
index 0000000..da4a85a
--- /dev/null
+++ b/duplicati/etc/nginx/sites-available/duplicati.domain.tld.conf.dist
@@ -0,0 +1,22 @@
+server {
+  listen 443 ssl http2;
+  server_name duplicati.server.tld;
+
+  #access_log /var/log/nginx/duplicati.server.tld.access.gz main buffer=16k gzip=9 flush=5m;
+  error_log /var/log/nginx/duplicati.server.tld.error;
+
+  charset utf-8;
+
+  auth_basic "Authentication needed";
+  auth_basic_user_file /var/www/duplicati.server.tld/.htpasswd;
+
+  location / {
+    proxy_pass http://127.0.0.1:8200;
+  }
+
+  #include config/gzip.conf;
+
+  # Wildcard certificate config
+  #include ssl/server.tld.conf;
+  #include config/ssl.conf;
+}