You might try adding :rw after each of your volume paths, like this:

volumes:
      - /path/to/appdata/config:/config:rw

My honest suggestion would be to ditch Duplicati for Duplicacy. Duplicacy is one time payment, but it's much more polished than Duplicati. I actually had major issues with recovering files from Duplicati; sometimes it would work and sometimes it wouldn't. Not ideal for something as critical as backup software.

You've got your path backwards, do:

/var/lib/docker/volumes:/source

And then access the data at /source in Duplicati.

Why are you mounting the volume with the file system path, instead of the volume name? You should be able to mount the volume normally by specifying it in the volume section, i.e.

services:
  duplicati:
    volumes:
      - nextcloud_data:ro

volumes:
  - nextcloud_data
    - external: true

That should grant Duplicati read-only access to the entire volume without messing around with absolute file paths.