Installation guide · version 0.3.0

From image to first backup.

A production-minded walkthrough covering Docker Compose, first-run setup, Google Drive, reverse proxying, Authentik SSO, and n8n workflow protection.

1. Prerequisites

  • A Linux host with Docker Engine and Docker Compose v2
  • Persistent storage or a NAS location for local copies
  • An HTTPS hostname routed through a reverse proxy
  • Network reachability to Proxmox, SMB storage, n8n instances, and Google APIs
  • A Google OAuth client or Workspace Shared Drive service account
Capacity matters. Worker scratch space must be large enough for archives in transit. Always test a restore before relying on any backup system.

2. Download deployment files

docker-compose.yml

Web, worker, PostgreSQL, state, and local backup volumes.

Download
.env.example

Safe template with no embedded credentials.

Download
mkdir squishybackup && cd squishybackup
curl -O https://squishybackup.thesquishybit.co.uk/downloads/docker-compose.yml
curl -o .env https://squishybackup.thesquishybit.co.uk/downloads/env.example

3. Configure and deploy

Edit .env. Set a long random PostgreSQL password and your final HTTPS URL. Never commit this file.

POSTGRES_PASSWORD=replace-with-a-long-random-password
PUBLIC_URL=https://backup.example.com
HTTP_PORT=8000
TZ=Europe/London
docker login docker.malyon.co.uk
docker compose pull
docker compose up -d
docker compose ps
docker compose logs -f web worker

Open https://backup.example.com/setup and create the first local administrator. Per-install encryption and session keys are generated inside the persistent state volume.

Preserve the state volume. If its credential-encryption key is lost, encrypted host keys, tokens, and integration secrets cannot be recovered.

4. Put HTTPS in front

Proxy the public hostname to the Docker host and HTTP_PORT. Forward the original host and scheme. Only expose the proxy publicly. PUBLIC_URL must exactly match the external origin because it generates OAuth and OIDC callback URLs.

5. Configure Google Drive

Recommended: OAuth for My Drive

  1. Create or select a Google Cloud project and enable the Google Drive API.
  2. Configure the OAuth consent screen and allowed users.
  3. Create a Web application OAuth client.
  4. Add https://backup.example.com/settings/storage/oauth/callback as an authorised redirect URI.
  5. Open Settings → Storage → Google Drive, enter the client ID and secret, and connect.
  6. Choose a writable destination using the folder browser.

Service account for a Shared Drive

  1. Create a service account and JSON key.
  2. Add its email as a member of a Workspace Shared Drive with Content manager access.
  3. Upload or paste the JSON key in the advanced service-account section.
  4. Select a writable Shared Drive folder.
Important: service accounts have no personal Drive storage quota. Use a Shared Drive for service-account uploads, or OAuth for My Drive.

6. Configure Authentik SSO

  1. Keep the local administrator working until SSO is tested.
  2. Create a confidential OAuth2/OpenID Provider in Authentik.
  3. Set the strict redirect URI to https://backup.example.com/auth/callback.
  4. Include openid, profile, and email scopes.
  5. Create an application and attach the provider.
  6. Copy the OpenID configuration URL, client ID, and client secret.
  7. Enter them under Settings → Authentication, enable SSO, and save.
  8. Test in a private browser window before signing out locally.
OpenID configuration URL:
https://auth.example.com/application/o/squishybackup/.well-known/openid-configuration

Callback URL:
https://backup.example.com/auth/callback

7. Add an n8n instance

  1. In self-hosted n8n, open Settings → n8n API and create an API key.
  2. In SquishyBackup, open n8n Backup → Instances.
  3. Enter a display name, the externally reachable base URL, and API key.
  4. Keep TLS verification enabled unless testing with a deliberately self-signed certificate.
  5. Save the instance, then choose Browse workflows.
  6. Create a policy for one workflow or select Protect every active workflow.
  7. Edit the policy to configure cloud/local schedules, retention, and notification overrides.
  8. Run it manually and confirm workflow-specific recovery points.

The all-active policy checks the n8n API every time it runs. Newly activated workflows are included automatically. Restores create a new inactive workflow and can target another enrolled instance.

Also back up n8n itself. Workflow exports do not include credential secrets, execution history, the database, community-node packages, or binary data.

8. Create the first backup

  1. Configure cloud, local storage, or both.
  2. Add a Proxmox host, approve an endpoint, or enroll an n8n instance.
  3. Create a policy and set schedules and retention per destination.
  4. Run it manually and watch Recent activity.
  5. Confirm recovery points at each destination.
  6. Perform a test restore to a non-production target.

9. Upgrade safely

docker compose pull
docker compose up -d

Before upgrades, back up PostgreSQL, the state volume, and deployment files. Archives alone do not preserve policies, users, encryption material, or history.