Installation guide

From image to first backup.

A production-minded walkthrough covering Docker Compose, first-run setup, Google Drive, reverse proxying, and Authentik SSO.

1. Prerequisites

  • A Linux host with Docker Engine and Docker Compose v2
  • Persistent storage or a NAS location for local copies
  • An HTTPS hostname routed through a reverse proxy
  • Network reachability to Proxmox, SMB storage, and Google APIs
  • A Google OAuth client or Workspace Shared Drive service account
Capacity matters. Worker scratch space must be large enough for archives in transit. Always test a restore before relying on any backup system.

2. Download deployment files

docker-compose.yml

Web, worker, PostgreSQL, state, and local backup volumes.

Download
.env.example

Safe template with no embedded credentials.

Download
mkdir squishybackup && cd squishybackup
curl -O https://squishybackup.thesquishybit.co.uk/downloads/docker-compose.yml
curl -o .env https://squishybackup.thesquishybit.co.uk/downloads/env.example

3. Configure and deploy

Edit .env. Set a long random PostgreSQL password and your final HTTPS URL. Never commit this file.

POSTGRES_PASSWORD=replace-with-a-long-random-password
PUBLIC_URL=https://backup.example.com
HTTP_PORT=8000
TZ=Europe/London
docker login docker.malyon.co.uk
docker compose pull
docker compose up -d
docker compose ps
docker compose logs -f web worker

Open https://backup.example.com/setup and create the first local administrator. Per-install encryption and session keys are generated inside the persistent state volume.

Preserve the state volume. If its credential-encryption key is lost, encrypted host keys, tokens, and integration secrets cannot be recovered.

4. Put HTTPS in front

Proxy the public hostname to the Docker host and HTTP_PORT. Forward the original host and scheme. Only expose the proxy publicly; keep the application port private. PUBLIC_URL must exactly match the external origin because it generates OAuth and OIDC callback URLs.

5. Configure Google Drive

Recommended: OAuth for My Drive

  1. Create or select a Google Cloud project and enable the Google Drive API.
  2. Configure the OAuth consent screen and allowed users.
  3. Create an OAuth client ID of type Web application.
  4. Add https://backup.example.com/settings/storage/oauth/callback as an authorised redirect URI.
  5. Open Settings → Storage → Google Drive, enter the client ID and secret, and connect.
  6. Choose a writable destination using the folder browser.

Service account for a Shared Drive

  1. Create a service account and JSON key.
  2. Add its email as a member of a Workspace Shared Drive with Content manager access.
  3. Upload or paste the JSON key in the advanced service-account section.
  4. Select a writable Shared Drive folder.
Important: service accounts have no personal Drive storage quota. Use a Shared Drive for service-account uploads, or OAuth for My Drive.

6. Configure Authentik SSO

  1. Keep the local administrator working until SSO is tested.
  2. Create a confidential OAuth2/OpenID Provider in Authentik.
  3. Set the strict redirect URI to https://backup.example.com/auth/callback.
  4. Include openid, profile, and email scopes.
  5. Create an application and attach the provider.
  6. Copy the OpenID configuration URL, client ID, and client secret.
  7. Enter them under Settings → Authentication, enable SSO, and save.
  8. Test in a private browser window before signing out locally.
OpenID configuration URL:
https://auth.example.com/application/o/squishybackup/.well-known/openid-configuration

Callback URL:
https://backup.example.com/auth/callback

7. Create the first backup

  1. Configure cloud, local storage, or both.
  2. Add a Proxmox host with a scoped API token, SSH key, and verified host fingerprint—or approve an endpoint.
  3. Create a policy and set schedules and retention per destination.
  4. Run it manually and watch Recent activity.
  5. Confirm the archive exists at each destination.
  6. Perform a test restore to a non-production target.

8. Upgrade safely

docker compose pull
docker compose up -d

Before upgrades, back up PostgreSQL, the state volume, and deployment files. Archives alone do not preserve policies, users, encryption material, or history.