Backups
Configure where server backups are stored — operator destinations and per-user Google Drive.
Struxa backups are stored through backup destinations: operator-owned storage (object storage, Proxmox Backup Server, restic, and more) plus an optional per-user Google Drive integration. All destination configuration lives in the Panel database; Wings fetches what it needs at backup time.
Backup destinations
Destinations are configured at two levels:
- Fleet-wide default — Admin → Settings → Backups. Every node uses it unless the node has its own destination.
- Per-node override — node create/edit pages (Admin → Nodes). Replaces the fleet-wide default for that node's servers.
With neither set, backups fall back to the local Wings adapter and are stored on the node itself. All destination config, including secrets, is encrypted at rest with the instance DATABASE_ENCRYPTION_KEY.
| Type | What it needs | Notes |
|---|---|---|
| Local (wings) | nothing | Backups land in the node's local backup directory |
| ddup-bak | nothing | Deduplicated backups via the node's ddup-bak installation |
| S3 / Object Storage | endpoint, region, bucket, access/secret keys | Uploads use presigned multipart (64 MiB parts). Panel downloads are opt-in per destination — see below |
| Restic | repository URL, optional password, retry lock, env vars | Password travels to Wings as RESTIC_PASSWORD |
| Proxmox Backup Server | URL, datastore, token, optional namespace/fingerprint | |
| Kopia | repository URL, username/password, optional fingerprint/tags |
S3 downloads from the panel are opt-in per destination (Allow downloads from the panel). With them on, users download backup files directly in the browser — for that to work, the S3 endpoint must be publicly reachable from users' browsers, not just from your nodes.
Google Drive
Users can save backups to their personal Google Drive. This is fully optional — nothing appears in the UI until an operator configures it.
Operator setup
- Create a Google Cloud project and enable the Drive API
- Create OAuth client credentials (Web application) in Google Cloud Console
- Add the redirect URI shown in Admin → Settings → Backups (
{panel URL}/api/account/google-drive/callback) - Paste the client ID and secret in Admin → Settings → Backups and save
While your Google app is in testing mode (the default), add each user's email as a test user in the Google Cloud Console. Testing mode also expires refresh tokens after 7 days — for a long-running setup, publish the app (consent screen → In production) so scheduled backups keep working.
User flow
- Connect the account: Account → Google Drive → Connect Google Drive (grants
drive.file+userinfo.email— only files created by Struxa are accessible) - On a server's Backups page the create button becomes a dropdown — choose Backup to Google Drive
- Backups land in
Struxa Backups/{server name} (id)in the user's Drive; rows show a Google badge
Download, restore, and delete work exactly like other backups — downloads stream through the Panel, restores are pulled by Wings, and deleting a backup removes the Drive file too (including schedule-driven retention deletes). If the Drive file can't be deleted (for example, after the account was disconnected), the backup row in the Panel is still removed and the file stays in Drive.
Behavior notes
- Drive backups use the user's own Google storage, so they count separately from plan backup limits
- Disconnecting revokes the Google token server-side. Existing backups stay listed, but their files can no longer be fetched or deleted from Drive — reconnect the account to clean them up
- Reconnect with the same Google account you used originally — that keeps existing backups tied to your Drive