Initial Configuration using Docker


This article will guide you through the initial configuration of CubeBackup in a docker container. If you are using CubeBackup on Windows or Linux directly, please refer to Initial Configuration on Windows or Initial Configuration on Linux.

1. Open the CubeBackup web console

After the docker container has been successfully launched, point your browser to http://<host_IP>:<port number> for the initial configuration.

TIPS:

  • The web console can be accessed using the above URL through any browser within your network.

  • If permitted by your company’s firewall policy, it can also be accessed from outside your network at http://<server_external_ip>:<port>

2. Set backup location

CubeBackup allows you to backup G Suite data to a local disk, network storage or your private Amazon S3 storage.

NOTE: Be sure to set the backup and data index locations in the web console to the docker container paths - not the host paths!

2.1 Backup G Suite data to a local disk

Backup GSuite locally

Storage type: Select “Local disk” from the dropdown list.

Data index path: Select the path you created for the data index on the docker, e.g. /cube_index.

Backup path: Select the path you created for the backup data on the docker, e.g. /gsuite_backup.

Encrypt backups: If you want your backups to be stored encrypted, make sure the “Encrypt backups” option is checked.

Tips for Backup Encryption:

  1. This option cannot be changed after the initial configuration.
  2. Data transfer between the Google Cloud and your storage is always HTTPS/SSL encrypted, whether this option is selected or not.
  3. Encryption may slow down the backup process by around 10%, and cost more CPU cycles.

2.2 Backup G Suite data to network storage

Backup GSuite to NAS

Storage type: Select “Mounted network storage” from the dropdown list.

Data index path: Select the path you created for the data index on the docker, e.g. /cube_index.

Network storage path: Select the path you created for the backup data on the docker, e.g. /gsuite_backup.

Encrypt backups: If you want your backups to be stored encrypted, make sure the “Encrypt backups” option is checked.

Tips for Backup Encryption:

  1. This option cannot be changed after the initial configuration.
  2. Data transfer between the Google Cloud and your storage is always HTTPS/SSL encrypted, whether this option is selected or not.
  3. Encryption may slow down the backup process by around 10%, and cost more CPU.

2.3 Backup G Suite data to Amazon S3

Backup GSuite to Amazon S3

Storage type: Select “Amazon S3” from the dropdown list.

Data index path: Select the path you created for the data index on the docker, e.g. /cube_index.

S3 Bucket: Before you can backup Google Drive, Shared drives, Contacts, Calendar and Sites data to Amazon S3, you will first need to create and configure a private Amazon S3 bucket using the following steps:

  1. Create an Amazon AWS account

    If your company has never used an Amazon AWS service, like Amazon EC2 or Amazon S3, you will need to create an Amazon AWS account. Please visit Amazon AWS, click the Create an AWS Account button, and follow the instructions.

    If you already have an AWS account, you can sign in directly using your account.

  2. Create Amazon S3 bucket

    Amazon S3 (Amazon Simple Storage Service) is one of the most-widely used cloud storage services in the world. It has been proven to be secure, cost-effective, and reliable. Amazon S3 stores data as objects within buckets. Each object consists of a file and attached metadata. Buckets are configurable containers for any data objects, at specific geographic regions, with controlled access and detailed access logs.

    To create your S3 bucket for G Suite backup data, please follow Amazon’s official instructions at: https://docs.aws.amazon.com/AmazonS3/latest/gsg/CreatingABucket.html

    NOTE: After the bucket has been successfully created, you can change the default configuration on the “Properties” page. You may wish to enable “Server access logging” or “Default encryption”, depending on your company policies, but these options are not necessary for the operation of CubeBackup.

    It is strongly recommended that you create a separate bucket only for CubeBackup.

  3. Create an IAM account

    AWS IAM (Identity and Access Management) is a web service that helps you securely control access to AWS resources. The IAM account will be used to control access to the S3 bucket.

    Instead of defining permissions for the IAM account directly, it is more convenient to create a group with predefined policies and then assign the IAM user to that group.

    Here are a few brief instructions for creating an IAM for CubeBackup:

    1. Open the IAM console at https://console.aws.amazon.com/iam/
    2. In the navigation pane, choose “Users” and then choose Add user.
    3. Enter a name for the new user, e.g., CubeBackupS3
    4. Check the Programmatic access option and leave the AWS Management Console access unchecked.
    5. Click Next: Permissions
    6. On the “Set permissions” page, click Create group
    7. On the “Create group” page, enter a group name (e.g., S3Access) and check “AmazonS3FullAccess” policy, then click Create group
    8. Back on the “Set permissions” page, make sure the newly created group is checked, then click Next:Tags
    9. Click Next:Review
    10. On the “Review” page, ensure that all information is correct, and click Create user.
    11. On the final “Add user” page, click Show in the “Secret access key” column. Leave this page open. You will need “Access key ID” and “Secret access key” values for the next step.

In the CubeBackup wizard, you can now enter the name of your Amazon S3 bucket and copy the Access key ID and Secret access key values into the corresponding textboxes.

For more information about creating IAM accounts, please visit: AWS IAM account Guide

Encrypt backups: If you want your backups to be stored encrypted, make sure the “Encrypt backups” option is checked.

  • This option cannot be changed after the initial configuration.
  • Data transfer between the Google Cloud and your storage is always HTTPS/SSL encrypted, whether this option is selected or not.
  • Encryption may slow down the backup process by around 10%, and cost more CPU.

2.4 Backup G Suite Data to AWS S3 compatible storage

CubeBackup supports AWS S3 compatible storage, such as Wasabi. To create a storage bucket on Wasabi Cloud Storage, please refer to backup G Suite data to Wasabi.

Warning: Some users have reported problems with Wasabi. Wasabi’s cloud storage is not as stable as AWS S3. Use at your own risk.

3. Create Google Service account

G Suite Domain

In this step, you are required to input the G Suite domain name, the domain administrator account, and the Service account key file.

What is the Service account key? Why is it needed?
Basically, a service account is a special Google account that is used to call Google APIs, so that users don’t need to be directly involved. Refer to https://cloud.google.com/iam/docs/service-accounts for more information.

To generate the Service account key file, please follow the instructions below:

1. Log in to Google Cloud Console.

Google Cloud Console does not require an administrator account. A personal Google account, such as myname@mycompany.com, or myname@gmail.com is just fine.

2. Create a new project named “CubeBackup”.

Google Cloud Console is a place to manage applications/projects based on Google APIs or Google Cloud Services. Begin by creating a new project.

  • Go to the Projects page in the Google Cloud Console.

This page can be opened by either clicking this link or selecting IAM & admin > Manage resources in the navigation menu.

NOTE: The navigation menu slides out from the left of the screen when you click the main menu icon in the upper left corner of the page.

  • Click CREATE PROJECT.

  • In the New Project page, enter “CubeBackup” as the project name and click CREATE.

NOTE: You can leave the Location and Organisation fields unchanged. They have no effect on this project.

3. Enable Google APIs.

The creation of the project may take one or two minutes. After the project has been created, click the SELECT PROJECT link for the newly created project in the Notifications dialog to make it the active project in your dashboard (you can also go to the Home dashboard by selecting Home from the navigation menu, then select your newly created project in the project list at the top of the page).

Active Project

NOTE: Please make sure this project is the currently active project in your console before continuing!

Now open the API Library page by selecting APIs & services > Library from the navigation menu. Select Google Drive API from the G Suite group. On the next page, click ENABLE. Next, go back to the API Library page and follow the same steps to enable Google Calendar API, Gmail API, Admin SDK, and Google People API (This API might be located in the Social Group).

To check whether all necessary APIs have been enabled, please select APIs & Services > Dashboard from the navigation menu, and make sure Admin SDK, Gmail API, Google Calendar API, Google Drive API, and People API are all included in the API list.

4. Create a Service account.

  • Select IAM & Admin > Service Accounts in the navigation menu.
  • Click +CREATE SERVICE ACCOUNT.
  • In the Service account details step, enter a name for the service account (e.g., cubebackup) and click CREATE.
  • In the second step, select “Project” > “Viewer” as the Role, then click CONTINUE.
  • Click DONE directly in the Grant users access to this service account step.
  • On the Service accounts page, click directly on the service account you just created (Don’t just check the box, click the email link). This should take you to the Service account details page.
  • In the Service account details page, click EDIT, then expand SHOW DOMAIN-WIDE DELEGATION and check Enable G Suite Domain-wide Delegation. If you are asked, enter “CubeBackup” as the Product name for the consent screen.
  • Click SAVE.
  • Click ADD KEY > Create new key on the Keys section.
  • Select JSON as the key type, then click CREATE.
  • Close the dialog that pops up and save the generated JSON key file locally (This file will be used as the service account key in CubeBackup’s configuration wizard).
  • In the end, your service account page should approximately look like this:

Google Service Account

5. Return to the CubeBackup setup page.

After the Service account key file has been generated and downloaded to your local computer, click the Choose File button to select the JSON key file generated in the last step. After the domain name, the G Suite administrator account, and the service account key file are all set, click Next.

GSuite domain

4. Authorize domain-wide access

After creating a Google service account, the created service account needs to be authorized to access your G Suite data through Google APIs.

All operations in this step must be performed by an administrator of your G Suite domain.

  • Sign in to your G Suite domain’s Admin console using a domain administrator account.
  • From the main menu in the top-left corner, select Security > API controls.
  • Click MANAGE DOMAIN WIDE DELEGATION in the “Domain wide delegation” section.
  • In the Domain-wide Delegation page, click Add new.
  • In the Client ID field, enter the service account’s Client ID shown in step 4 of the setup wizard.

service account

  • In the OAuth Scopes field, copy and paste this list of scopes:

    https://www.googleapis.com/auth/admin.directory.domain.readonly,
    https://www.googleapis.com/auth/admin.directory.user.readonly,
    https://www.googleapis.com/auth/admin.directory.orgunit.readonly,
    https://mail.google.com/,
    https://www.googleapis.com/auth/drive,
    https://www.googleapis.com/auth/calendar,
    https://www.googleapis.com/auth/contacts, 
    https://sites.google.com/feeds/ 
    
  • Click AUTHORIZE. G Suite Domain Authorization

  • CubeBackup now has the authority to make API calls in your domain. Return to the CubeBackup setup page, and click the Next button to check if these configuration changes have been successful.

NOTE: If any error messages pop up, please wait a few minutes and try again. In some cases, G Suite domain-wide authorization needs some time to propagate. If it continues to fail, please recheck all your inputs and refer to How do you solve the authorization failed error.

5. Select users

Now you can select which G Suite users you would like to back up.

  • By default, all valid users are selected.
  • You can expand an Organization Unit by clicking the OU to see users in that OU.
  • You can even disable the backup for all users in an OU by deselecting the checkbox beside that OU.

For example, if a school wanted to backup only the data for teachers and not students, they could select the OU for teachers and leave the OU for students unchecked.

select GSuite user

6. Select Shared drives

This option only applies to G Suite Business/Enterprise/Education/Nonprofit organizations who have the shared drives feature enabled. For G Suite Legacy or G Suite Basic organizations, this step will be skipped.

You can select which shared drives you would like to back up.

  • By default, all shared drives are selected.
  • This can be very useful for schools. For example, an administrator may not want to backup shared drives created by students, which could consume a very large amount of storage.

shared drives selection

7. Set administrator password

In this step, you can set up the CubeBackup web console administrator account and password.

  • This account and password is only for the CubeBackup console; it has no relationship with any G Suite services.

  • The default administrator account is the G Suite administrator of your organization, but this is not required. You can make anyone the CubeBackup administrator.

  • Multiple administrator accounts are not supported by the current version of CubeBackup.

admin password

8. More settings

After the initial configuration of CubeBackup, you can log into the CubeBackup web console and select SETTINGS on the left panel for more options.

There are several tabs on this page: The <domain-name> tab affects only the selected domain; the System tab controls global system settings.

Tip: As a G Suite organization, or a G Suite reseller, you may manage more than one G Suite domains. CubeBackup allows you to backup multiple domains in one place.

8.1 G Suite domains management

As a G Suite administrator, you may manage more than one domain. G Suite Partners/Resellers in particular are often responsible for managing many domains for their clients. CubeBackup allows you to manage multiple domains in one place.

You can select the active domain or add a new domain from the drop-down box in the top-right corner of the web console.

  • Adding a new G Suite domain

You can add a new G Suite domain to CubeBackup by clicking + add domain from the drop-down list in the top-right corner of the web console.

On the Add domain screen, enter the G Suite domain name and admin account for the domain you wish to add, then click Next.

Follow the instructions on the next screen to paste the required Service account Client ID and OAuth Scopes into the G Suite admin console. Once the OAuth Scopes have been authorized, click Next.

Now, select the users to backup for the new domain.

  • By default, all valid users are selected.
  • You can expand an Organization Unit by clicking the OU to see users in that OU.
  • You can even disable the backup for all users in an OU by deselecting the checkbox beside that OU. For example, if a school wanted to backup only the data for teachers and not students, they could select the OU for teachers and leave the OU for students unchecked.

  • Finally, click Save.

8.2 Administrator/operator accounts management

Note: Currently, this feature is only available in the V4.5-beta version. If you are using CubeBackup version 4.3.x, you can skip this part.

In step 7 of the initial configuration, an admin account (the system administrator) was created for CubeBackup. The admin account can log into the CubeBackup web console to perform backup and restore jobs, as well as manage all settings for CubeBackup. However, in some cases, multiple administrative accounts with different roles may be needed. For example:

  • An operator who can restore data for any G Suite user without involving the system administrator.
  • If you manage multiple G Suite domains in CubeBackup, it may be helpful to assign each domain a separate administrator/operator.

You can click the Create button in the Accounts tab to add a new administrative account.

create a new account

Roles explanation:

  • System Admin: Full control of CubeBackup.
  • Domain Admin: Administrative powers and permissions for specific domain(s).
  • Domain operator: Backup & restore permissions for any G Suite users in specific domain(s).

For detailed information about different accounts/roles in CubeBackup, please visit Types of accounts in CubeBackup.

NOTE: All accounts created here are administrative accounts. CubeBackup also allows each G Suite user to restore his/her own data in the CubeBackup console using Google OAuth login. Please refer to enable OAuth login for all G Suite users for detailed instructions.

8.3 Network Throttling

Backups for an entire G Suite domain can be quite large, and the backup process can consume considerable network bandwidth. CubeBackup allows you to flexibly control network throttling by setting speed limits for work hours and non-work hours independently. Both work days and work hours can be defined to meet your company’s unique needs.

Throttling

8.4 Email reports

As an administrator, you may not want to constantly sign in to the CubeBackup web console to check the status of the backup service. CubeBackup can send you monthly, weekly, or even daily email reports of backup status, progress, space used, and much more.

For convenience, CubeBackup will send the email reports to recipients using notification@cubebackup.com by default. These reports are generated locally by your backup machine. All details and statistical data used to generate the reports remain private. However, if you wish, you can set up your own SMTP server for these reports.

SMTP

9. Additional information