Cloud Backup

A macOS menu bar application for backing up cloud data to Amazon S3:

• Google Workspace: Backup Takeout data from Google Cloud Storage
• Salesforce: Backup selected objects using Bulk API 2.0 with daily scheduling

Features

• Menu Bar App: Lives in your menu bar for easy access
• Multiple Platforms: Support for Google Workspace and Salesforce
• Incremental Sync: Only transfers new or changed files (GCS)
• Bulk API 2.0: Efficient Salesforce data export using the Bulk API
• Object Selection: Choose which Salesforce objects to backup
• Daily Scheduling: Automatic daily Salesforce backups via launchd
• Progress Tracking: Real-time progress with transfer speeds and ETA
• macOS Notifications: Get notified when backups complete or fail
• Secure Credentials: All credentials stored in macOS Keychain
• Backup History: Track all backup operations

Requirements

• macOS 13.0 (Ventura) or later
• Xcode 15.0 or later
• For Google Workspace: Google Cloud Service Account with Storage Object Viewer permissions
• For Salesforce: Connected App with OAuth enabled
• AWS IAM credentials with S3 write permissions

Building

Quick Build

./build.sh

This creates GWS Backup.app ready to use.

Using Command Line

swift build -c release

Configuration

Google Workspace Setup

1. Go to Google Cloud Console
2. Create or select a project
3. Enable the Cloud Storage API
4. Create a Service Account with "Storage Object Viewer" role
5. Download the JSON key
6. In app Settings > Google Cloud:
   • Import the service account JSON file
   • Enter your GCS bucket name

Salesforce Setup

1. Create a Connected App in Salesforce Setup:

   • Go to Setup > App Manager > New Connected App
   • Enable OAuth Settings
   • Set Callback URL to: gwsbackup://oauth/callback
   • Select OAuth Scopes:
     • api (Access and manage your data)
     • refresh_token, offline_access (Perform requests at any time)
   • Save and wait for activation (can take 2-10 minutes)

2. Get your credentials:

   • Consumer Key (Client ID)
   • Consumer Secret (Client Secret)

3. In app Settings > Salesforce:

   • Enter Client ID and Client Secret
   • Click "Connect to Salesforce" to authenticate
   • Select which objects to backup
   • Configure S3 destination bucket
   • Optionally enable daily scheduling

AWS Setup

1. Go to AWS IAM Console
2. Create a new IAM user with programmatic access
3. Attach a policy allowing S3 access:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "s3:PutObject",
           "s3:GetObject",
           "s3:ListBucket",
           "s3:HeadObject"
         ],
         "Resource": [
           "arn:aws:s3:::your-gcs-backup-bucket",
           "arn:aws:s3:::your-gcs-backup-bucket/*",
           "arn:aws:s3:::your-salesforce-backup-bucket",
           "arn:aws:s3:::your-salesforce-backup-bucket/*"
         ]
       }
     ]
   }

4. In app Settings > AWS S3:
   • Enter your Access Key ID and Secret Access Key

Usage

Menu Bar

Click the cloud icon in your menu bar to:

• See status of both Google Workspace and Salesforce backups
• Start manual backups for either platform
• View scheduled backup information
• Access Settings

Google Workspace Backups

1. Configure GCS and S3 credentials
2. Click "Backup Now" under Google Workspace
3. The app compares files and only transfers new/changed ones

Salesforce Backups

1. Configure Salesforce Connected App credentials
2. Connect to Salesforce via OAuth
3. Select objects to backup (standard and custom objects)
4. Configure S3 destination bucket
5. Click "Backup Now" or enable daily scheduling

Daily Scheduling

Enable automatic daily Salesforce backups:

1. Go to Settings > Salesforce
2. Toggle "Enable daily automatic backup"
3. Set the time for the backup to run
4. The app installs a launchd agent to run backups automatically

Backup Output

Google Workspace

Files are synced to S3 maintaining the same structure as in GCS.

Salesforce

Each backup creates a timestamped folder containing:

• CSV files for each selected object (all fields)
• _manifest.json with backup metadata

Example structure:

salesforce-backup/
  2025-01-22_02-00-00/
    Account.csv
    Contact.csv
    Opportunity.csv
    CustomObject__c.csv
    _manifest.json

Troubleshooting

"Not configured" error

Make sure you've set up all required credentials in Settings.

Salesforce OAuth fails

• Verify the callback URL is exactly: gwsbackup://oauth/callback
• Wait 2-10 minutes after creating the Connected App
• Check that the Connected App has the required OAuth scopes

Scheduled backup not running

• Verify the app is installed in /Applications or your home directory
• Check ~/Library/Logs/GWSBackup-scheduler.log for errors
• Run launchctl list | grep gwsbackup to verify the agent is loaded

Large Salesforce exports timing out

The app uses Bulk API 2.0 which handles large datasets efficiently. For very large objects, backups may take longer but should complete.

Security

This app implements several security best practices:

• Keychain Storage: All sensitive credentials (AWS keys, GCS service account JSON, Salesforce OAuth tokens) are stored in the macOS Keychain, not in files
• PKCE OAuth: Salesforce authentication uses Proof Key for Code Exchange (PKCE) for enhanced security
• No Hardcoded Secrets: The app contains no hardcoded API keys or credentials
• Secure Input: Password fields use SecureField components
• Token Refresh: OAuth tokens are automatically refreshed before expiry
• Memory Clearing: Sensitive values are cleared from memory after use

Credential Requirements

Service	Required Credentials
Google Cloud	Service Account JSON key file
Salesforce	OAuth Client ID & Secret (from Connected App)
AWS	IAM Access Key ID & Secret Access Key

All credentials are entered through the app's Settings UI and stored securely in macOS Keychain.

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

MIT License - See LICENSE file for details