name: backup
services:
  borgmatic:
    image: ghcr.io/borgmatic-collective/borgmatic:latest
    container_name: borgmatic
    hostname: linumiq-borgmatic
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    environment:
      TZ: Europe/Berlin
      # Daily backup at 03:00 server-local time. The image writes this to
      # /etc/crontabs/root and runs: borgmatic --stats -v 0
      BACKUP_CRON: "0 3 * * *"
    env_file:
      - ./.env
    volumes:
      # Backup source (read-only — borgmatic never writes to /docker).
      - /docker:/docker:ro
      # Local borg repository (host-side, same disk; remote planned later).
      - /var/backups/borg:/repository
      # borgmatic configuration.
      - ./borgmatic.d:/etc/borgmatic.d:ro
      # Persist borg cache + security dir across container recreation so borg
      # does not re-scan the whole repo or warn about an "unknown" repository.
      - borg_cache:/root/.cache/borg
      - borg_security:/root/.config/borg
    networks:
      # Reach the prod + dev Postgres containers (supabase-db / supabase-dev-db)
      # by container name for the pg_dumpall hook.
      - supabase_default
      - supabase-dev_default
volumes:
  borg_cache:
  borg_security:
networks:
  supabase_default:
    external: true
  supabase-dev_default:
    external: true