linumiq_net-user
e7a7cafa89
- /docker/backup: borgmatic container (daily 03:00 Berlin via BACKUP_CRON) - Backs up /docker (ro) to local encrypted repo /var/backups/borg (repokey-blake2) - Postgres prod+dev captured via pg_dumpall; live PG data/logs/build artifacts excluded - Retention: keep_daily 7, keep_weekly 4, keep_monthly 6; runs prune/compact/create/check - Secrets in backup/.env (gitignored, chmod 600)
41 lines
1.3 KiB
YAML
41 lines
1.3 KiB
YAML
name: backup
|
|
services:
|
|
borgmatic:
|
|
image: ghcr.io/borgmatic-collective/borgmatic:latest
|
|
container_name: borgmatic
|
|
hostname: linumiq-borgmatic
|
|
restart: unless-stopped
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
environment:
|
|
TZ: Europe/Berlin
|
|
# Daily backup at 03:00 server-local time. The image writes this to
|
|
# /etc/crontabs/root and runs: borgmatic --stats -v 0
|
|
BACKUP_CRON: "0 3 * * *"
|
|
env_file:
|
|
- ./.env
|
|
volumes:
|
|
# Backup source (read-only — borgmatic never writes to /docker).
|
|
- /docker:/docker:ro
|
|
# Local borg repository (host-side, same disk; remote planned later).
|
|
- /var/backups/borg:/repository
|
|
# borgmatic configuration.
|
|
- ./borgmatic.d:/etc/borgmatic.d:ro
|
|
# Persist borg cache + security dir across container recreation so borg
|
|
# does not re-scan the whole repo or warn about an "unknown" repository.
|
|
- borg_cache:/root/.cache/borg
|
|
- borg_security:/root/.config/borg
|
|
networks:
|
|
# Reach the prod + dev Postgres containers (supabase-db / supabase-dev-db)
|
|
# by container name for the pg_dumpall hook.
|
|
- supabase_default
|
|
- supabase-dev_default
|
|
volumes:
|
|
borg_cache:
|
|
borg_security:
|
|
networks:
|
|
supabase_default:
|
|
external: true
|
|
supabase-dev_default:
|
|
external: true
|