From 34e88a8cf5147ad57d532271209f4f9f4d7496aa Mon Sep 17 00:00:00 2001
From: xCyanGrizzly <sam.agsteribbe@hotmail.com>
Date: Wed, 22 Jul 2026 00:22:56 +0200
Subject: [PATCH] feat: add backup compose service

---
 .env.example       |  8 ++++++++
 backup/Dockerfile  |  8 ++++++++
 docker-compose.yml | 25 +++++++++++++++++++++++++
 3 files changed, 41 insertions(+)
 create mode 100644 backup/Dockerfile

diff --git a/.env.example b/.env.example
index bf3752b..a3fddd1 100644
--- a/.env.example
+++ b/.env.example
@@ -36,3 +36,11 @@ TDLIB_STATE_DIR="/data/tdlib"
 WORKER_MAX_ZIP_SIZE_MB=4096
 MULTIPART_TIMEOUT_HOURS=0
 LOG_LEVEL="info"
+
+# Disaster recovery backups
+BACKUP_MOUNT_PATH="/mnt/dragonsstash-backups"
+BACKUP_STAGING_PATH="/var/lib/dragons-stash-backup/staging"
+BACKUP_REPOSITORY="/backup/restic"
+BACKUP_RESTIC_PASSWORD_FILE="/etc/dragons-stash/restic-password"
+BACKUP_RETENTION_DAYS=30
+BACKUP_APP_VERSION="unknown"
diff --git a/backup/Dockerfile b/backup/Dockerfile
new file mode 100644
index 0000000..9edf3ac
--- /dev/null
+++ b/backup/Dockerfile
@@ -0,0 +1,8 @@
+FROM postgres:16-alpine
+
+RUN apk add --no-cache bash restic coreutils
+
+COPY scripts/backup/container-entrypoint.sh /usr/local/bin/dragons-stash-backup
+RUN chmod 0755 /usr/local/bin/dragons-stash-backup
+
+ENTRYPOINT ["/usr/local/bin/dragons-stash-backup"]
diff --git a/docker-compose.yml b/docker-compose.yml
index fe5ddc7..9364fe5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -97,6 +97,31 @@ services:
     networks:
       - backend
 
+  backup:
+    profiles: ["backup"]
+    build:
+      context: .
+      dockerfile: backup/Dockerfile
+    environment:
+      DATABASE_URL: postgresql://${POSTGRES_USER:-dragons}:${POSTGRES_PASSWORD:-stash}@db:5432/${POSTGRES_DB:-dragonsstash}
+      RESTIC_REPOSITORY: ${BACKUP_REPOSITORY:-/backup/restic}
+      RESTIC_PASSWORD_FILE: /run/secrets/restic-password
+      BACKUP_RETENTION_DAYS: ${BACKUP_RETENTION_DAYS:-30}
+      BACKUP_APP_VERSION: ${BACKUP_APP_VERSION:-unknown}
+    user: "0:0"
+    volumes:
+      - manual_uploads:/data/uploads:ro
+      - tdlib_state:/data/tdlib-worker:ro
+      - tdlib_bot_state:/data/tdlib-bot:ro
+      - ${BACKUP_MOUNT_PATH:?Set BACKUP_MOUNT_PATH to the mounted Synology share}:/backup:rw
+      - ${BACKUP_STAGING_PATH:?Set BACKUP_STAGING_PATH to a local staging directory}:/staging:rw
+      - ${BACKUP_RESTIC_PASSWORD_FILE:?Set BACKUP_RESTIC_PASSWORD_FILE to a root-readable secret file}:/run/secrets/restic-password:ro
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - backend
+
   db:
     image: postgres:16-alpine
     environment: