# backup stack — Kopia snapshots of /config, selected /storage1/labdata paths, and DB dumps.
# Scope: stacks/backup/SCOPE.md + snapshot-paths.txt (excludes RomM art, registry, transient dirs).
#
# Offsite target: Backblaze B2 (S3-compatible). One-time repo setup — see README.md.
# Schedule: backup-scheduler dumps databases ~02:50, Kopia snapshots ~03:00 (policy).
#
# Env convention: stack.env only (no Portainer UI vars). Kopia UI is internal-only
# via Caddy after you add backup.ginnoir.com (optional, README).

services:
  kopia:
    container_name: kopia
    image: kopia/kopia:0.17
    hostname: kopia
    restart: unless-stopped
    networks: [backup, edge]
    env_file:
      - stack.env
    cap_add:
      - SYS_ADMIN
    security_opt:
      - apparmor:unconfined
    devices:
      - /dev/fuse:/dev/fuse
    volumes:
      - /config/kopia/config:/app/config
      - /config/kopia/cache:/app/cache
      - /config/kopia/logs:/app/logs
      - /config:/backup/config:ro
      - /config/backup/dumps:/backup/dumps:ro
      - /storage1/labdata/gitea/repositories:/backup/labdata/gitea/repositories:ro
      - /storage1/labdata/gitea/lfs:/backup/labdata/gitea/lfs:ro
      - /storage1/labdata/famapp/minio:/backup/labdata/famapp/minio:ro
      - /storage1/labdata/resume/minio:/backup/labdata/resume/minio:ro
      - /storage1/labdata/plane/minio:/backup/labdata/plane/minio:ro
      - /storage1/labdata/romhacks/metadata:/backup/labdata/romhacks/metadata:ro
      - /storage1/labdata/romhacks/library:/backup/labdata/romhacks/library:ro
      - /storage1/labdata/romm/assets:/backup/labdata/romm/assets:ro
      - /config/backup/init-kopia.sh:/init-kopia.sh:ro
      - /config/backup/snapshot-paths.txt:/snapshot-paths.txt:ro
    ports:
      - "51515:51515"
    entrypoint: ["/bin/sh", "/init-kopia.sh"]
    labels:
      - "com.centurylabs.watchtower.enable=false"

  backup-scheduler:
    container_name: backup_scheduler
    image: alpine:3.20
    restart: unless-stopped
    networks: [backup]
    env_file:
      - stack.env
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /config/backup/dumps:/dumps
      - /config/backup/scripts/backup-dump-databases.sh:/scripts/backup-dump-databases.sh:ro
      - /config/backup/scripts/backup-run-snapshots.sh:/scripts/backup-run-snapshots.sh:ro
      - /config/backup/snapshot-paths.txt:/snapshot-paths.txt:ro
      - /config/backup/crontab:/etc/crontab:ro
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        apk add --no-cache docker-cli curl tzdata >/dev/null
        printenv | grep -E '^(NTFY_|TZ=)' > /etc/backup.env || true
        crond -f -l 8 -c /etc
    depends_on:
      - kopia

networks:
  backup:
    name: backup
    driver: bridge
  edge:
    name: edge
    external: true