# WristVitals database backups: pg_dump | age | rclone to S3-compatible storage, SFTP or FTPS.
# Build from this directory:  docker build -t wristvitals-backup deploy/backup
# postgres:17-alpine gives a pg_dump/pg_restore that matches the db service; age and rclone come
# from Alpine's own packages. apk keeps only the current build of a package, so the pins are
# fuzzy (major.minor): an exact "-rN" pin breaks as soon as Alpine rebuilds the package.
FROM postgres:17-alpine
RUN apk add --no-cache 'age~1.3' 'rclone~1.74' \
    && adduser -D -H -u 10001 -s /sbin/nologin backup
COPY backup.sh /usr/local/bin/backup.sh
# Everything writable lives in /tmp (a tmpfs in the stack); rclone's config and cache go there too.
ENV TZ=UTC HOME=/tmp RCLONE_CONFIG=/tmp/rclone.conf RCLONE_CACHE_DIR=/tmp/rclone-cache RCLONE_TEMP_DIR=/tmp
USER backup
ENTRYPOINT ["/usr/local/bin/backup.sh"]
