Separate one-shot utility

compose.custody-backup.yaml

@@ -0,0 +1,47 @@
+# Explicit local sandbox backup helper. Start the persistent stack first, then stop only wikideck.
+# Requires WIKIDECK_BACKUP_DIR (existing restricted host directory) and WIKIDECK_BACKUP_NAME (new leaf name).
+services:
+  backup:
+    image: wikideck:custody-backup
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: custody-backup
+    environment:
+      WIKIDECK_NETWORK: testnet
+      WIKIDECK_CUSTODY_STORAGE: postgres
+      WIKIDECK_CUSTODY_PG_URL_FILE: /secrets/runtime/url
+      WIKIDECK_CUSTODY_PG_BACKUP_URL_FILE: /secrets/backup/url
+      WIKIDECK_CUSTODY_PG_CA_FILE: /secrets/backup/ca.crt
+    command: ["create", "--source", "/app/data", "--destination", "/backups/${WIKIDECK_BACKUP_NAME:?Set a new backup leaf name}", "--consent"]
+    volumes:
+      - custody-node:/app/data
+      - pg-runtime:/secrets/runtime:ro
+      - pg-backup:/secrets/backup:ro
+      - type: bind
+        source: ${WIKIDECK_BACKUP_DIR:?Set an existing restricted host backup directory}
+        target: /backups
+        bind:
+          create_host_path: false
+    networks: [financial]
+    read_only: true
+    tmpfs: ["/tmp:mode=1777,size=32m,noexec,nosuid"]
+    cap_drop: [ALL]
+    security_opt: [no-new-privileges:true]
+    pids_limit: 32
+    mem_limit: 512m
+    restart: "no"
+networks:
+  financial:
+    external: true
+    name: wikideck-custody-local_financial
+volumes:
+  custody-node:
+    external: true
+    name: wikideck-custody-local_custody-node
+  pg-runtime:
+    external: true
+    name: wikideck-custody-local_pg-runtime
+  pg-backup:
+    external: true
+    name: wikideck-custody-local_pg-backup