# Explicit local sandbox backup helper. Start the persistent stack first, then stop only wikideck.
# Requires WIKIDECK_BACKUP_DIR (existing restricted host directory) and WIKIDECK_BACKUP_NAME (new leaf name).
# For verification, override the service command with: verify --source /backups/<name>.
services:
  backup:
    image: wikideck:custody-backup
    build:
      context: .
      dockerfile: Dockerfile
      target: custody-backup
    environment:
      WIKIDECK_NETWORK: testnet
      WIKIDECK_CUSTODY_STORAGE: postgres
      WIKIDECK_CUSTODY_PG_URL_FILE: /secrets/runtime/url
      WIKIDECK_CUSTODY_PG_BACKUP_URL_FILE: /secrets/backup/url
      WIKIDECK_CUSTODY_PG_CA_FILE: /secrets/backup/ca.crt
    command: ["create", "--source", "/app/data", "--destination", "/backups/${WIKIDECK_BACKUP_NAME:?Set a new backup leaf name}", "--consent"]
    volumes:
      - custody-node:/app/data
      - pg-runtime:/secrets/runtime:ro
      - pg-backup:/secrets/backup:ro
      - type: bind
        source: ${WIKIDECK_BACKUP_DIR:?Set an existing restricted host backup directory}
        target: /backups
        bind:
          create_host_path: false
    networks: [financial]
    read_only: true
    tmpfs: ["/tmp:mode=1777,size=32m,noexec,nosuid"]
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    pids_limit: 32
    mem_limit: 512m
    restart: "no"
networks:
  financial:
    external: true
    name: wikideck-custody-local_financial
volumes:
  custody-node:
    external: true
    name: wikideck-custody-local_custody-node
  pg-runtime:
    external: true
    name: wikideck-custody-local_pg-runtime
  pg-backup:
    external: true
    name: wikideck-custody-local_pg-backup