49 lines
1.7 KiB
YAML
Executable File
49 lines
1.7 KiB
YAML
Executable File
# Explicit local sandbox backup helper. Start the persistent stack first, then stop only wikideck.
|
|
# Requires WIKIDECK_BACKUP_DIR (existing restricted host directory) and WIKIDECK_BACKUP_NAME (new leaf name).
|
|
# For verification, override the service command with: verify --source /backups/<name>.
|
|
services:
|
|
backup:
|
|
image: wikideck:custody-backup
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
target: custody-backup
|
|
environment:
|
|
WIKIDECK_NETWORK: testnet
|
|
WIKIDECK_CUSTODY_STORAGE: postgres
|
|
WIKIDECK_CUSTODY_PG_URL_FILE: /secrets/runtime/url
|
|
WIKIDECK_CUSTODY_PG_BACKUP_URL_FILE: /secrets/backup/url
|
|
WIKIDECK_CUSTODY_PG_CA_FILE: /secrets/backup/ca.crt
|
|
command: ["create", "--source", "/app/data", "--destination", "/backups/${WIKIDECK_BACKUP_NAME:?Set a new backup leaf name}", "--consent"]
|
|
volumes:
|
|
- custody-node:/app/data
|
|
- pg-runtime:/secrets/runtime:ro
|
|
- pg-backup:/secrets/backup:ro
|
|
- type: bind
|
|
source: ${WIKIDECK_BACKUP_DIR:?Set an existing restricted host backup directory}
|
|
target: /backups
|
|
bind:
|
|
create_host_path: false
|
|
networks: [financial]
|
|
read_only: true
|
|
tmpfs: ["/tmp:mode=1777,size=32m,noexec,nosuid"]
|
|
cap_drop: [ALL]
|
|
security_opt: [no-new-privileges:true]
|
|
pids_limit: 32
|
|
mem_limit: 512m
|
|
restart: "no"
|
|
networks:
|
|
financial:
|
|
external: true
|
|
name: wikideck-custody-local_financial
|
|
volumes:
|
|
custody-node:
|
|
external: true
|
|
name: wikideck-custody-local_custody-node
|
|
pg-runtime:
|
|
external: true
|
|
name: wikideck-custody-local_pg-runtime
|
|
pg-backup:
|
|
external: true
|
|
name: wikideck-custody-local_pg-backup
|