docker-compose.yml

services:

  postback:
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped

    extra_hosts:
      - "host.docker.internal:host-gateway"

    environment:
      # PostgreSQL connection
      PGHOST:     ${PGHOST}
      PGPORT:     ${PGPORT:-5432}
      PGDATABASE: ${PGDATABASE}
      PGUSER:     ${PGUSER}
      PGPASSWORD: ${PGPASSWORD}

      # Storage backend: "local" or "rsync"
      STORAGE_BACKEND: ${STORAGE_BACKEND:-local}

      # ── local backend ──────────────────────────────────────────────────────
      LOCAL_STORAGE_PATH: /backup

      # ── rsync backend (ignored when STORAGE_BACKEND=local) ────────────────
      RSYNC_HOST:    ${RSYNC_HOST:-}
      RSYNC_USER:    ${RSYNC_USER:-}
      RSYNC_PATH:    ${RSYNC_PATH:-}
      RSYNC_SSH_KEY: /secrets/rsync_key
      RSYNC_PORT:    ${RSYNC_PORT:-22}

      # Scheduler (seconds between runs, default 1 hour)
      BACKUP_INTERVAL_SECS: ${BACKUP_INTERVAL_SECS:-3600}
      # UTC offset for retention checkpoints, e.g. "+02:00"
      BACKUP_TIMEZONE: ${BACKUP_TIMEZONE:-UTC}

      # Encryption (optional)
      ENCRYPTION_PUBLIC_KEY: ${ENCRYPTION_PUBLIC_KEY:-}

      # Retention knobs (optional — these are the defaults)
      # KEEP_HOURLY: "6"
      # KEEP_6H:     "4"
      # KEEP_DAILY:  "28"

      # Slack notifications (optional)
      # SLACK_BOT_TOKEN:  "xoxb-..."
      # SLACK_CHANNEL:    "#db-alerts"
      # SLACK_NOTIFY_ON:  "success,failure"

      RUST_LOG: ${RUST_LOG:-info}

    volumes:
      # ── local backend: mount a host directory or named volume ──────────────
      - ${LOCAL_BACKUP_PATH:-./backups}:/backup

      # ── rsync backend: mount your SSH private key ──────────────────────────
      # Uncomment when STORAGE_BACKEND=rsync
      # - ${RSYNC_SSH_KEY_PATH}:/secrets/rsync_key:ro

      # Temp dump dir in RAM — never touches persistent disk
      - type: tmpfs
        target: /tmp/postback
        tmpfs:
          mode: 0777

# To use a named volume instead of a host path, uncomment both blocks below:
# volumes:
#   postback_data: