# infra/sentry/backup/Dockerfile
#
# Sidecar container that backs up the self-hosted Sentry stack daily:
#   - pg_dump --format=custom of the sentry Postgres
#   - clickhouse-backup snapshot uploaded directly to S3
#   - both artifacts encrypted with GPG (or AES256 fallback) before upload
#
# Triggered by an internal cron (see crontab) so the container stays running
# in the background. Re-uses the upstream Postgres + ClickHouse client tools
# at versions matching the Sentry stack (Postgres 14, ClickHouse 23.8).

FROM alpine:3.20

# --- Runtime deps ------------------------------------------------------------
# postgresql-client     -> pg_dump
# clickhouse-client     -> clickhouse-client
# aws-cli               -> S3 upload (works with Hetzner Object Storage + MinIO via --endpoint-url)
# rclone                -> alternative S3 backend (handy for MinIO-compat that AWS-CLI v2 dislikes)
# gnupg                 -> GPG encryption of dumps
# tini                  -> proper signal-handling as PID 1
# bash, coreutils       -> POSIX-strict scripts need real coreutils
# tzdata                -> consistent UTC timestamps
# busybox-extras (cron) -> crond
RUN apk add --no-cache \
      postgresql16-client \
      clickhouse-client \
      aws-cli \
      rclone \
      gnupg \
      tini \
      bash \
      coreutils \
      tzdata \
      busybox-extras \
      curl \
    && rm -rf /var/cache/apk/*

ENV TZ=UTC \
    BACKUP_HOME=/srv/backup \
    PATH=/srv/backup:$PATH

WORKDIR ${BACKUP_HOME}

COPY backup.sh ${BACKUP_HOME}/backup.sh
COPY crontab   /etc/crontabs/root

RUN chmod 0755 ${BACKUP_HOME}/backup.sh \
    && mkdir -p ${BACKUP_HOME}/logs ${BACKUP_HOME}/work

# Run cron in the foreground; tini handles SIGTERM cleanly so docker compose
# down doesn't strand a half-finished dump.
ENTRYPOINT ["/sbin/tini", "--"]
CMD ["crond", "-f", "-L", "/dev/stdout", "-l", "2"]
