# infra/authentik/backup/Dockerfile
#
# Sidecar container that backs up the self-hosted Authentik stack daily:
#   - pg_dump --format=custom of the Authentik Postgres
#   - tar of the `authentik-media` volume (uploaded user-avatars, branding
#     assets, exported blueprints)
#   - SECRETS-MANIFEST.txt listing the names of secrets that MUST be backed
#     up separately (AUTHENTIK_SECRET_KEY, POSTGRES password, BOOTSTRAP token)
#     since the Postgres dump alone is useless without them
#   - all artifacts GPG-encrypted (or AES256-symmetric fallback) before
#     upload to S3
#
# Triggered by an internal cron (see crontab) so the container stays running
# in the background. Re-uses postgres16-client (matches the postgres:16-alpine
# pin in docker-compose.yml).

FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc

# --- Runtime deps ------------------------------------------------------------
# postgresql16-client   -> pg_dump
# aws-cli               -> S3 upload (works with Hetzner Object Storage + MinIO via --endpoint-url)
# rclone                -> alternative S3 backend (handy for MinIO-compat)
# gnupg                 -> GPG encryption of dumps
# tini                  -> proper signal-handling as PID 1
# bash, coreutils       -> POSIX-strict scripts need real coreutils
# tzdata                -> consistent UTC timestamps
# busybox-extras (crond)
# curl                  -> health probe
RUN apk add --no-cache \
      postgresql16-client \
      aws-cli \
      rclone \
      gnupg \
      tini \
      bash \
      coreutils \
      tar \
      tzdata \
      busybox-extras \
      curl \
    && rm -rf /var/cache/apk/*

ENV TZ=UTC \
    BACKUP_HOME=/srv/backup \
    PATH=/srv/backup:$PATH

WORKDIR ${BACKUP_HOME}

COPY backup.sh ${BACKUP_HOME}/backup.sh
COPY crontab   /etc/crontabs/root

RUN chmod 0755 ${BACKUP_HOME}/backup.sh \
    && mkdir -p ${BACKUP_HOME}/logs ${BACKUP_HOME}/work

# Run cron in the foreground; tini handles SIGTERM cleanly so `docker compose
# down` doesn't strand a half-finished dump.
ENTRYPOINT ["/sbin/tini", "--"]
CMD ["crond", "-f", "-L", "/dev/stdout", "-l", "2"]
