59 lines
2.0 KiB
Docker
59 lines
2.0 KiB
Docker
# infra/authentik/backup/Dockerfile
|
|
#
|
|
# Sidecar container that backs up the self-hosted Authentik stack daily:
|
|
# - pg_dump --format=custom of the Authentik Postgres
|
|
# - tar of the `authentik-media` volume (uploaded user-avatars, branding
|
|
# assets, exported blueprints)
|
|
# - SECRETS-MANIFEST.txt listing the names of secrets that MUST be backed
|
|
# up separately (AUTHENTIK_SECRET_KEY, POSTGRES password, BOOTSTRAP token)
|
|
# since the Postgres dump alone is useless without them
|
|
# - all artifacts GPG-encrypted (or AES256-symmetric fallback) before
|
|
# upload to S3
|
|
#
|
|
# Triggered by an internal cron (see crontab) so the container stays running
|
|
# in the background. Re-uses postgres16-client (matches the postgres:16-alpine
|
|
# pin in docker-compose.yml).
|
|
|
|
FROM alpine:3.20
|
|
|
|
# --- Runtime deps ------------------------------------------------------------
|
|
# postgresql16-client -> pg_dump
|
|
# aws-cli -> S3 upload (works with Hetzner Object Storage + MinIO via --endpoint-url)
|
|
# rclone -> alternative S3 backend (handy for MinIO-compat)
|
|
# gnupg -> GPG encryption of dumps
|
|
# tini -> proper signal-handling as PID 1
|
|
# bash, coreutils -> POSIX-strict scripts need real coreutils
|
|
# tzdata -> consistent UTC timestamps
|
|
# busybox-extras (crond)
|
|
# curl -> health probe
|
|
RUN apk add --no-cache \
|
|
postgresql16-client \
|
|
aws-cli \
|
|
rclone \
|
|
gnupg \
|
|
tini \
|
|
bash \
|
|
coreutils \
|
|
tar \
|
|
tzdata \
|
|
busybox-extras \
|
|
curl \
|
|
&& rm -rf /var/cache/apk/*
|
|
|
|
ENV TZ=UTC \
|
|
BACKUP_HOME=/srv/backup \
|
|
PATH=/srv/backup:$PATH
|
|
|
|
WORKDIR ${BACKUP_HOME}
|
|
|
|
COPY backup.sh ${BACKUP_HOME}/backup.sh
|
|
COPY crontab /etc/crontabs/root
|
|
|
|
RUN chmod 0755 ${BACKUP_HOME}/backup.sh \
|
|
&& mkdir -p ${BACKUP_HOME}/logs ${BACKUP_HOME}/work
|
|
|
|
# Run cron in the foreground; tini handles SIGTERM cleanly so `docker compose
|
|
# down` doesn't strand a half-finished dump.
|
|
ENTRYPOINT ["/sbin/tini", "--"]
|
|
CMD ["crond", "-f", "-L", "/dev/stdout", "-l", "2"]
|