54 lines
1.8 KiB
Docker
54 lines
1.8 KiB
Docker
# infra/sentry/backup/Dockerfile
|
|
#
|
|
# Sidecar container that backs up the self-hosted Sentry stack daily:
|
|
# - pg_dump --format=custom of the sentry Postgres
|
|
# - clickhouse-backup snapshot uploaded directly to S3
|
|
# - both artifacts encrypted with GPG (or AES256 fallback) before upload
|
|
#
|
|
# Triggered by an internal cron (see crontab) so the container stays running
|
|
# in the background. Re-uses the upstream Postgres + ClickHouse client tools
|
|
# at versions matching the Sentry stack (Postgres 14, ClickHouse 23.8).
|
|
|
|
FROM alpine:3.20
|
|
|
|
# --- Runtime deps ------------------------------------------------------------
|
|
# postgresql-client -> pg_dump
|
|
# clickhouse-client -> clickhouse-client
|
|
# aws-cli -> S3 upload (works with Hetzner Object Storage + MinIO via --endpoint-url)
|
|
# rclone -> alternative S3 backend (handy for MinIO-compat that AWS-CLI v2 dislikes)
|
|
# gnupg -> GPG encryption of dumps
|
|
# tini -> proper signal-handling as PID 1
|
|
# bash, coreutils -> POSIX-strict scripts need real coreutils
|
|
# tzdata -> consistent UTC timestamps
|
|
# busybox-extras (cron) -> crond
|
|
RUN apk add --no-cache \
|
|
postgresql16-client \
|
|
clickhouse-client \
|
|
aws-cli \
|
|
rclone \
|
|
gnupg \
|
|
tini \
|
|
bash \
|
|
coreutils \
|
|
tzdata \
|
|
busybox-extras \
|
|
curl \
|
|
&& rm -rf /var/cache/apk/*
|
|
|
|
ENV TZ=UTC \
|
|
BACKUP_HOME=/srv/backup \
|
|
PATH=/srv/backup:$PATH
|
|
|
|
WORKDIR ${BACKUP_HOME}
|
|
|
|
COPY backup.sh ${BACKUP_HOME}/backup.sh
|
|
COPY crontab /etc/crontabs/root
|
|
|
|
RUN chmod 0755 ${BACKUP_HOME}/backup.sh \
|
|
&& mkdir -p ${BACKUP_HOME}/logs ${BACKUP_HOME}/work
|
|
|
|
# Run cron in the foreground; tini handles SIGTERM cleanly so docker compose
|
|
# down doesn't strand a half-finished dump.
|
|
ENTRYPOINT ["/sbin/tini", "--"]
|
|
CMD ["crond", "-f", "-L", "/dev/stdout", "-l", "2"]
|