services:
  minio-permissions:
    image: who-need-help:minio-local
    build:
      context: .
      dockerfile: Dockerfile.minio
      target: server
    entrypoint: ["/bin/sh", "-euc"]
    command:
      - chown -R 10001:10001 /data
    volumes:
      - minio_data:/data
    user: "0:0"
    read_only: true
    cap_drop: [ALL]
    cap_add: [CHOWN]
    security_opt:
      - no-new-privileges:true
    networks: [internal]
    restart: "no"
    profiles: [backup]

  minio:
    image: who-need-help:minio-local
    build:
      context: .
      dockerfile: Dockerfile.minio
      target: server
    command: ["server", "/data", "--console-address", ":9001"]
    environment:
      MINIO_ROOT_USER: ${BACKUP_MINIO_ROOT_USER:?Set BACKUP_MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${BACKUP_MINIO_ROOT_PASSWORD:?Set BACKUP_MINIO_ROOT_PASSWORD}
    volumes:
      - minio_data:/data
    ports:
      - target: 9000
        published: "${BACKUP_MINIO_API_PORT:-0}"
        host_ip: 127.0.0.1
        protocol: tcp
      - target: 9001
        published: "${BACKUP_MINIO_CONSOLE_PORT:-0}"
        host_ip: 127.0.0.1
        protocol: tcp
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--spider", "http://127.0.0.1:9000/minio/health/ready"]
      interval: 2s
      timeout: 3s
      retries: 30
    depends_on:
      minio-permissions:
        condition: service_completed_successfully
    user: "10001:10001"
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    networks: [internal, backup_host]
    restart: unless-stopped
    profiles: [backup]

  minio-client:
    image: who-need-help:mc-local
    build:
      context: .
      dockerfile: Dockerfile.minio
      target: client
    entrypoint: ["mc"]
    command: ["--version"]
    environment:
      MC_CONFIG_DIR: /tmp/mc
      MC_HOST_local: http://${BACKUP_MINIO_ROOT_USER:?Set BACKUP_MINIO_ROOT_USER}:${BACKUP_MINIO_ROOT_PASSWORD:?Set BACKUP_MINIO_ROOT_PASSWORD}@minio:9000
    volumes:
      - ${BACKUP_RUNTIME_DIR:?Set BACKUP_RUNTIME_DIR for the backup profile}:/work
    user: "${BACKUP_HOST_UID:?Set BACKUP_HOST_UID}:${BACKUP_HOST_GID:?Set BACKUP_HOST_GID}"
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    networks: [internal]
    profiles: [backup]

  backup-tools:
    image: who-need-help:backup-tools
    build:
      context: .
      dockerfile: Dockerfile.backup
    environment:
      PGHOST: db
      PGPORT: "5432"
      PGUSER: ${POSTGRES_USER:?Set POSTGRES_USER}
      PGPASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD}
      PGDATABASE: ${POSTGRES_DB:?Set POSTGRES_DB}
      AWS_ACCESS_KEY_ID: ${BACKUP_MINIO_ROOT_USER:?Set BACKUP_MINIO_ROOT_USER}
      AWS_SECRET_ACCESS_KEY: ${BACKUP_MINIO_ROOT_PASSWORD:?Set BACKUP_MINIO_ROOT_PASSWORD}
      RESTIC_PASSWORD: ${BACKUP_RESTIC_PASSWORD:?Set BACKUP_RESTIC_PASSWORD}
      RESTIC_CACHE_DIR: /tmp/restic-cache
      BACKUP_INTERRUPTION_CHUNKS: ${BACKUP_INTERRUPTION_CHUNKS:?Set BACKUP_INTERRUPTION_CHUNKS}
      BACKUP_INTERRUPTION_CHUNK_BYTES: ${BACKUP_INTERRUPTION_CHUNK_BYTES:?Set BACKUP_INTERRUPTION_CHUNK_BYTES}
      BACKUP_INTERRUPTION_INTERVAL_SECONDS: ${BACKUP_INTERRUPTION_INTERVAL_SECONDS:?Set BACKUP_INTERRUPTION_INTERVAL_SECONDS}
    user: "10001:10001"
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: [ALL]
    security_opt:
      - no-new-privileges:true
    networks: [internal]
    profiles: [backup]

networks:
  backup_host:

volumes:
  minio_data: