43 lines
1.8 KiB
YAML
43 lines
1.8 KiB
YAML
# Scheduled ModelForge backups.
|
|
#
|
|
# Deployment infrastructure owns the schedule, not an operator and not an interactive session:
|
|
#
|
|
# docker compose -p modelforge --env-file .env \
|
|
# -f docker-compose.yml -f docker-compose.backup.yml up -d backup-scheduler
|
|
#
|
|
# The scheduler calls the same operator-authenticated recovery API a human would: create, verify,
|
|
# then apply retention. It holds no database credential, no encryption key and no filesystem access
|
|
# to the backup root — the control plane does all of that behind its own guards.
|
|
#
|
|
# An Unraid User Script or a systemd timer invoking scripts/modelforge_scheduled_backup.sh directly
|
|
# is equally supported; this service exists so a Compose-only deployment is still protected.
|
|
services:
|
|
backup-scheduler:
|
|
image: curlimages/curl:8.11.1@sha256:c1fe1679c34d9784c1b0d1e5f62ac0a79fca01fb6377cdd33e90473c6f9f9a69
|
|
entrypoint: ["/bin/sh"]
|
|
command:
|
|
- "-c"
|
|
- |
|
|
set -eu
|
|
while true; do
|
|
sh /opt/modelforge/modelforge_scheduled_backup.sh || \
|
|
echo "scheduled backup failed; BACKUP_FAILED and BACKUP_STALE will report it"
|
|
sleep "${MODELFORGE_BACKUP_INTERVAL_SECONDS:-86400}"
|
|
done
|
|
environment:
|
|
MODELFORGE_BASE_URL: ${MODELFORGE_BACKUP_BASE_URL:-http://api:8000}
|
|
MODELFORGE_OPERATOR_API_KEY: ${MODELFORGE_OPERATOR_API_KEY:-}
|
|
MODELFORGE_BACKUP_ID_PREFIX: ${MODELFORGE_BACKUP_ID_PREFIX:-scheduled}
|
|
MODELFORGE_BACKUP_INTERVAL_SECONDS: ${MODELFORGE_BACKUP_INTERVAL_SECONDS:-86400}
|
|
volumes:
|
|
- ./scripts/modelforge_scheduled_backup.sh:/opt/modelforge/modelforge_scheduled_backup.sh:ro
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
read_only: true
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
restart: unless-stopped
|