overseerandClaude Opus 5.5
89a10edc38
Task 47b27ccb: a litestream sidecar (litestream/litestream:0.5.17) in deploy/compose.yaml mounts the nestquest-db volume and replicates /var/lib/nestquest/nestquest.db over SFTP to the Synology NAS (10.60.1.50, /homes/Joshua/nestquest-backups), outside the Docker host. deploy/litestream.yml holds no secrets: the NAS host key is pinned and the dedicated SFTP private key is mounted read-only from the git-ignored deploy/litestream_key. api/README.md documents what runs, where it writes, key setup, and a high-level restore. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
62 lines
2.4 KiB
YAML
62 lines
2.4 KiB
YAML
# Compose deployment scaffold for the NestQuest API service (Feature
|
|
# 17). The SQLite database lives on the NAMED VOLUME ``nestquest-db``
|
|
# mounted at /var/lib/nestquest — recreating the container keeps the
|
|
# household data (``docker compose down`` leaves named volumes alone).
|
|
#
|
|
# Configuration is supplied by the environment: the fixed database
|
|
# path here, and the secret values (panel service token, Authentik
|
|
# OIDC settings) from ``deploy/.env`` — a git-ignored file you create
|
|
# from ``deploy/.env.example`` (placeholder names only; never commit
|
|
# real values).
|
|
#
|
|
# TLS is terminated by the shared Traefik reverse proxy on another
|
|
# host, which forwards to this service on port 8080. The published
|
|
# port binds NESTQUEST_BIND_ADDRESS (read from deploy/.env, the
|
|
# project directory's env file): it defaults to 127.0.0.1 so an
|
|
# unconfigured deployment is never exposed; set it to the host's LAN
|
|
# address on the API box so the proxy can reach it.
|
|
services:
|
|
api:
|
|
build:
|
|
context: ..
|
|
dockerfile: Dockerfile
|
|
image: nestquest-api:latest
|
|
init: true
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${NESTQUEST_BIND_ADDRESS:-127.0.0.1}:8080:8080"
|
|
environment:
|
|
# The SQLite file inside the named volume; fixed, not a secret.
|
|
NESTQUEST_DB_PATH: /var/lib/nestquest/nestquest.db
|
|
env_file:
|
|
# Secret values (NESTQUEST_PANEL_TOKEN, NESTQUEST_OIDC_*); absent
|
|
# until you create deploy/.env from the example.
|
|
- path: .env
|
|
required: false
|
|
volumes:
|
|
- nestquest-db:/var/lib/nestquest
|
|
healthcheck:
|
|
test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health')"]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 15s
|
|
|
|
# Continuous backup: streams the SQLite database on the shared named
|
|
# volume to the Synology NAS over SFTP (config: deploy/litestream.yml).
|
|
# The SFTP private key deploy/litestream_key is git-ignored and must be
|
|
# created on the API box before starting (see api/README.md).
|
|
litestream:
|
|
image: litestream/litestream:0.5.17
|
|
restart: unless-stopped
|
|
command: ["replicate", "-config", "/etc/litestream.yml"]
|
|
depends_on:
|
|
api:
|
|
condition: service_healthy
|
|
volumes:
|
|
- nestquest-db:/var/lib/nestquest
|
|
- ./litestream.yml:/etc/litestream.yml:ro
|
|
- ./litestream_key:/etc/litestream/sftp_key:ro
|
|
|
|
volumes:
|
|
nestquest-db: |