services:
  # Nightly backup of every named volume on this host to S3. Containers
  # labeled docker-volume-backup.stop-during-backup=true (see
  # vpn-docker-compose.yml) are stopped for the duration of the backup so
  # their data is captured in a consistent state, then restarted.
  backup:
    image: offen/docker-volume-backup:v2
    container_name: backup
    environment:
      BACKUP_FILENAME: "vpn-%Y-%m-%dT%H-%M-%S.{{ .Extension }}"
      BACKUP_CRON_EXPRESSION: "0 3 * * *"
      BACKUP_RETENTION_DAYS: "14"
      BACKUP_PRUNING_LEEWAY: "5m"
      AWS_S3_BUCKET_NAME: ${AWS_S3_BUCKET_NAME}
      AWS_S3_PATH: ${AWS_S3_PATH}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      AWS_ENDPOINT: ${AWS_ENDPOINT}
    volumes:
      - openvpn_data:/backup/openvpn_data:ro
      - letsencrypt_data:/backup/letsencrypt_data:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
    restart: unless-stopped

  # One-shot: restores empty volumes from the latest S3 backup, then exits.
  # Run explicitly by spinup.sh before the services that own these volumes
  # start - not started by `docker compose up`.
  restore:
    image: amazon/aws-cli:2
    container_name: backup-restore
    entrypoint: ["/bin/bash", "/restore.sh"]
    environment:
      AWS_S3_BUCKET_NAME: ${AWS_S3_BUCKET_NAME}
      AWS_S3_PATH: ${AWS_S3_PATH}
      AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
      AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
      AWS_ENDPOINT: ${AWS_ENDPOINT}
    volumes:
      - ./restore.sh:/restore.sh:ro
      - openvpn_data:/restore/openvpn_data
      - letsencrypt_data:/restore/letsencrypt_data
    restart: "no"

volumes:
  openvpn_data:
    name: openvpn_data
  letsencrypt_data:
    name: letsencrypt_data