feat: backup cron

docker-compose.prod.yml

@@ -1,50 +1,67 @@
 name: daily-meal-api
 
-x-app-image: &app-image git.leonmorival.xyz/leonm/daily-meal-api:${IMAGE_TAG:-latest}
+x-app-image: &app-image git.leonmorival.xyz/leonm/daily-meal-api:${IMAGE_TAG:?IMAGE_TAG is required}
 
-x-app-environment: &app-environment
-  APP_ENV: production
-  APP_DEBUG: "false"
-  OCTANE_SERVER: frankenphp
-  OCTANE_HTTPS: "true"
-  OCTANE_PORT: "80"
-  OCTANE_ADMIN_PORT: "2019"
-  OCTANE_MAX_REQUESTS: "500"
-  LOG_CHANNEL: stderr
-  LOG_LEVEL: "${LOG_LEVEL:-warning}"
-  DB_CONNECTION: pgsql
-  DB_HOST: postgres
-  DB_PORT: "5432"
-  REDIS_HOST: redis
-  REDIS_CLIENT: predis
-  QUEUE_CONNECTION: redis
-  MAIL_MAILER: resend
-  MAIL_FROM_ADDRESS: "${MAIL_FROM_ADDRESS:?MAIL_FROM_ADDRESS is required}"
-  MAIL_FROM_NAME: "${MAIL_FROM_NAME:-Bowli}"
-  RESEND_API_KEY: "${RESEND_API_KEY:?RESEND_API_KEY is required}"
-  SCOUT_DRIVER: meilisearch
-  MEILISEARCH_HOST: http://meilisearch:7700
-
-x-app-volumes: &app-volumes
-  - storage-data:/app/storage/app
-  - storage-public-data:/app/storage/app/public
+x-default-logging: &default-logging
+  driver: json-file
+  options:
+    max-size: "10m"
+    max-file: "5"
 
 x-app-service: &app-service
   image: *app-image
   restart: unless-stopped
+  init: true
   env_file:
     - .env
-  environment: *app-environment
-  volumes: *app-volumes
   depends_on:
     postgres:
       condition: service_healthy
     redis:
-      condition: service_started
+      condition: service_healthy
     meilisearch:
-      condition: service_started
+      condition: service_healthy
   networks:
     - internal
+  stop_grace_period: 30s
+  logging: *default-logging
+
+x-database-tools: &database-tools
+  image: daily-meal-postgres-tools:${POSTGRES_VERSION:-15-alpine}
+  build:
+    context: ./docker/database-backup
+    args:
+      POSTGRES_IMAGE: postgres:${POSTGRES_VERSION:-15-alpine}
+  environment:
+    AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:?AWS_ACCESS_KEY_ID is required}
+    AWS_DEFAULT_REGION: ${AWS_DEFAULT_REGION:?AWS_DEFAULT_REGION is required}
+    AWS_ENDPOINT: ${AWS_ENDPOINT:-}
+    AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:?AWS_SECRET_ACCESS_KEY is required}
+    AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN:-}
+    BACKUP_CRON: ${BACKUP_CRON:-0 3 * * *}
+    BACKUP_LOCAL_RETENTION_DAYS: ${BACKUP_LOCAL_RETENTION_DAYS:-7}
+    BACKUP_RUN_ON_START: ${BACKUP_RUN_ON_START:-true}
+    BACKUP_S3_BUCKET: ${BACKUP_S3_BUCKET:-bowli-backup}
+    BACKUP_S3_ENDPOINT: ${BACKUP_S3_ENDPOINT:-}
+    BACKUP_S3_PREFIX: ${BACKUP_S3_PREFIX:-database-backups/postgres}
+    RESTORE_CONFIRM: ${RESTORE_CONFIRM:-}
+    RESTORE_SKIP_SAFETY_BACKUP: ${RESTORE_SKIP_SAFETY_BACKUP:-false}
+    DB_DATABASE: ${DB_DATABASE:?DB_DATABASE is required}
+    DB_HOST: postgres
+    DB_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD is required}
+    DB_PORT: "5432"
+    DB_USERNAME: ${DB_USERNAME:?DB_USERNAME is required}
+    TZ: ${TZ:-Europe/Paris}
+  volumes:
+    - database-backups:/backups
+  depends_on:
+    postgres:
+      condition: service_healthy
+  networks:
+    - internal
+  logging: *default-logging
+  security_opt:
+    - no-new-privileges:true
 
 services:
   app:
@@ -81,13 +98,13 @@ services:
     command: ["php", "artisan", "schedule:work"]
 
   postgres:
-    image: postgres:15-alpine
+    image: postgres:${POSTGRES_VERSION:-15-alpine}
     container_name: daily-meal-api-postgres
     restart: unless-stopped
     environment:
-      POSTGRES_DB: "${DB_DATABASE:?DB_DATABASE is required}"
-      POSTGRES_USER: "${DB_USERNAME:?DB_USERNAME is required}"
-      POSTGRES_PASSWORD: "${DB_PASSWORD:?DB_PASSWORD is required}"
+      POSTGRES_DB: ${DB_DATABASE:?DB_DATABASE is required}
+      POSTGRES_USER: ${DB_USERNAME:?DB_USERNAME is required}
+      POSTGRES_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD is required}
     volumes:
       - postgres-data:/var/lib/postgresql/data
     healthcheck:
@@ -98,15 +115,26 @@ services:
       retries: 10
     networks:
       - internal
+    stop_grace_period: 60s
+    logging: *default-logging
 
   redis:
-    image: redis:alpine
+    image: redis:${REDIS_VERSION:-7.4-alpine}
     container_name: daily-meal-api-redis
     restart: unless-stopped
+    command: ["redis-server", "--appendonly", "yes", "--appendfsync", "everysec"]
     volumes:
       - redis-data:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      start_period: 10s
+      interval: 5s
+      timeout: 3s
+      retries: 10
     networks:
       - internal
+    stop_grace_period: 30s
+    logging: *default-logging
 
   meilisearch:
     image: getmeili/meilisearch:v${MEILISEARCH_VERSION:-1.49.0}
@@ -114,24 +142,54 @@ services:
     restart: unless-stopped
     environment:
       MEILI_NO_ANALYTICS: "true"
-      MEILI_MASTER_KEY: "${MEILISEARCH_KEY:?MEILISEARCH_KEY is required}"
+      MEILI_MASTER_KEY: ${MEILISEARCH_KEY:?MEILISEARCH_KEY is required}
     volumes:
       - meilisearch-data:/meili_data
+    healthcheck:
+      test: ["CMD-SHELL", "curl --fail --silent http://127.0.0.1:7700/health >/dev/null"]
+      start_period: 20s
+      interval: 10s
+      timeout: 5s
+      retries: 10
     networks:
       - internal
+    stop_grace_period: 30s
+    logging: *default-logging
+
+  db-backup:
+    <<: *database-tools
+    container_name: daily-meal-api-db-backup
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -h $$DB_HOST -p $$DB_PORT -U $$DB_USERNAME -d $$DB_DATABASE && test -f /backups/.last-success && find /backups/.last-success -mtime -2 -print -quit | grep -q ."]
+      start_period: 5m
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+  db-restore:
+    <<: *database-tools
+    profiles:
+      - restore
+    restart: "no"
+    entrypoint: ["/usr/local/bin/restore-database"]
 
   adminer:
-    image: adminer:latest
+    image: adminer:${ADMINER_VERSION:-5.5.0-standalone}
     container_name: daily-meal-api-adminer
-    restart: unless-stopped
+    restart: "no"
     profiles:
       - debug
     ports:
       - "127.0.0.1:${ADMINER_PORT:-8080}:8080"
     environment:
       ADMINER_DEFAULT_SERVER: postgres
+    depends_on:
+      postgres:
+        condition: service_healthy
     networks:
       - internal
+    logging: *default-logging
 
 volumes:
   postgres-data:
@@ -139,20 +197,21 @@ volumes:
     name: bemeal_pgsql_data
 
   redis-data:
+    external: true
     name: bemeal_redis_data
 
   meilisearch-data:
+    external: true
     name: bemeal_meilisearch_data
 
-  storage-data:
-    name: bemeal_storage_data
-
-  storage-public-data:
-    name: bemeal_storage_public_data
+  database-backups:
+    external: true
+    name: bemeal_database_backups
 
 networks:
   proxy:
     external: true
+    name: proxy
 
   internal:
     driver: bridge