# rest-server (NH3 Synology) — restic backup target for the fleet.
#
# Deploys into Synology Container Manager on 10.100.50.50. Data lives on
# a Btrfs shared folder so it gets Synology snapshots + optional
# replication to a sibling share if you configure one later.
#
# Auth model:
#   --private-repos : every URL path must start with /<username>/ and the
#                     HTTP basic-auth user must match. One user per host.
#                     Per-host repos are strictly isolated.
#   --append-only   : on-disk data can be ADDED but not REMOVED or REWRITTEN.
#                     A compromised host can't delete its own history.
#                     Prune requires disabling this (see README).
#
# Credentials come from /data/.htpasswd — see README for how to populate
# it. That file is mounted read-only into the container.
#
# All tunables live in .env — edit that, not this file.

services:
  rest-server:
    image: restic/rest-server:${REST_SERVER_VERSION}
    container_name: rest-server
    restart: unless-stopped
    ports:
      - "${REST_PORT}:8000"
    volumes:
      - ${DATA_DIR}:/data
    environment:
      - OPTIONS=--private-repos --append-only --prometheus ${EXTRA_OPTIONS:-}
      - TZ=${TZ:-America/Los_Angeles}
    # rest-server stores repos under /data and looks for /data/.htpasswd
    # automatically — no extra bind mount needed as long as the htpasswd
    # file is created inside DATA_DIR before startup.
    healthcheck:
      # TCP port probe — avoids the --private-repos 401 trap.
      # See stacks/rest-server-ana/compose.yaml for reasoning.
      test: ["CMD", "nc", "-z", "localhost", "8000"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s