# rest-server (Anaheim) — restic backup target for the fleet.
#
# Deploys to ana-docker. Data dir is the NFS mount at
# /mnt/backup/restic/repo/ana, backed by the Debian 12 NFS/SMB file
# server at 10.250.50.50. (Historically a TrueNAS SCALE appliance; since
# reprovisioned as vanilla Debian.)
#
# Mirrors stacks/rest-server-nh3/ in every meaningful way — same auth
# model, same on-disk layout, same operational semantics — so each client
# host uses an identical URL shape against either endpoint:
#
#   rest:http://<user>:<pw>@10.100.50.50:8000/<user>/     (NH3 Synology)
#   rest:http://<user>:<pw>@10.250.50.70:8000/<user>/     (this stack)
#
# Auth model:
#   --private-repos : URL path must start with /<user>/ and the HTTP
#                     basic-auth user must match. Per-host repos are
#                     strictly isolated.
#   --append-only   : on-disk data can be added but not removed or
#                     rewritten; a compromised host can't wipe its own
#                     history. Prune requires disabling this (see README).
#
# Credentials come from /data/.htpasswd — see README for populating it.
#
# All tunables live in .env — edit that, not this file.

services:
  rest-server:
    image: restic/rest-server:${REST_SERVER_VERSION}
    container_name: rest-server
    restart: unless-stopped
    # Run as the UID that owns the NFS-backed data dir, so file I/O
    # is not subject to NFS root_squash. On ana-docker this is lkraven (1000).
    user: "${REST_UID:-1000}:${REST_GID:-1000}"
    ports:
      - "${REST_PORT}:8000"
    volumes:
      - ${DATA_DIR}:/data
    environment:
      - OPTIONS=--private-repos --append-only --prometheus ${EXTRA_OPTIONS:-}
      - TZ=${TZ:-America/Los_Angeles}
    healthcheck:
      # TCP port probe — busybox nc ships in the restic/rest-server Alpine
      # image. HTTP-level checks fight with --private-repos returning 401
      # (busybox wget exit 8, gnu wget exit 6 — version-dependent and hard
      # to branch on cleanly in POSIX sh).
      test: ["CMD", "nc", "-z", "localhost", "8000"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 15s
    networks:
      - tnet
    labels:
      - homepage.group=Service Networking
      - homepage.name=Restic (rest-server)
      - homepage.icon=mdi-cloud-upload
      - homepage.description=Anaheim restic endpoint (data on NFS)
      - homepage.href=http://10.250.50.70:${REST_PORT}

networks:
  tnet:
    name: traefik-net
    external: true