compose.yml

services:
  # Automatic backup service
  db-backup:
    build: .
    container_name: db-backup
    restart: unless-stopped
    # Hardening: no privilege escalation, minimal capabilities
    # (the ones listed are required by the apt install at startup and the privilege drop)
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - CHOWN
      - DAC_OVERRIDE
      - FOWNER
      - SETGID
      - SETUID
    environment:
      # Timezone for the logs and the backup file names
      - TZ=Europe/Paris
      # Optional at-rest encryption of backups (GPG symmetric AES256):
      # - BACKUP_ENCRYPTION_PASSPHRASE_FILE=/run/secrets/backup_passphrase
      #   (or BACKUP_ENCRYPTION_PASSPHRASE=my_passphrase, less recommended)
    volumes:
      # Volume to store the backups
      - ./backups:/backups
      # Volume for the configuration file
      - ./backups.yml:/config/backups.yml:ro
    # Longer than shutdown_grace (5m) so Docker's SIGKILL doesn't arrive before draining.
    stop_grace_period: 5m30s
    networks:
      - db-network
    depends_on:
      - postgres-db
      - mariadb-db
      - mongodb-db

  # Example PostgreSQL database
  # Note: no "ports:" exposed — the backup container reaches the databases
  # through the internal network. Only publish a port on the host if needed.
  postgres-db:
    image: postgres:16-alpine
    container_name: postgres-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: myapp_db
      POSTGRES_USER: postgres
      POSTGRES_PASSWORD: change_me_postgres
    volumes:
      - postgres-data:/var/lib/postgresql/data
    networks:
      - db-network

  # Example MariaDB database
  mariadb-db:
    image: mariadb:11
    container_name: mariadb-db
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: change_me_root
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wp_user
      MYSQL_PASSWORD: change_me_wp
    volumes:
      - mariadb-data:/var/lib/mysql
    networks:
      - db-network

  # Example MongoDB database
  mongodb-db:
    image: mongo:7
    container_name: mongodb-db
    restart: unless-stopped
    environment:
      MONGO_INITDB_ROOT_USERNAME: admin
      MONGO_INITDB_ROOT_PASSWORD: change_me_mongo
      MONGO_INITDB_DATABASE: myapp
    volumes:
      - mongodb-data:/data/db
    networks:
      - db-network

volumes:
  postgres-data:
  mariadb-data:
  mongodb-data:

networks:
  db-network:
    driver: bridge