feat: add backups feature

deploy/docker/Dockerfile

@@ -53,6 +53,20 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
 
 WORKDIR /app
 
+RUN set -eux; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends ca-certificates curl gnupg; \
+    . /etc/os-release; \
+    install -d /usr/share/postgresql-common/pgdg; \
+    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
+      | gpg --dearmor -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg; \
+    echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg] https://apt.postgresql.org/pub/repos/apt ${VERSION_CODENAME}-pgdg main" \
+      > /etc/apt/sources.list.d/pgdg.list; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends postgresql-client-17; \
+    apt-get purge -y --auto-remove curl gnupg; \
+    rm -rf /var/lib/apt/lists/*
+
 RUN useradd -u 10001 -m appuser
 
 COPY backend/requirements.txt backend/requirements.txt

deploy/examples/caddy/.env.example

@@ -39,3 +39,13 @@ PANEL_WEBHOOK_SECRET=change_me
 # Caddy and Docker network ranges that may set X-Forwarded-For.
 TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
 
+# Periodic backups from the worker container. Disabled by default.
+BACKUP_ENABLED=False
+BACKUP_CHAT_ID=
+BACKUP_INTERVAL_SECONDS=3600
+BACKUP_LOCAL_RETENTION=100
+BACKUP_ARCHIVE_SIGNATURE_REQUIRED=True
+BACKUP_ARCHIVE_SIGNATURE_SECRET=
+BACKUP_COMPOSE_ENABLED=True
+COMPOSE_BACKUP_SOURCE=.
+COMPOSE_RESTORE_MODE=rw

deploy/examples/caddy/docker-compose.yml

@@ -67,6 +67,7 @@ services:
       TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
     volumes:
       - shop-data:/app/data
+      - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:${COMPOSE_RESTORE_MODE:-rw}
     networks:
       - remnawave-shop
     depends_on:
@@ -91,6 +92,7 @@ services:
       <<: *app_environment
     volumes:
       - shop-data:/app/data
+      - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:ro
     networks:
       - remnawave-shop
     depends_on:

deploy/examples/newt/.env.example

@@ -40,3 +40,13 @@ PANEL_WEBHOOK_SECRET=change_me
 # Pangolin/Newt and Docker network ranges that may set X-Forwarded-For.
 TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
 
+# Periodic backups from the worker container. Disabled by default.
+BACKUP_ENABLED=False
+BACKUP_CHAT_ID=
+BACKUP_INTERVAL_SECONDS=3600
+BACKUP_LOCAL_RETENTION=100
+BACKUP_ARCHIVE_SIGNATURE_REQUIRED=True
+BACKUP_ARCHIVE_SIGNATURE_SECRET=
+BACKUP_COMPOSE_ENABLED=True
+COMPOSE_BACKUP_SOURCE=.
+COMPOSE_RESTORE_MODE=rw

deploy/examples/newt/docker-compose.yml

@@ -67,6 +67,7 @@ services:
       TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
     volumes:
       - shop-data:/app/data
+      - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:${COMPOSE_RESTORE_MODE:-rw}
     networks:
       - remnawave-shop
     depends_on:
@@ -91,6 +92,7 @@ services:
       <<: *app_environment
     volumes:
       - shop-data:/app/data
+      - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:ro
     networks:
       - remnawave-shop
     depends_on:

deploy/examples/nginx/.env.example

@@ -39,3 +39,13 @@ PANEL_WEBHOOK_SECRET=change_me
 # Nginx and Docker network ranges that may set X-Forwarded-For.
 TRUSTED_PROXIES=127.0.0.1,::1,172.16.0.0/12
 
+# Periodic backups from the worker container. Disabled by default.
+BACKUP_ENABLED=False
+BACKUP_CHAT_ID=
+BACKUP_INTERVAL_SECONDS=3600
+BACKUP_LOCAL_RETENTION=100
+BACKUP_ARCHIVE_SIGNATURE_REQUIRED=True
+BACKUP_ARCHIVE_SIGNATURE_SECRET=
+BACKUP_COMPOSE_ENABLED=True
+COMPOSE_BACKUP_SOURCE=.
+COMPOSE_RESTORE_MODE=rw

deploy/examples/nginx/docker-compose.yml

@@ -67,6 +67,7 @@ services:
       TRUSTED_PROXIES: ${TRUSTED_PROXIES:-127.0.0.1,::1,172.16.0.0/12}
     volumes:
       - shop-data:/app/data
+      - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:${COMPOSE_RESTORE_MODE:-rw}
     networks:
       - remnawave-shop
     depends_on:
@@ -91,6 +92,7 @@ services:
       <<: *app_environment
     volumes:
       - shop-data:/app/data
+      - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:ro
     networks:
       - remnawave-shop
     depends_on:

deploy/examples/no-proxy/.env.example

@@ -39,3 +39,14 @@ PANEL_API_KEY=change_me
 PANEL_WEBHOOK_SECRET=change_me
 
 TRUSTED_PROXIES=127.0.0.1,::1
+
+# Periodic backups from the worker container. Disabled by default.
+BACKUP_ENABLED=False
+BACKUP_CHAT_ID=
+BACKUP_INTERVAL_SECONDS=3600
+BACKUP_LOCAL_RETENTION=100
+BACKUP_ARCHIVE_SIGNATURE_REQUIRED=True
+BACKUP_ARCHIVE_SIGNATURE_SECRET=
+BACKUP_COMPOSE_ENABLED=True
+COMPOSE_BACKUP_SOURCE=.
+COMPOSE_RESTORE_MODE=rw

deploy/examples/no-proxy/docker-compose.yml

@@ -69,6 +69,7 @@ services:
       - "${WEB_SERVER_BIND:-0.0.0.0:8080}:8080"
     volumes:
       - shop-data:/app/data
+      - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:${COMPOSE_RESTORE_MODE:-rw}
     networks:
       - remnawave-shop
     depends_on:
@@ -93,6 +94,7 @@ services:
       <<: *app_environment
     volumes:
       - shop-data:/app/data
+      - ${COMPOSE_BACKUP_SOURCE:-.}:/app/compose-source:ro
     networks:
       - remnawave-shop
     depends_on: