docker-compose/restic/compose.yaml

services:
  backrest:
    image: ${RESTIC_IMAGE:-garethgeorge/backrest:latest}
    container_name: ${RESTIC_COMPOSE_PROJECT_NAME}_app
    restart: unless-stopped
    hostname: ${RESTIC_HOSTNAME:-falcon}
    volumes:
      # Backrest application data
      - backrest_data:/data
      - backrest_cache:/cache
      - backrest_tmp:/tmp

      # Configuration file (mount directly to override)
      - ./config.json:/config/config.json:rw

      # Backup destination
      - ${RESTIC_BACKUP_PATH:-/mnt/hidrive/users/valknar/Backup}:/repos

      # Docker volumes to backup (read-only)
      - backup_core_postgres_data:/volumes/core_postgres_data:ro
      - backup_core_redis_data:/volumes/core_redis_data:ro
      - backup_directus_uploads:/volumes/directus_uploads:ro
      - backup_directus_bundle:/volumes/directus_bundle:ro
      - backup_awesome_data:/volumes/awesome_data:ro
      - backup_gotify_data:/volumes/gotify_data:ro
      - backup_scrapyd_data:/volumes/scrapyd_data:ro
      - backup_scrapy_code:/volumes/scrapy_code:ro
      - backup_n8n_data:/volumes/n8n_data:ro
      - backup_filestash_data:/volumes/filestash_data:ro
      - backup_linkwarden_data:/volumes/linkwarden_data:ro
      - backup_linkwarden_meili_data:/volumes/linkwarden_meili_data:ro
      - backup_letsencrypt_data:/volumes/letsencrypt_data:ro

    environment:
      TZ: ${TIMEZONE:-Europe/Berlin}
      BACKREST_DATA: /data
      BACKREST_CONFIG: /config/config.json
      XDG_CACHE_HOME: /cache
      TMPDIR: /tmp

    networks:
      - compose_network

    labels:
      - 'traefik.enable=${RESTIC_TRAEFIK_ENABLED}'
      - 'traefik.http.middlewares.${RESTIC_COMPOSE_PROJECT_NAME}-redirect-web-secure.redirectscheme.scheme=https'
      - 'traefik.http.routers.${RESTIC_COMPOSE_PROJECT_NAME}-web.middlewares=${RESTIC_COMPOSE_PROJECT_NAME}-redirect-web-secure'
      - 'traefik.http.routers.${RESTIC_COMPOSE_PROJECT_NAME}-web.rule=Host(`${RESTIC_TRAEFIK_HOST}`)'
      - 'traefik.http.routers.${RESTIC_COMPOSE_PROJECT_NAME}-web.entrypoints=web'
      - 'traefik.http.routers.${RESTIC_COMPOSE_PROJECT_NAME}-web-secure.rule=Host(`${RESTIC_TRAEFIK_HOST}`)'
      - 'traefik.http.routers.${RESTIC_COMPOSE_PROJECT_NAME}-web-secure.tls.certresolver=resolver'
      - 'traefik.http.routers.${RESTIC_COMPOSE_PROJECT_NAME}-web-secure.entrypoints=web-secure'
      - 'traefik.http.middlewares.${RESTIC_COMPOSE_PROJECT_NAME}-web-secure-compress.compress=true'
      - 'traefik.http.routers.${RESTIC_COMPOSE_PROJECT_NAME}-web-secure.middlewares=${RESTIC_COMPOSE_PROJECT_NAME}-web-secure-compress'
      - 'traefik.http.services.${RESTIC_COMPOSE_PROJECT_NAME}-web-secure.loadbalancer.server.port=9898'
      - 'traefik.docker.network=${NETWORK_NAME}'
      - 'com.centurylinklabs.watchtower.enable=${WATCHTOWER_LABEL_ENABLE}'

volumes:
  backrest_data:
    name: ${RESTIC_COMPOSE_PROJECT_NAME}_data
  backrest_cache:
    name: ${RESTIC_COMPOSE_PROJECT_NAME}_cache
  backrest_tmp:
    name: ${RESTIC_COMPOSE_PROJECT_NAME}_tmp

  # External volumes from other stacks (read-only mounts)
  backup_core_postgres_data:
    name: core_postgres_data
    external: true
  backup_core_redis_data:
    name: core_redis_data
    external: true
  backup_directus_uploads:
    name: core_directus_uploads
    external: true
  backup_directus_bundle:
    name: core_directus_bundle
    external: true
  backup_awesome_data:
    name: awesome_data
    external: true
  backup_gotify_data:
    name: messaging_gotify_data
    external: true
  backup_scrapyd_data:
    name: scrapy_scrapyd_data
    external: true
  backup_scrapy_code:
    name: scrapy_scrapy_code
    external: true
  backup_n8n_data:
    name: n8n_n8n_data
    external: true
  backup_filestash_data:
    name: stash_filestash_data
    external: true
  backup_linkwarden_data:
    name: links_data
    external: true
  backup_linkwarden_meili_data:
    name: links_meili_data
    external: true
  backup_letsencrypt_data:
    name: proxy_letsencrypt_data
    external: true

networks:
  compose_network:
    name: ${NETWORK_NAME}
    external: true