From 7db528d39bc08846c5c3fb57ac25e1280b1ecc2a Mon Sep 17 00:00:00 2001
From: oscarg <oscargrey.sld@proton.me>
Date: Tue, 11 Aug 2026 08:21:56 +0000
Subject: [PATCH] Added automated backups.

---
 .env.example       | 10 +++++++++-
 docker-compose.yml | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/.env.example b/.env.example
index ed6b2d7..9e389a6 100644
--- a/.env.example
+++ b/.env.example
@@ -5,8 +5,16 @@ DOMAIN_NAME=example.com
 WEBMAIL_SUBDOMAIN=mail
 MAIL_SUBDOMAIN=mx
 
+# Compose Profiles (only backup-enabled exists)
+COMPOSE_PROFILES=
+
+# Restic Config (Only fill out if enabling backups)
+RESTIC_REPOSITORY=""
+RESTIC_PASSWORD=""
+RESTIC_HOSTNAME=""
+
 # Secret Keys
-# This should be generated automatically.
+# These should be generated with `openssl rand -base64 32`.
 BULWARK_SECRET=
 OAUTH_SECRET=
 
diff --git a/docker-compose.yml b/docker-compose.yml
index 8a7922f..dc9c3c1 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -63,6 +63,23 @@ services:
             - ./service_data/cert_sync:/data
         command: sh /data/sync-certs.sh
 
+    backup:
+        image: mazzolino/restic
+        container_name: backup
+        restart: unless-stopped
+        hostname: ${RESTIC_HOSTNAME}
+        profiles:
+            - backup-enabled
+        environment:
+            - BACKUP_CRON="0 2 * * *"
+            - RUN_ON_STARTUP=true
+            - RESTIC_REPOSITORY=${RESTIC_REPOSITORY}
+            - RESTIC_PASSWORD=${RESTIC_PASSWORD}
+            - RESTIC_FORGET_ARGS=--keep-last 7 --keep-daily 7 --keep-weekly 4 --prune
+        volumes:
+            - ~/.ssh:/run/secrets/.ssh:ro
+            - /var/lib/docker/volumes:/data/volumes:ro
+
 volumes:
     stalwart-etc:
     stalwart-data: