# backhaul-agent — the public, containerized DB-backup client. Runs as a sidecar on a
# database's private Docker network: reaches the DB internally, pushes dumps home over HTTPS.
# No inbound ports. The agent logic is pure stdlib Python; this image just adds the DB dump
# tools and a once-a-minute cron.
FROM debian:bookworm-slim

# postgresql-client-17 from PGDG (Debian's default is 15, and pg_dump refuses a newer server
# major — nc-db and most modern Postgres are 17). default-mysql-client covers MySQL/MariaDB;
# sqlite3 lets the agent back up SQLite files (e.g. Vaultwarden) via `.dump`.
RUN set -eux; \
    apt-get update; \
    apt-get install -y --no-install-recommends \
        ca-certificates curl gnupg python3 cron default-mysql-client sqlite3; \
    install -d /usr/share/postgresql-common/pgdg; \
    curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc \
        -o /usr/share/postgresql-common/pgdg/apt.postgresql.org.asc; \
    echo "deb [signed-by=/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc] http://apt.postgresql.org/pub/repos/apt bookworm-pgdg main" \
        > /etc/apt/sources.list.d/pgdg.list; \
    apt-get update; \
    apt-get install -y --no-install-recommends postgresql-client-17; \
    rm -rf /var/lib/apt/lists/*

WORKDIR /app
COPY backhaul-agent.py /app/backhaul-agent.py
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]