# Kvitt backup job image (SPEC §10.3, §10.9): alpine with sqlite, gzip, tar, rclone and backup.sh on a daily schedule.
# Versions resolved 2026-10-17: alpine 3.24.2 (Docker Hub official image, multi-arch index digest below);
# packages from Alpine v3.24 main/community: sqlite 3.53.4, rclone 1.74.1, tar 1.35, tzdata 2026e;
# 2026-10-18: supercronic 0.2.49.
# The scheduler is supercronic, not busybox crond: on the Pi the container runs as uid 10001, not root (README,
# "Backup uid"), and busybox crond cannot run jobs as a non-root user (checked 2026-10-18). See D-104.
FROM docker.io/library/alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6

RUN apk add --no-cache \
      "sqlite~3.53" \
      "rclone~1.74" \
      "tar~1.35" \
      "supercronic~0.2" \
      gzip \
      tzdata \
 && adduser -D -u 10001 -g "Kvitt backup" kvitt \
 && mkdir -p /backups /data \
 && chown 10001:10001 /backups /data

COPY backup.sh healthcheck.sh /
RUN chmod 0755 /backup.sh /healthcheck.sh \
 && echo '30 3 * * * /backup.sh' > /etc/kvitt-backup.crontab

ENV TZ=Europe/Stockholm
# Daily at 03:30 Europe/Stockholm; /tmp/kvitt-started feeds the healthcheck's "no run yet since start".
# The development stack runs it on demand instead (`docker compose run --rm backup /backup.sh`, see infra/README.md).
CMD ["sh", "-c", "date +%s > /tmp/kvitt-started && exec supercronic -quiet /etc/kvitt-backup.crontab"]