From b98eecbb36ef18984f8a962bf51fba1f6580905f Mon Sep 17 00:00:00 2001
From: Yun Chan <yunchan@twentyoz.kr>
Date: Tue, 1 Sep 2026 12:34:14 +0900
Subject: [PATCH] =?UTF-8?q?=EC=9D=BC=EC=9D=BC=20=EA=B2=80=EC=A6=9D?=
 =?UTF-8?q?=ED=98=95=20DB=20=EB=B0=B1=EC=97=85=20=EC=82=AC=EC=9D=B4?=
 =?UTF-8?q?=EB=93=9C=EC=B9=B4=EB=A5=BC=20=EC=A0=95=EC=8B=9D=20=EC=8A=A4?=
 =?UTF-8?q?=ED=83=9D=EC=97=90=20=EC=B6=94=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 infra/docker-compose.nas.yml | 41 ++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/infra/docker-compose.nas.yml b/infra/docker-compose.nas.yml
index b16881a..bd754fd 100644
--- a/infra/docker-compose.nas.yml
+++ b/infra/docker-compose.nas.yml
@@ -50,6 +50,47 @@ services:
       com.vignette.data-role: database-ssot
     networks: [backend]
 
+  db-backup:
+    # 매일 검증형 custom dump를 ./backups/auto 에 원자적으로 남기고 보존기간을 넘긴
+    # 파일만 지운다. DB에는 읽기만 수행하며 실패 시 해당 회차 파일을 남기지 않는다.
+    image: ${VIGNETTE_NAS_POSTGRES_IMAGE:?Immutable NAS PostgreSQL image ID is required}
+    restart: unless-stopped
+    depends_on:
+      db: { condition: service_healthy }
+    entrypoint:
+      - sh
+      - -ceu
+      - |
+        while true; do
+          ts=$$(date +%Y%m%d-%H%M%S)
+          tmp="/backups/auto/.partial-$${ts}.dump"
+          out="/backups/auto/vignette-$${ts}.dump"
+          if PGPASSWORD="$${POSTGRES_PASSWORD}" pg_dump -h db -U "$${POSTGRES_USER}" -d "$${POSTGRES_DB}" -Fc -f "$$tmp" \
+             && PGPASSWORD="$${POSTGRES_PASSWORD}" pg_restore -l "$$tmp" > /dev/null; then
+            mv "$$tmp" "$$out"
+            echo "backup ok: $$out ($$(wc -c < "$$out") bytes)"
+          else
+            rm -f "$$tmp"
+            echo "backup FAILED at $$ts" >&2
+          fi
+          find /backups/auto -name 'vignette-*.dump' -mtime +${VIGNETTE_BACKUP_RETENTION_DAYS:-14} -delete
+          sleep 86400
+        done
+    environment:
+      POSTGRES_USER: ${POSTGRES_USER:-vignette_owner}
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?NAS PostgreSQL owner password is required}
+      POSTGRES_DB: ${POSTGRES_DB:-vignette}
+    volumes:
+      - type: bind
+        source: ./backups/auto
+        target: /backups/auto
+    security_opt:
+      - no-new-privileges:true
+    labels:
+      <<: *production-labels
+      com.vignette.data-role: database-backup
+    networks: [backend]
+
   engine:
     <<: *api-image
     command: