feat: add PDS backup service with rclone + S3

Three backup types: pre-update (Watchtower lifecycle hook),
pre-deploy (Ansible task), and periodic (systemd timer).
All uploads go to OVH S3 via rclone. Backs up SQLite DBs,
pds.env, and Caddy config.

👾 Generated with [Letta Code](https://letta.com)

Co-Authored-By: Letta Code <noreply@letta.com>

templates/backup.service.j2

@@ -0,0 +1,8 @@
+[Unit]
+Description=PDS Backup Service
+After=docker.service
+Requires=docker.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/backup.sh periodic

templates/backup.sh.j2

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -euo pipefail
+
+BACKUP_TYPE="${1:-periodic}"
+DATA_DIR="{{ pds_data_dir }}"
+BACKUP_BUCKET="{{ pds_backup_s3_bucket }}"
+RCLONE="rclone"
+RCLONE_CONFIG="/etc/rclone/rclone.conf"
+TIMESTAMP=$(date -u +%Y%m%d-%H%M%S)
+BACKUP_NAME="${BACKUP_TYPE}-${TIMESTAMP}.tar.gz"
+TMP_DIR="/tmp/pds-backup-$$"
+
+cleanup() {
+    rm -rf "$TMP_DIR"
+}
+trap cleanup EXIT
+
+mkdir -p "$TMP_DIR"
+
+# Create tarball of PDS data
+tar czf "$TMP_DIR/$BACKUP_NAME" \
+    -C "$(dirname "$DATA_DIR")" \
+    "$(basename "$DATA_DIR")"
+
+# Upload to S3
+$RCLONE copy "$TMP_DIR/$BACKUP_NAME" "pds-backup:$BACKUP_BUCKET/" \
+    --config "$RCLONE_CONFIG"
+
+echo "Backup complete: ${BACKUP_NAME} -> ${BACKUP_BUCKET}"

templates/backup.timer.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=Periodic PDS Backup
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec={{ pds_backup_period }}
+Persistent=true
+
+[Install]
+WantedBy=timers.target

templates/compose.yaml.j2

@@ -8,6 +8,21 @@ services:
       - type: bind
         source: {{ pds_data_dir }}
         target: {{ pds_data_dir }}
+      - type: bind
+        source: /usr/bin/rclone
+        target: /usr/local/bin/rclone
+        read_only: true
+      - type: bind
+        source: /etc/rclone/rclone.conf
+        target: /etc/rclone/rclone.conf
+        read_only: true
+      - type: bind
+        source: /usr/local/bin/backup.sh
+        target: /usr/local/bin/backup.sh
+        read_only: true
+    labels:
+      - com.centurylinklabs.watchtower.lifecycle.pre-update=/usr/local/bin/backup.sh preupdate
+      - com.centurylinklabs.watchtower.lifecycle.pre-update-timeout=2
     env_file:
       - {{ pds_data_dir }}/pds.env
 
@@ -36,3 +51,4 @@ services:
     environment:
       - WATCHTOWER_CLEANUP=true
       - WATCHTOWER_POLL_INTERVAL=3600
+      - WATCHTOWER_LIFECYCLE_HOOKS=true

templates/rclone.conf.j2

@@ -0,0 +1,9 @@
+[pds-backup]
+type = s3
+provider = OVH
+env_auth = false
+access_key_id = {{ pds_backup_s3_access_key }}
+secret_access_key = {{ pds_backup_s3_secret_key }}
+region = {{ pds_backup_s3_region }}
+endpoint = {{ pds_backup_s3_endpoint }}
+force_path_style = true