Backup compose and env files

[grimer@lemmy.world]

Just curious if there is an easy way to back up my docker-compose.yaml and .env files. I have the following directory structure for my containers:

-docker
  -<name of container>
    -.env
    -docker-compose.yml

I'd like to copy those two files for each container folder but no other subfolders that may also be in the container folder (config, data, etc). I've been trying to get my restic backups to do it but I just can't figure it out.

Is there a better way?
I'd like to have backups in case my entire server dies.___

[punkrocksportsfan@fanaticus.social]

Keeping backup of .env means exposing sensitive creds ?

[helloroot@lemy.lol]

what about a local, encrypted backup

[dohpaz42@lemmy.world]

As a Mac user, I like Time Machine for backups. It’s not perfect, but it gets the job done. There is a Linux version.

Nb. I’ve not used this particular software, so YMMV.

[punkrocksportsfan@fanaticus.social]

It’s like you have secrets that you pull in to build your .env which should only be used by the stuff that needs it and it’s not shared.

I’m assuming this is a production backup and the idea that someone has a prod .env file gives me the Willies.

Id want to change all the cards.

[grimer@lemmy.world]

In my particular case I only have a few .env files and they don't have any credentials in them. This is mostly for the docker-compose files.

[mangopenguin@lemmy.blahaj.zone]

I mean... just back them up like any other file. If you want them and nothing else, then do an exclude all and then include after for those files.

But you also need to backup the rest of the data, so I'm not sure why you'd want to exclude all the other folders.

[mangopenguin@lemmy.blahaj.zone]

Backups are encrypted so it shouldn't be an issue.

[regalpotoo@lemmy.world]

Check them into Git, but be cautious about credentials that might live in the env files that you don't want to expose publicly.

[grimer@lemmy.world]

That is an option I've been thinking about but I've never used it, I'm not a dev. Maybe I'll look at it more seriously since it does sound like what would work best, I'd really apprecieate the versioning. Thanks!

[Guest]

I have mine in git! I have:

-docker
  - .env
  - <thing name>
      - dockers-compose.yml

Then using docker compose --env-file ../.env -v up -d it uses the above .env file. (../ means up one folder)

For more details and a bunch of my compose files checkout my repo!
https://github.com/shadybraden/homelab/tree/main/docker

[Guest]

Definitely worth a shot.

One thing I do to prevent stuff from getting into a public git repo is:

• In the git repo, make a file called .gitignore then add the line .env to it. Then git will ignore any file named .env
• edit compose files from a computer that is separate from the one that gets secrets. I have my desktop setup to push to github. Then I make a change, then simply run `git pull on my server to download the changes.
• make the .env only viewable by root (you'll have to use sudo nano) by running sudo chmod 600 .env && sudo chown root:root .env

[Guest]

You can specify a folder in your files for configs, and a different one for the compose and env:

- config
   - <container_config>
- docker
  - container 
      - compose.yml

[scrubbles@poptalk.scrubbles.tech]

Docker compose in git. Env in 1password or whatever password manager you use. Most support uploading a raw file.