feat(persistence): Automated daily PostgreSQL backup (NFR-004)

[DigiBanks99]

Parent PRD

#242

What to build

Implement automated daily PostgreSQL backups satisfying NFR-004 (RPO < 24 hours). The docker-compose.prod.yml already declares a postgres_backups volume (/var/backups/postgresql) — this slice adds the backup service that actually writes to it.

This slice covers:

• Add a db-backup service to deployment/docker-compose.prod.yml using a standard PostgreSQL backup image (e.g., prodrigestivill/postgres-backup-local or equivalent)
  • Connects to the postgres service using the same credentials
  • Runs daily pg_dump on a configurable schedule (default: 02:00 daily)
  • Writes compressed backup files to the existing postgres_backups volume
  • Retains the last 7 daily backups; older files are pruned automatically
  • Restarts unless-stopped to survive host reboots
• The backup container is on menlo-network and waits for postgres to be healthy before running
• deployment/README.md updated with:
  • How to verify a backup ran (check backup file listing in the volume)
  • How to restore from a backup (pg_restore or psql command against the backup file)
  • How to configure the backup schedule and retention via environment variables

Acceptance criteria

• db-backup service exists in deployment/docker-compose.prod.yml
• Backup service uses the already-declared postgres_backups volume
• Backup service depends on postgres being healthy before running
• Backup schedule defaults to daily; configurable via environment variable
• At least 7 daily backups are retained; older ones are pruned automatically
• deployment/README.md documents how to verify a backup exists
• deployment/README.md documents how to restore from a backup file
• The compose file still starts cleanly with podman compose up / docker compose up

Blocked by

• Blocked by feat(persistence): Menlo.Application infrastructure + Aspire PostgreSQL wiring #244 (PostgreSQL service must be configured before wiring up backup)

User stories addressed

From PRD #242 (specification NFR-004):

NFR-004 — Backup: Automated daily backups must be performed to a separate local storage location. RPO < 24 hours.