Stack-level backup: Nextcloud WebDAV + Docker volume backup via SSH

- backup container: builds from Dockerfile (adds openssh-client, curl, jq)
  fetches Nextcloud creds from Settings API at runtime, pg_dumps all DBs
  and tars Docker volumes on each app LXC via SSH, uploads to Nextcloud
  WebDAV, writes runs.ndjson log, heartbeats Uptime Kuma
- updater: gains docker-cli, Docker socket mount, /backup/runs,
  /backup/status, /backup/trigger endpoints; reads runs.ndjson for status
- kuma_data mounted read-only into backup container for local backup
- .env.example updated with SETTINGS_URL, SETTINGS_SECRET, PG_SUPERPASS

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -3,7 +3,6 @@ services:
     image: louislam/uptime-kuma:2
     security_opt:
       - apparmor=unconfined
-
     volumes:
       - kuma_data:/app/data
     ports:
@@ -22,26 +21,32 @@ services:
       - FORGEJO_TOKEN=${FORGEJO_TOKEN:-}
       - AUTH_URL=${AUTH_URL:-http://10.10.10.101:3001}
       - CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
+      - BACKUP_CONTAINER=${BACKUP_CONTAINER:-management-backup-1}
     volumes:
       - /root/.ssh:/root/.ssh:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+      - backup_data:/backups:ro
     ports:
       - "9000:9000"
     restart: unless-stopped
 
   backup:
-    image: postgres:16-alpine
+    build: ./backup
     security_opt:
       - apparmor=unconfined
     entrypoint: ["/bin/sh", "-c", "crond -f -l 8"]
     environment:
       - BACKUP_DATABASES=${BACKUP_DATABASES}
       - PG_SUPERPASS=${PG_SUPERPASS}
-      - BACKUP_REMOTE=${BACKUP_REMOTE}
       - KUMA_PUSH_URL=${KUMA_PUSH_URL}
+      - SETTINGS_URL=${SETTINGS_URL:-http://10.10.10.116:3080}
+      - SETTINGS_SECRET=${SETTINGS_SECRET}
+      - SSH_KEY=${SSH_KEY:-/root/.ssh/hotel-manage_deploy}
     volumes:
       - backup_data:/backups
       - ./backup/backup.sh:/etc/periodic/daily/backup:ro
       - /root/.ssh:/root/.ssh:ro
+      - kuma_data:/kuma_data:ro
     restart: unless-stopped
 
 volumes: