Bring Postgres and the backup schedule back after a host reboot

[heliocosta-dev]

What and why

• Postgres had no restart: key in docker-compose.yml or deploy/docker-compose.yml, and Docker's default is "no". After a host reboot the database stayed down while the app (unless-stopped) looped on its boot-time migration. It now uses restart: unless-stopped.
• Backup was restart: "no". That stopped an unconfigured sidecar (print a hint, exit 0) from restart-looping, but it also meant a configured schedule never came back after a reboot, so scheduled dumps stopped without any warning. Now an unconfigured scripts/backup/entrypoint.sh prints its hint and then idles (exec sleep infinity) instead of exiting, and the service uses restart: unless-stopped. The configured path behaves exactly as before. Only the comment explaining why a failed start-up dump falls through to the schedule changed.
• The en and pt-BR self-hosting docs, SELF_HOSTING.md, .env.example and the setup wizard's byte-identical template now say the unconfigured service idles instead of exiting.

Every other service in the compose files (millionsend, docs, smtp, mx, clamav, and mx in deploy/mx) already had unless-stopped. docker-compose.prebuilt.yml only overrides images.

Behavior changes:

• A non-daily BACKUP_CRON still exits 1. Docker now retries it with backoff, so it shows as Restarting with the error in the logs instead of staying Exited.
• On boot, Docker starts containers without waiting for depends_on health checks. The app retries until Postgres is ready. A backup start-up dump that hits a database that isn't ready yet falls through to the schedule. It is usually skipped anyway, because the bucket already holds a dump from the last 26 hours.

Test plan

• docker compose config with all profiles passes for deploy/docker-compose.yml, docker-compose.yml, docker-compose.yml + docker-compose.prebuilt.yml and deploy/mx/docker-compose.yml. Every service resolves to restart: unless-stopped.
• The entrypoint passes sh -n, shellcheck and BusyBox ash -n on postgres:17-alpine (the backup image's base). BusyBox 1.37's sleep accepts infinity.
• Ran unconfigured, the same way compose runs it (--init, read-only, --cap-drop ALL, no-new-privileges, user postgres), with --restart unless-stopped. The old entrypoint restart-looped (7 restarts in 8 s). The new one prints the hint once, stays running with 0 restarts, and docker stop returns at once.
• Ran configured with a failing start-up dump: it falls through to the schedule and stays running with 0 restarts.
• docker compose run --rm still works on an unless-stopped service, so the documented one-off dump and restore commands are unaffected.
• pnpm lint, pnpm typecheck, and the @millionsend/ses tests (including the check that envTemplate() is byte-identical to .env.example).

🤖 Generated with Claude Code