feat: separate DB_DIR and BACKUP_DIR, constrain local destinations

Split DATA_DIR into DB_DIR (Postgres + Redis, fast local storage) and
BACKUP_DIR (archives, point to large/external mount). Each configurable
independently in .env.

Backend: local destination paths must be under /data/backups (container
mount point). Subdirectories auto-created on demand.

Frontend: path input shows fixed /data/backups/ prefix with editable
subdirectory suffix so users understand the folder structure.

Author: Roman Hrokholskyi

.env.example

@@ -9,5 +9,11 @@ JWT_SECRET=changeme-to-a-random-secret
 JWT_ALGORITHM=HS256
 ACCESS_TOKEN_EXPIRE_MINUTES=30
 
+# Host paths for persistent data
+# DB_DIR: Postgres + Redis (keep on fast local storage)
+# BACKUP_DIR: backup archives (point to large/external mount if needed)
+DB_DIR=./data
+BACKUP_DIR=./data/backups
+
 # App
 ENVIRONMENT=development

backend/api/app/services/destination_service.py

@@ -1,4 +1,5 @@
 import asyncio
+import os
 import shutil
 import uuid
 from pathlib import Path
@@ -49,21 +50,21 @@ async def _enrich_destinations(
     return result
 
 
+BACKUP_ROOT = Path(os.environ.get("BACKUP_DIR", "/data/backups"))
+
+
 async def create_destination(
     db: AsyncSession, user: User, body: DestinationCreate
 ) -> DestinationRead:
     if body.storage_type == StorageType.LOCAL:
-        path = Path(body.path)
-        if not path.is_absolute():
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail="Local destination path must be absolute",
-            )
-        if not path.is_dir():
+        path = Path(body.path).resolve()
+        if not path.is_relative_to(BACKUP_ROOT.resolve()):
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
-                detail=f"Path does not exist or is not a directory: {body.path}",
+                detail=f"Local path must be under {BACKUP_ROOT}",
             )
+        # Auto-create the subdirectory
+        path.mkdir(parents=True, exist_ok=True)
 
     if body.is_default:
         await destination_repo.clear_default(db)
@@ -105,17 +106,13 @@ async def update_destination(
     update_data = body.model_dump(exclude_unset=True)
 
     if destination.storage_type == StorageType.LOCAL and "path" in update_data:
-        path = Path(update_data["path"])
-        if not path.is_absolute():
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail="Local destination path must be absolute",
-            )
-        if not path.is_dir():
+        path = Path(update_data["path"]).resolve()
+        if not path.is_relative_to(BACKUP_ROOT.resolve()):
             raise HTTPException(
                 status_code=status.HTTP_400_BAD_REQUEST,
-                detail=f"Path does not exist or is not a directory: {update_data['path']}",
+                detail=f"Local path must be under {BACKUP_ROOT}",
             )
+        path.mkdir(parents=True, exist_ok=True)
     if update_data.get("is_default"):
         await destination_repo.clear_default(db)
 

backend/api/tests/integration/conftest.py

@@ -1,3 +1,5 @@
+import tempfile
+from pathlib import Path
 from unittest.mock import AsyncMock, patch
 
 import pytest_asyncio
@@ -29,6 +31,7 @@ async def override_get_db():
             new_callable=AsyncMock,
             return_value=None,
         ),
+        patch("app.services.destination_service.BACKUP_ROOT", Path(tempfile.gettempdir())),
     ):
         async with AsyncClient(
             transport=ASGITransport(app=fastapi_app), base_url="http://test"
@@ -50,10 +53,13 @@ async def override_get_db():
 
     fastapi_app.dependency_overrides[get_db] = override_get_db
 
-    with patch(
-        "app.services.destination_service._get_available_bytes",
-        new_callable=AsyncMock,
-        return_value=None,
+    with (
+        patch(
+            "app.services.destination_service._get_available_bytes",
+            new_callable=AsyncMock,
+            return_value=None,
+        ),
+        patch("app.services.destination_service.BACKUP_ROOT", Path(tempfile.gettempdir())),
     ):
         async with AsyncClient(
             transport=ASGITransport(app=fastapi_app), base_url="http://test"

backend/api/tests/test_destination_service.py

@@ -1,48 +1,58 @@
-from unittest.mock import AsyncMock, patch
+import tempfile
+from pathlib import Path
+from unittest.mock import AsyncMock, patch, MagicMock
+
+import pytest
 
 from app.services import destination_service
 from shared.enums import StorageType
 from shared.models import Destination
 from shared.schemas import DestinationCreate
 
-# All tests patch Path.is_dir so fake paths like /tmp/test pass validation,
-# and _get_available_bytes so disk checks don't run on test fixtures.
-_PATCHES = [
-    patch(
+# Shared patches: BACKUP_ROOT=/tmp so test paths like /tmp/test pass,
+# mkdir is no-op, disk check returns None.
+_patches = {
+    "root": patch("app.services.destination_service.BACKUP_ROOT", Path(tempfile.gettempdir())),
+    "mkdir": patch("app.services.destination_service.Path.mkdir", MagicMock()),
+    "avail": patch(
         "app.services.destination_service._get_available_bytes",
         new_callable=AsyncMock,
         return_value=None,
     ),
-    patch("app.services.destination_service.Path.is_dir", return_value=True),
-]
+}
+
+
+def _apply_patches():
+    mocks = {k: p.start() for k, p in _patches.items()}
+    return mocks
+
+
+def _stop_patches():
+    for p in _patches.values():
+        p.stop()
 
 
-def _apply(fn):
-    for p in reversed(_PATCHES):
-        fn = p(fn)
-    return fn
+@pytest.fixture(autouse=True)
+def _patch_destination_service():
+    _apply_patches()
+    yield
+    _stop_patches()
 
 
-@_apply
-async def test_create_destination(mock_is_dir, mock_avail, db_session, admin_user):
-    body = DestinationCreate(alias="Test Dest", path="/tmp/test")
+async def test_create_destination(db_session, admin_user):
+    body = DestinationCreate(alias="Test Dest", path=f"{tempfile.gettempdir()}/test")
     result = await destination_service.create_destination(db_session, admin_user, body)
     assert result.alias == "Test Dest"
     assert result.storage_type == StorageType.LOCAL
     assert result.is_default is False
 
 
-@_apply
-async def test_create_default_clears_old_default(mock_is_dir, mock_avail, db_session, admin_user):
-    body1 = DestinationCreate(
-        alias="First", path="/tmp/first", is_default=True
-    )
+async def test_create_default_clears_old_default(db_session, admin_user):
+    body1 = DestinationCreate(alias="First", path=f"{tempfile.gettempdir()}/first", is_default=True)
     first = await destination_service.create_destination(db_session, admin_user, body1)
     assert first.is_default is True
 
-    body2 = DestinationCreate(
-        alias="Second", path="/tmp/second", is_default=True
-    )
+    body2 = DestinationCreate(alias="Second", path=f"{tempfile.gettempdir()}/second", is_default=True)
     second = await destination_service.create_destination(db_session, admin_user, body2)
     assert second.is_default is True
 
@@ -51,9 +61,8 @@ async def test_create_default_clears_old_default(mock_is_dir, mock_avail, db_ses
     assert refreshed_first.is_default is False
 
 
-@_apply
-async def test_list_destinations(mock_is_dir, mock_avail, db_session, admin_user):
-    body = DestinationCreate(alias="Listed", path="/tmp/listed")
+async def test_list_destinations(db_session, admin_user):
+    body = DestinationCreate(alias="Listed", path=f"{tempfile.gettempdir()}/listed")
     await destination_service.create_destination(db_session, admin_user, body)
 
     results = await destination_service.list_destinations(db_session)
@@ -62,12 +71,9 @@ async def test_list_destinations(mock_is_dir, mock_avail, db_session, admin_user
     assert "Listed" in aliases
 
 
-@_apply
-async def test_delete_destination(mock_is_dir, mock_avail, db_session, admin_user):
-    body = DestinationCreate(alias="ToDelete", path="/tmp/delete")
-    created = await destination_service.create_destination(
-        db_session, admin_user, body
-    )
+async def test_delete_destination(db_session, admin_user):
+    body = DestinationCreate(alias="ToDelete", path=f"{tempfile.gettempdir()}/delete")
+    created = await destination_service.create_destination(db_session, admin_user, body)
 
     await destination_service.delete_destination(db_session, str(created.id))
 

docker-compose.yml

@@ -15,7 +15,7 @@ services:
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-gitbacker}
       POSTGRES_DB: ${POSTGRES_DB:-gitbacker}
     volumes:
-      - ${DATA_DIR:-./data}/postgres:/var/lib/postgresql/data
+      - ${DB_DIR:-./data/postgres}:/var/lib/postgresql/data
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-gitbacker}"]
       interval: 5s
@@ -26,7 +26,7 @@ services:
   redis:
     image: redis:7-alpine
     volumes:
-      - ${DATA_DIR:-./data}/redis:/data
+      - ${DB_DIR:-./data/redis}:/data
     healthcheck:
       test: ["CMD", "redis-cli", "ping"]
       interval: 5s
@@ -49,7 +49,7 @@ services:
       ACCESS_TOKEN_EXPIRE_MINUTES: ${ACCESS_TOKEN_EXPIRE_MINUTES:-30}
       ENVIRONMENT: production
     volumes:
-      - ${DATA_DIR:-./data}/backups:/data/backups
+      - ${BACKUP_DIR:-./data/backups}:/data/backups
     ports:
       - "${API_PORT:-8000}:8000"
     restart: unless-stopped
@@ -65,7 +65,7 @@ services:
       DATABASE_URL: postgresql+psycopg2://${POSTGRES_USER:-gitbacker}:${POSTGRES_PASSWORD:-gitbacker}@postgres:5432/${POSTGRES_DB:-gitbacker}
       REDIS_URL: redis://redis:6379/0
     volumes:
-      - ${DATA_DIR:-./data}/backups:/data/backups
+      - ${BACKUP_DIR:-./data/backups}:/data/backups
     restart: unless-stopped
 
   frontend:

frontend/src/app/destinations/page.tsx

@@ -82,9 +82,12 @@ export default function DestinationsPage() {
     enabled: !!token,
   });
 
+  const BACKUP_ROOT = "/data/backups";
+  const fullPath = path ? `${BACKUP_ROOT}/${path}` : BACKUP_ROOT;
+
   const createMutation = useMutation({
     mutationFn: () =>
-      createDestination(token!, { alias, path }),
+      createDestination(token!, { alias, path: fullPath }),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ["destinations"] });
       setOpen(false);
@@ -150,17 +153,22 @@ export default function DestinationsPage() {
                   />
                 </div>
                 <div className="space-y-2">
-                  <Label htmlFor="path">Path</Label>
-                  <Input
-                    id="path"
-                    value={path}
-                    onChange={(e) => setPath(e.target.value)}
-                    placeholder="/data/backups"
-                    required
-                  />
+                  <Label htmlFor="path">Subdirectory</Label>
+                  <div className="flex items-center rounded-md border border-input">
+                    <span className="shrink-0 select-none border-r bg-muted px-3 py-2 text-xs font-mono text-muted-foreground">
+                      /data/backups/
+                    </span>
+                    <input
+                      id="path"
+                      value={path}
+                      onChange={(e) => setPath(e.target.value.replace(/^\/+/, ""))}
+                      placeholder="e.g. critical"
+                      className="flex-1 bg-transparent px-3 py-2 text-sm font-mono outline-none placeholder:text-muted-foreground"
+                    />
+                  </div>
                   <p className="text-xs text-muted-foreground">
-                    Absolute path to an existing directory. Must be accessible by the
-                    API and worker containers (mount it in docker-compose.yml).
+                    Optional subfolder within the backup volume. Leave empty to use
+                    the root. The directory will be created automatically.
                   </p>
                 </div>
                 <Button