Always-On Agent Host Kit

The fourth piece is the weekly price sheet — the same table as the homepage, frozen into the kit so you have a dated copy.

services:
  caddy:
    image: caddy:2-alpine
    restart: unless-stopped
    ports: ["80:80", "443:443"]
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy_data:/data
    depends_on: [agent]

  agent:
    image: ${AGENT_IMAGE:-python:3.12-slim}
    restart: unless-stopped
    env_file: .env
    working_dir: /app
    volumes:
      - ./agent:/app
      - agent_data:/var/lib/agent
    command: ["python", "-m", "agent"]
    depends_on:
      redis: { condition: service_healthy }
      db: { condition: service_healthy }
    healthcheck:
      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health')"]
      interval: 30s
      timeout: 5s
      retries: 3

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    command: ["redis-server", "--appendonly", "yes"]
    volumes: [redis_data:/data]
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s

  db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_USER: agent
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
      POSTGRES_DB: agent
    volumes: [pg_data:/var/lib/postgresql/data]
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U agent"]
      interval: 10s

volumes:
  caddy_data:
  agent_data:
  redis_data:
  pg_data:

Replace AGENT_IMAGE and the python -m agent command with your worker. Do not paste API keys into the compose file.

1. 1. Name the state. List volumes, .env, the Caddyfile, and any agent workspace directories. If it is not on the list, it will not come back.
2. 2. Snapshot is not off-box. Take the vendor snapshot, then copy a tarball or pg_dump to object storage or another region. Same-host snapshots die with the host.
3. 3. Encrypt secrets separately. The dump of Postgres should not be the only copy of your API keys. Keep .env in a password manager.
4. 4. Restore onto a fresh VM once. A backup you have never restored is a rumor. Budget an hour after the first week.
5. 5. Rehearse DNS and TLS. Restore is not done until HTTPS answers on the new IP.