From 1d76ab1c82b30832a6b6a161878704bd3670caba Mon Sep 17 00:00:00 2001
From: prosolis <5590409+prosolis@users.noreply.github.com>
Date: Mon, 27 Jul 2026 06:25:52 -0700
Subject: [PATCH] Guard against Petal starting on an unmounted data volume

The mountpoint directory exists whether or not the encrypted volume is
mounted, so a boot where the unlock failed would start Petal against an
empty unencrypted directory and serve a blank database -- the failure
mode that looks like data loss. .volume-ok lives on the encrypted
filesystem and is bind-mounted with create_host_path:false, so its
absence is a container start failure instead of a silent empty DB.
---
 docker-compose.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/docker-compose.yml b/docker-compose.yml
index dbd7df3..dfba15d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -51,6 +51,20 @@ services:
       # A bind mount, not a named volume: petal.db must be trivially reachable
       # from the host for the nightly backup and for a restore.
       - ./data:/data
+      # Mount-liveness guard. On the VPS ./data is an encrypted LUKS volume, and
+      # the mountpoint directory still exists when that volume is NOT mounted —
+      # so without this, a boot where the unlock failed would start Petal
+      # against an empty unencrypted directory and quietly serve a blank
+      # database. .volume-ok lives on the encrypted filesystem, and
+      # create_host_path: false turns its absence into a container start
+      # failure instead. Harmless elsewhere: create the file once and it is a
+      # no-op. See deploy/README.md §6.
+      - type: bind
+        source: ./data/.volume-ok
+        target: /data/.volume-ok
+        read_only: true
+        bind:
+          create_host_path: false
     networks:
       - traefik
       - internal