LibrePortal/scripts/backup/system/backup_system.sh

#!/bin/bash

# System-config backup.
#
# Snapshots the system config tree (<system>/configs — global settings, WebUI
# credentials, and crucially the BACKUP-LOCATION credentials) to every enabled
# backup location, so a bare-metal restore is self-sufficient. Without this the
# location creds live only on the box: lose it and you can't even reach your own
# remote backups (chicken-and-egg). It is a lightweight, static-dir snapshot — no
# container quiescing or DB dumps (those are per-app concerns), so it does NOT go
# through backupAppStart. The install tree (code) is reproducible from the release
# and is deliberately NOT included; per-app data is handled by backupAppStart.

backupSystemConfig()
{
    local source_path="${configs_dir%/}"
    if [[ ! -d "$source_path" ]]; then
        isNotice "System config dir not found ($source_path) — skipping system backup"
        return 0
    fi
    if [[ -z "$(resticEnabledLocations)" ]]; then
        isNotice "No backup locations enabled — skipping system config backup"
        return 0
    fi

    isHeader "Backing up system config"
    engineEnsureAllLocationsReady

    local idx ok=0 fail=0
    while IFS= read -r idx; do
        [[ -z "$idx" ]] && continue
        if engineBackupSystem "$idx" >/dev/null; then
            ok=$((ok + 1))
        else
            fail=$((fail + 1))
        fi
    done < <(resticEnabledLocations)

    if [[ $ok -eq 0 ]]; then
        isError "System config backup failed on all locations"
        return 1
    fi

    # Apply retention so system snapshots don't accumulate (respects append-only
    # locations; bypasses backupAppStart's per-app forget, so do it here).
    while IFS= read -r idx; do
        [[ -z "$idx" ]] && continue
        engineForgetSystem "$idx" >/dev/null 2>&1 || true
    done < <(resticEnabledLocations)

    if [[ $fail -gt 0 ]]; then
        isNotice "System config backed up to $ok location(s), failed on $fail"
    else
        isSuccessful "System config backed up to $ok location(s)"
    fi
    return 0
}

# Restore the latest system-config snapshot from a location into a STAGING dir.
# Deliberately does NOT overwrite live config — recovering creds/settings is a
# review-then-copy step, never an automatic blast over a running control plane.
backupRestoreSystemConfig()
{
    local idx="${1:-}"
    # Optional: which system-config snapshot. Empty or "latest" keeps the old
    # behaviour, which is what every existing caller wants.
    local want_snapshot="${2:-}"
    # Optional: WHOSE snapshot. Defaults to this machine's name, which is right
    # for "recover my own settings" and wrong for a rebuild — the snapshots
    # were tagged with the DEAD machine's name, and the moment a restore adopts
    # a config carrying a different install name, a later lookup under the new
    # name finds nothing at all.
    local want_host="${3:-}"
    [[ -z "$idx" ]] && idx=$(resticEnabledLocations | head -1)
    if [[ -z "$idx" ]]; then
        isError "No enabled backup location to restore the system config from"
        return 1
    fi

    # Root has to make this, because the manager owns restore_dir but restic
    # writes into the staging tree as the container user. `runFileOp mkdir`
    # here was denied every time, unchecked — and restic reports a permission
    # denial as "ignoring error …" and still exits 0, so this reported
    # "System config restored to: <path>" for a path that was never created.
    # That is the step the whole restore ordering depends on for credentials.
    local staging="${restore_dir%/}/system-config"
    if ! runOwnership restore-stage "$staging"; then
        isError "Could not create the staging directory at $staging"
        return 1
    fi

    isHeader "Restoring system config (to staging — live config is untouched)"
    if ! engineRestoreSystemLatest "$idx" "$staging" "$want_host" "$want_snapshot"; then
        isError "System config restore failed"
        return 1
    fi

    # Restic reports a permission denial as "ignoring error …" and still exits
    # 0, so its status alone is not evidence that anything landed. Look for the
    # tree as the user that wrote it — the staging dir is the container user's,
    # and the manager can traverse it but not read inside.
    local landed
    landed=$(runFileOp find "$staging" -mindepth 1 -maxdepth 1 -print -quit 2>/dev/null)
    if [[ -z "$landed" ]]; then
        isError "System config restore wrote nothing to $staging"
        return 1
    fi

    isSuccessful "System config restored to: $staging"
    isNotice "Review it, then copy what you need into ${configs_dir} (backup-location creds, logins, settings). Live config was NOT overwritten."
    return 0
}