7acfdabbac
The backup engine already drops to the backup user (sudo -E -u $docker_install_user) and backupLocationOwner == $docker_install_user, which is exactly what runFileOp/runFileWrite resolve to in both modes. So convert the raw-sudo data ops (mkdir/chmod/rm/find/cat/grep/mv/chown/tee on backup repos, location configs, keys, manifests) to runFileOp/runFileWrite — creating files as the owner directly, no root chown. backup_verify creates its scratch as the backup user (runFileOp mktemp) instead of chown-after. Binary installs (kopia tar/install, borg dnf) -> runSystem. The 44 sudo -u engine drops stay (already least-privilege; the scoped sudoers will grant them). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: librelad <librelad@digitalangels.vip>
78 lines
2.0 KiB
Bash
78 lines
2.0 KiB
Bash
#!/bin/bash
|
|
|
|
# Per-location directory layout helpers. Each backup location is one
|
|
# directory under configs/backup/locations/<idx>/ containing:
|
|
#
|
|
# location.config — sourced at startup, holds CFG_BACKUP_LOC_<idx>_*
|
|
# including PASSWORD (auto-randomized from
|
|
# RANDOMIZEDPASSWORD<N> on first install)
|
|
# ssh.key — private SSH key when AUTH=key (chmod 0600)
|
|
# kopia.config — kopia adapter's connection state (chmod 0600)
|
|
#
|
|
# Everything for one location is co-located here so add/remove operations
|
|
# are mkdir / rm of one directory.
|
|
|
|
backupLocationsDir()
|
|
{
|
|
echo "$configs_dir/backup/locations"
|
|
}
|
|
|
|
backupLocationDir()
|
|
{
|
|
local idx="$1"
|
|
echo "$(backupLocationsDir)/$idx"
|
|
}
|
|
|
|
backupLocationConfig()
|
|
{
|
|
local idx="$1"
|
|
echo "$(backupLocationDir "$idx")/location.config"
|
|
}
|
|
|
|
backupLocationSshKey()
|
|
{
|
|
local idx="$1"
|
|
echo "$(backupLocationDir "$idx")/ssh.key"
|
|
}
|
|
|
|
backupLocationKopiaConfig()
|
|
{
|
|
local idx="$1"
|
|
echo "$(backupLocationDir "$idx")/kopia.config"
|
|
}
|
|
|
|
# Owner used when chowning per-location files. Falls back to sudo_user_name
|
|
# when docker_install_user hasn't been resolved (CLI startup before
|
|
# checkInstallTypeRequirement runs).
|
|
backupLocationOwner()
|
|
{
|
|
echo "${docker_install_user:-${sudo_user_name:-libreportal}}"
|
|
}
|
|
|
|
backupLocationEnsureDir()
|
|
{
|
|
local idx="$1"
|
|
local dir
|
|
dir=$(backupLocationDir "$idx")
|
|
local owner
|
|
owner=$(backupLocationOwner)
|
|
runFileOp mkdir -p "$dir"
|
|
runFileOp chown "$owner":"$owner" "$dir"
|
|
runFileOp chmod 0700 "$dir"
|
|
}
|
|
|
|
backupLocationResolvedPath()
|
|
{
|
|
local idx="$1"
|
|
local mode
|
|
mode=$(resticLocationField "$idx" PATH_MODE)
|
|
if [[ "$mode" == "auto" ]]; then
|
|
# Base dir is the configurable Default Backup Location (Backup Engine
|
|
# config); each location gets its own numbered subfolder.
|
|
local base="${CFG_BACKUP_DEFAULT_PATH:-$docker_dir/backups}"
|
|
echo "${base%/}/${idx}"
|
|
else
|
|
resticLocationField "$idx" PATH
|
|
fi
|
|
}
|