From eff183dc63d470e969f7a64e8ff68c00bdf87d54 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Sun, 26 Jul 2026 04:37:33 +0200
Subject: Decouple restore and backup directories to avoid permission issues

Restore now uses /var/cache/git-restore (root-owned),
backup keeps /var/cache/git-backup (backup-owned)

Co-Authored-By: Claude.ai
---
 roles/backup/tasks/main.yml          | 12 ++++++++++++
 roles/backup/templates/restore.sh.j2 |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

(limited to 'roles/backup')

diff --git a/roles/backup/tasks/main.yml b/roles/backup/tasks/main.yml
index d51d3562..e21b8aaa 100644
--- a/roles/backup/tasks/main.yml
+++ b/roles/backup/tasks/main.yml
@@ -50,6 +50,18 @@
   ansible.builtin.include_tasks: "openrc.yml"
   when: ansible_facts['service_mgr'] == "openrc"
 
+- name: "Create restic restore cache directory"
+  become: true
+  ansible.builtin.file:
+    path: "/var/cache/{{ backup_name }}-restore"
+    state: "directory"
+    owner: "root"
+    group: "root"
+    mode: "0700"
+  tags:
+    - "never"
+    - "restore"
+
 - name: "Deploy restore script"
   become: true
   ansible.builtin.template:
diff --git a/roles/backup/templates/restore.sh.j2 b/roles/backup/templates/restore.sh.j2
index 35428693..44334138 100644
--- a/roles/backup/templates/restore.sh.j2
+++ b/roles/backup/templates/restore.sh.j2
@@ -20,7 +20,7 @@ export AWS_SECRET_ACCESS_KEY="${BACKUP_SECRET_ACCESS_KEY}"
 # --target /, as a guardrail against unbounded deletion, so scope it to
 # exactly the paths this job backs up.
 restic restore "{{ backup_restore_id }}" \
-  --cache-dir "/var/cache/{{ backup_name }}-backup" \
+  --cache-dir "/var/cache/{{ backup_name }}-restore" \
   --target "{{ restore_target }}" \
   --delete \
   --include {{ backup_paths | map('quote') | join(' --include ') }}
-- 
cgit v1.2.3