From c1ebcfed32e690afd33e01c4a61e66400e6158ee Mon Sep 17 00:00:00 2001
From: nicodes <nicozessoules@gmail.com>
Date: Fri, 28 Aug 2026 18:14:27 -0600
Subject: [PATCH] Stage encrypted backups for retrieval

---
 scripts/alpine.sh | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/scripts/alpine.sh b/scripts/alpine.sh
index d6e6923..0d02d0b 100644
--- a/scripts/alpine.sh
+++ b/scripts/alpine.sh
@@ -1508,6 +1508,8 @@ audit=/var/log/komizo/tasks.log
 lock=/run/komizo/task-termcade.lock
 container=termcade-komizo-task
 backup_dir=/var/lib/komizo/termcade-backups
+export_archive="/home/$DOAS_USER/termcade-backup.tar.age"
+export_metadata="/home/$DOAS_USER/termcade-backup.metadata"
 identity_file=/srv/termcade/backup-age-identity
 old_volume=termcade_pb_data
 fresh_volume=termcade_pb_data_reset_20260828
@@ -1569,8 +1571,8 @@ if [ "$task" = release-identity-backfill ]; then
 		run --rm --no-deps -T --name "$container" "$service" "$executable" "$mode" || rc=$?
 else
 	mkdir -p "$backup_dir"
-	chown root:"$DOAS_USER" "$backup_dir"
-	chmod 710 "$backup_dir"
+	chown root:root "$backup_dir"
+	chmod 700 "$backup_dir"
 	case "$mode" in
 		inspect)
 			docker volume inspect "$old_volume" >/dev/null
@@ -1594,6 +1596,8 @@ pb_data_drill" ] || { echo "task-termcade: wrong volume contract" >&2; exit 65;
 			[ "$(sha256sum "$backup_dir/current.tar.age" | cut -d' ' -f1)" = "$sha" ] || { echo "task-termcade: encrypted checksum mismatch" >&2; exit 65; }
 			chown "$DOAS_USER":root "$backup_dir/current.tar.age" "$backup_dir/current.metadata"
 			chmod 400 "$backup_dir/current.tar.age" && chmod 444 "$backup_dir/current.metadata"
+			install -o "$DOAS_USER" -g "$DOAS_USER" -m 400 "$backup_dir/current.tar.age" "$export_archive"
+			install -o "$DOAS_USER" -g "$DOAS_USER" -m 400 "$backup_dir/current.metadata" "$export_metadata"
 			;;
 		drill)
 			[ -s "$backup_dir/current.tar.age" ] && [ -s "$backup_dir/current.metadata" ] || { echo "task-termcade: verified backup missing" >&2; exit 65; }
@@ -1615,7 +1619,7 @@ pb_data_drill" ] || { echo "task-termcade: wrong volume contract" >&2; exit 65;
 			sha256sum "$backup_dir/current.tar.age" | cut -d' ' -f1 > "$backup_dir/offhost.sealed"
 			chown root:root "$backup_dir/current.tar.age" "$backup_dir/current.metadata" "$backup_dir/offhost.sealed"
 			chmod 400 "$backup_dir/current.tar.age" "$backup_dir/offhost.sealed" && chmod 444 "$backup_dir/current.metadata"
-			chown root:root "$backup_dir" && chmod 700 "$backup_dir"
+			rm -f "$export_archive" "$export_metadata"
 			;;
 		reset)
 			[ -s "$backup_dir/offhost.sealed" ] || { echo "task-termcade: off-host backup is not sealed" >&2; exit 65; }