From c053f285b843c0683c4d3949ef55c495a0bbc011 Mon Sep 17 00:00:00 2001
From: ginnoir <ginnoir@users.noreply.github.com>
Date: Wed, 10 Jun 2026 22:01:26 -0500
Subject: [PATCH] Fix backup cron scripts for Kopia password and MariaDB dumps.

Pass KOPIA_REPOSITORY_PASSWORD into snapshot create; use MARIADB_ROOT_PASSWORD for romm and bookstack app user for bookstack root mismatch.
---
 stacks/backup/scripts/backup-dump-databases.sh | 15 +++++++++++----
 stacks/backup/scripts/backup-run-snapshots.sh  |  8 +++++++-
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/stacks/backup/scripts/backup-dump-databases.sh b/stacks/backup/scripts/backup-dump-databases.sh
index 98c4282..74d2e87 100644
--- a/stacks/backup/scripts/backup-dump-databases.sh
+++ b/stacks/backup/scripts/backup-dump-databases.sh
@@ -22,16 +22,23 @@ dump_postgres() {
   docker exec "${name}" pg_dump -U "${user}" "${db}" | gzip -c > "${DIR}/${name}.sql.gz"
 }
 
+# user: root (default) or app account (e.g. bookstack — root password may not match env)
 dump_mariadb() {
   name="$1"
   db="$2"
+  user="${3:-root}"
   if ! docker ps --format '{{.Names}}' | grep -qx "${name}"; then
     log "skip ${name} (not running)"
     return 0
   fi
-  log "dump ${name} → ${db}"
-  docker exec "${name}" sh -c "mariadb-dump -u root -p\"\$MYSQL_ROOT_PASSWORD\" \"${db}\"" \
-    | gzip -c > "${DIR}/${name}.sql.gz"
+  log "dump ${name} → ${db} (as ${user})"
+  if [ "${user}" = "root" ]; then
+    docker exec "${name}" sh -c "mariadb-dump -u root -p\"\${MARIADB_ROOT_PASSWORD:-\$MYSQL_ROOT_PASSWORD}\" \"${db}\"" \
+      | gzip -c > "${DIR}/${name}.sql.gz"
+  else
+    docker exec "${name}" sh -c "mariadb-dump -u \"${user}\" -p\"\${MYSQL_PASSWORD:-\$MARIADB_PASSWORD}\" \"${db}\"" \
+      | gzip -c > "${DIR}/${name}.sql.gz"
+  fi
 }
 
 log "starting database dumps → ${DIR}"
@@ -42,7 +49,7 @@ dump_postgres postgres_authentik authentik authentik
 dump_postgres postgres_famapp famapp famapp
 dump_postgres postgres_resume postgres postgres
 
-dump_mariadb mariadb_bookstack bookstack
+dump_mariadb mariadb_bookstack bookstack bookstack
 dump_mariadb owncloud_mariadb owncloud
 dump_mariadb romm-db romm
 
diff --git a/stacks/backup/scripts/backup-run-snapshots.sh b/stacks/backup/scripts/backup-run-snapshots.sh
index 33c9d73..c3e9a57 100644
--- a/stacks/backup/scripts/backup-run-snapshots.sh
+++ b/stacks/backup/scripts/backup-run-snapshots.sh
@@ -5,6 +5,7 @@ set -eu
 
 NTFY_URL="${NTFY_URL:-https://ntfy.ginnoir.com/backup}"
 NTFY_TITLE="${NTFY_TITLE:-ValhallaBackup}"
+KOPIA_PASSWORD="${KOPIA_REPOSITORY_PASSWORD:-${KOPIA_PASSWORD:-}}"
 
 notify() {
   priority="$1"
@@ -12,6 +13,11 @@ notify() {
   curl -sf -H "Title: ${NTFY_TITLE}" -H "Priority: ${priority}" -d "${message}" "${NTFY_URL}" >/dev/null 2>&1 || true
 }
 
+if [ -z "${KOPIA_PASSWORD}" ]; then
+  notify high "KOPIA_REPOSITORY_PASSWORD not set — snapshots skipped"
+  exit 1
+fi
+
 if ! docker ps --format '{{.Names}}' | grep -qx kopia; then
   notify high "Kopia container not running — snapshots skipped"
   exit 1
@@ -20,7 +26,7 @@ fi
 FAILED=0
 while IFS= read -r path || [ -n "${path}" ]; do
   case "${path}" in ''|\#*) continue ;; esac
-  if ! docker exec kopia kopia snapshot create "${path}"; then
+  if ! docker exec -e KOPIA_PASSWORD="${KOPIA_PASSWORD}" kopia kopia snapshot create "${path}"; then
     FAILED=1
   fi
 done < /snapshot-paths.txt