From 7d73542645e7e7c54a2a3c6673e19ed5722a5450 Mon Sep 17 00:00:00 2001 From: Scooby Husky Date: Mon, 17 Aug 2026 21:05:38 -0500 Subject: [PATCH] Fix nextcloud-pvc-sync: add fsGroup for data access, fix restic cache dir Now that the endpoint/credentials are fixed and this job can actually reach the VPS, it surfaced two more real bugs: no fsGroup (couldn't read the PVC data at all - nextcloud's real Deployment uses fsGroup 33/www-data, this job never matched it) and no writable cache dir for runAsUser 65534 (restic defaults to $HOME/.cache). Co-Authored-By: Claude Sonnet 5 --- apps/nextcloud/manifests/pvc-sync-cronjob.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/apps/nextcloud/manifests/pvc-sync-cronjob.yaml b/apps/nextcloud/manifests/pvc-sync-cronjob.yaml index e93d302..83d873c 100644 --- a/apps/nextcloud/manifests/pvc-sync-cronjob.yaml +++ b/apps/nextcloud/manifests/pvc-sync-cronjob.yaml @@ -63,6 +63,11 @@ spec: securityContext: runAsNonRoot: true runAsUser: 65534 + # Matches the real nextcloud Deployment's fsGroup (33/www-data) - + # without it this job can't read the PVC data at all (confirmed + # live 2026-08-18: "permission denied" on every file/dir under + # /data once it could actually reach the VPS to back up to). + fsGroup: 33 seccompProfile: type: RuntimeDefault affinity: @@ -88,6 +93,10 @@ spec: export RESTIC_PASSWORD_FILE=/restic-secret/password export AWS_ACCESS_KEY_ID="${MINIO_ACCESS_KEY}" export AWS_SECRET_ACCESS_KEY="${MINIO_SECRET_KEY}" + # Default cache dir is $HOME/.cache - runAsUser 65534 has + # no writable HOME, restic errors with "mkdir /.cache: + # permission denied" otherwise. + export RESTIC_CACHE_DIR=/tmp/restic-cache restic snapshots >/dev/null 2>&1 || restic init