fix(deploy): repair backup directory permissions

deploy/deploy.sh

@@ -161,6 +161,15 @@ backup_database() {
   local stamp
   stamp="$(date -u +%Y%m%dT%H%M%SZ)"
   mkdir -p "$BACKUP_DIR"
+  if [ ! -w "$BACKUP_DIR" ]; then
+    echo "Backup directory ${BACKUP_DIR} is not writable; repairing ownership via Docker."
+    docker run --rm -v "$BACKUP_DIR":/backup mariadb:11 \
+      chown "$(id -u):$(id -g)" /backup
+  fi
+  if [ ! -w "$BACKUP_DIR" ]; then
+    echo "Backup directory ${BACKUP_DIR} is still not writable. Aborting deploy."
+    return 1
+  fi
 
   if [ "$provider" = "sqlite" ]; then
     # SQLite lives in the jobtracker_data volume. Tar it from a throwaway container
@@ -219,33 +228,35 @@ backup_database() {
 
   # The password goes via MYSQL_PWD, never on the command line, so it cannot leak
   # into the process list or the deploy log.
-  local dump_status=0
+  local dump_status=0 error_file
+  error_file="$(mktemp "${TMPDIR:-/tmp}/jobtracker-backup.XXXXXX.err")"
   if command -v mariadb-dump >/dev/null 2>&1; then
     MYSQL_PWD="$db_pass" mariadb-dump \
       --host="$db_host" --port="$db_port" --user="$db_user" \
       --single-transaction --routines --events --quick \
-      "$db_name" 2>/tmp/jobtracker-backup.err | gzip -c > "$target" || dump_status=$?
+      "$db_name" 2>"$error_file" | gzip -c > "$target" || dump_status=$?
   elif command -v mysqldump >/dev/null 2>&1; then
     MYSQL_PWD="$db_pass" mysqldump \
       --host="$db_host" --port="$db_port" --user="$db_user" \
       --single-transaction --routines --events --quick \
-      "$db_name" 2>/tmp/jobtracker-backup.err | gzip -c > "$target" || dump_status=$?
+      "$db_name" 2>"$error_file" | gzip -c > "$target" || dump_status=$?
   else
     # No client on the host: run one in a container. --network host so the same
     # host/port from the connection string resolves identically.
     docker run --rm --network host -e MYSQL_PWD="$db_pass" mariadb:11 \
       mariadb-dump --host="$db_host" --port="$db_port" --user="$db_user" \
       --single-transaction --routines --events --quick \
-      "$db_name" 2>/tmp/jobtracker-backup.err | gzip -c > "$target" || dump_status=$?
+      "$db_name" 2>"$error_file" | gzip -c > "$target" || dump_status=$?
   fi
 
   if [ "$dump_status" -ne 0 ]; then
     echo "Database dump FAILED (exit ${dump_status}). Aborting deploy."
-    sed -e 's/password=[^ ]*/password=***/gI' /tmp/jobtracker-backup.err >&2 || true
-    rm -f "$target"
+    sed -e 's/password=[^ ]*/password=***/gI' "$error_file" >&2 || true
+    rm -f "$error_file" "$target"
     return 1
   fi
 
+  rm -f "$error_file"
   verify_sql_backup "$target"
 }