brushing up backups

ansible/roles/backup_source/tasks/main.yml

@@ -16,12 +16,22 @@
 
 # Declared here rather than assumed. Stage 1 installed it by hand; this is what
 # makes a rebuilt host get it too.
+# Cache refresh is best-effort on purpose. An unrelated third-party repo with a
+# bad signing key (spacey had two: an expired Caddy subkey and a SHA1 nodesource
+# key) makes `apt-get update` return warnings, which the apt module treats as a
+# hard failure — and that must not stop backups being configured. Installing the
+# package is NOT best-effort: if age is genuinely unavailable, the next task fails.
+- name: Refresh the apt cache (best effort)
+  ansible.builtin.apt:
+    update_cache: yes
+    cache_valid_time: 3600
+  failed_when: false
+  changed_when: false
+
 - name: Ensure age is installed
   ansible.builtin.apt:
     name: age
     state: present
-    update_cache: yes
-    cache_valid_time: 3600
 
 # The pull account: unprivileged, no sudo, exists only so small-backups-box can
 # read the dump directory. Trust points one way — the box can read backups, and

ansible/roles/backup_source/templates/backup.sh.j2

@@ -53,6 +53,12 @@ trap 'log "Restarting ${SERVICE}..."; eval "$START_CMD" || true' EXIT
 # --- Dump straight into age; plaintext never touches the disk ---
 log "Writing ${ARTIFACT}..."
 {{ backup_source_dump_command }} | age -r "$RECIPIENT" -o "${ARTIFACT}.partial"
+{% if backup_source_pull_user %}
+# Match the final ownership immediately, so even a partial left by a later
+# failure is not an unreadable obstacle to the pull.
+chown root:{{ backup_source_pull_user }} "${ARTIFACT}.partial"
+chmod 640 "${ARTIFACT}.partial"
+{% endif %}
 mv "${ARTIFACT}.partial" "$ARTIFACT"
 {% if backup_source_pull_user %}
 # Readable by the pull account and nobody else. The contents are age-encrypted