brushing up backups

ansible/roles/backup_store/templates/pull-backups.sh.j2

@@ -22,7 +22,12 @@ pull_{{ src.name | replace('-', '_') }}() {
   local dir="${STORE}/{{ src.name }}"
   mkdir -p "$dir"
   log "Pulling {{ src.name }} from {{ src.source }}..."
-  if rsync -az --timeout=120 \
+  # --exclude '*.partial': a dump that died mid-write leaves one behind, owned
+  # root:root 0600 because the chown only happens after a successful mv. Without
+  # this exclude the pull account cannot read it and rsync fails for the WHOLE
+  # source — so one failed dump would silently block every subsequent pull of
+  # that service. An incomplete artefact is never worth transferring anyway.
+  if rsync -az --timeout=120 --exclude '*.partial' \
        -e "ssh -i $SSH_KEY -o StrictHostKeyChecking=accept-new -o ConnectTimeout=15" \
        "{{ src.source }}" "$dir/"; then
     log "  {{ src.name }}: ok ($(find "$dir" -maxdepth 1 -type f | wc -l) artefacts, $(du -sh "$dir" | cut -f1))"