From 451cca3ebdede523128c2ae79e16e5754578af14 Mon Sep 17 00:00:00 2001
From: autonomic-bot <maxf.account@proton.me>
Date: Wed, 27 May 2026 04:50:14 +0100
Subject: [PATCH] =?UTF-8?q?fix:=20set=5Fenv=20newline-safe=20=E2=80=94=20R?=
 =?UTF-8?q?ESTIC=5FREPOSITORY=20was=20glued=20onto=20a=20comment=20line=20?=
 =?UTF-8?q?(backups=20broke)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

backup-bot-two's .env.sample ends with a newline-less comment, so set_env's bare
append concatenated RESTIC_REPOSITORY onto it (commenting it out). The backupbot
container then lacked RESTIC_REPOSITORY and 'abra app backup create' KeyError'd —
breaking the backup stage for recipes without a custom backup hook (cryptpad).
set_env now ensures a trailing newline before appending (applied to drone.nix too,
same latent bug). Re-verify keycloak backup, which earlier passed off an older deploy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 modules/backupbot.nix | 4 ++++
 modules/drone.nix     | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/modules/backupbot.nix b/modules/backupbot.nix
index c59c598..a6f6e31 100644
--- a/modules/backupbot.nix
+++ b/modules/backupbot.nix
@@ -18,6 +18,10 @@ let
 
       set_env() {
         sed -i -E "/^[[:space:]]*#?[[:space:]]*$1=/d" "$ENV_FILE"
+        # Ensure the file ends in a newline before appending — backup-bot-two's .env.sample ends
+        # with a newline-less comment line, so a bare append would glue the var onto that comment
+        # (commenting it out). `$(tail -c1)` is empty iff the last byte is already a newline.
+        if [ -s "$ENV_FILE" ] && [ -n "$(tail -c1 "$ENV_FILE")" ]; then printf '\n' >> "$ENV_FILE"; fi
         printf '%s=%s\n' "$1" "$2" >> "$ENV_FILE"
       }
       set_env RESTIC_REPOSITORY /backups/restic
diff --git a/modules/drone.nix b/modules/drone.nix
index ebe6dff..4e1ed99 100644
--- a/modules/drone.nix
+++ b/modules/drone.nix
@@ -32,6 +32,9 @@ let
 
       set_env() {
         sed -i -E "/^[[:space:]]*#?[[:space:]]*$1=/d" "$ENV_FILE"
+        # ensure trailing newline before append (a recipe .env.sample may end without one, which
+        # would glue the var onto the last line — see modules/backupbot.nix for the bite).
+        if [ -s "$ENV_FILE" ] && [ -n "$(tail -c1 "$ENV_FILE")" ]; then printf '\n' >> "$ENV_FILE"; fi
         printf '%s=%s\n' "$1" "$2" >> "$ENV_FILE"
       }
       set_env LETS_ENCRYPT_ENV ""