Backup: switch NAS transport to SMB/CIFS, fix crond/OOM/live-tar defects

Wire the backup service against the Synology share over SMB/CIFS (the NAS
authenticates with a user/password; NFS is IP-allowlist only). Also fixes
three defects found bringing the service up live:

- entrypoint crash-loop: dcron's crond fails "setpgid: Operation not
  permitted" in this runtime -> use busybox crond; make repo-init idempotent
  (check via `restic cat config`, tolerate init-on-existing) so a transient
  CIFS/lock hiccup can't kill PID 1.
- OOM: pg_dump of a ~276MB DB + tar + restic exceeded the 256M cap -> 1G.
- live tar abort: GNU tar exits 1 when TDLib files change mid-read (worker is
  live); per design this is best-effort, so tolerate exit 1, fatal only >=2.

Kuma push is now optional (empty URL disables alerting) since it's deferred.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backup/Dockerfile

@@ -1,6 +1,8 @@
 FROM alpine:3.20
 
-RUN apk add --no-cache restic postgresql16-client curl tzdata dcron tar bash
+# Note: use busybox's built-in crond (Alpine base), NOT the dcron package —
+# dcron's crond fails with "setpgid: Operation not permitted" in this runtime.
+RUN apk add --no-cache restic postgresql16-client curl tzdata tar bash
 
 COPY backup/backup.sh /backup.sh
 COPY backup/entrypoint.sh /entrypoint.sh

backup/backup.sh

@@ -2,6 +2,7 @@
 set -euo pipefail
 
 report_failure() {
+  [ -n "${KUMA_PUSH_URL:-}" ] || return 0
   curl -fsS "$KUMA_PUSH_URL" --get \
     --data-urlencode "status=down" \
     --data-urlencode "msg=$BASH_COMMAND failed" || true
@@ -15,11 +16,17 @@ trap 'rm -f "$DUMP_FILE" "$TAR_FILE"' EXIT
 
 pg_dump -h dragonsstash-db -U "$POSTGRES_USER" -d "$POSTGRES_DB" -Fc -f "$DUMP_FILE"
 
-tar czf "$TAR_FILE" -C /data tdlib-worker tdlib-bot
+# TDLib volumes are tarred live (best-effort, per design). A file changing
+# mid-read makes GNU tar exit 1 (warning) — that is expected here and must not
+# abort the backup. Only a genuine error (exit >= 2) is fatal.
+tar --warning=no-file-changed -czf "$TAR_FILE" -C /data tdlib-worker tdlib-bot \
+  || { rc=$?; [ "$rc" -le 1 ] || exit "$rc"; }
 
 restic backup "$DUMP_FILE" "$TAR_FILE"
 restic forget --keep-daily 14 --prune
 
-curl -fsS "$KUMA_PUSH_URL" --get \
-  --data-urlencode "status=up" \
-  --data-urlencode "msg=OK"
+if [ -n "${KUMA_PUSH_URL:-}" ]; then
+  curl -fsS "$KUMA_PUSH_URL" --get \
+    --data-urlencode "status=up" \
+    --data-urlencode "msg=OK"
+fi

backup/entrypoint.sh

@@ -1,8 +1,11 @@
 #!/bin/bash
-set -euo pipefail
+set -uo pipefail
 
-if ! restic snapshots >/dev/null 2>&1; then
-  restic init
+# Ensure the repo exists, but never crash-loop on it: a transient error reading
+# the repo (CIFS hiccup, stale lock) must not kill PID 1. `restic init` failing
+# because the repo already exists is expected and harmless here.
+if ! restic cat config >/dev/null 2>&1; then
+  restic init || echo "restic init skipped (repo already exists or temporarily unreachable)"
 fi
 
 exec crond -f -l 2