From 2bcca87f0c33b3b085831e369fcfacc6fa3c2d53 Mon Sep 17 00:00:00 2001
From: Dimo-2562 <chosehoon2@naver.com>
Date: Mon, 1 Jun 2026 17:14:34 +0900
Subject: [PATCH] =?UTF-8?q?debug:=20root=20=EA=B6=8C=ED=95=9C=20=EB=AC=B8?=
 =?UTF-8?q?=EC=A0=9C=20=ED=95=B4=EA=B2=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/cockple-db-backup.service |  2 ++
 scripts/install_backup_systemd.sh | 16 ++++++++++++++--
 scripts/run_db_backup.sh          |  1 +
 3 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/scripts/cockple-db-backup.service b/scripts/cockple-db-backup.service
index 6df2da36..0cb3a011 100644
--- a/scripts/cockple-db-backup.service
+++ b/scripts/cockple-db-backup.service
@@ -6,4 +6,6 @@ Requires=docker.service
 
 [Service]
 Type=oneshot
+User=root
+Group=root
 ExecStart=/bin/bash /opt/cockple/backup/run_db_backup.sh
diff --git a/scripts/install_backup_systemd.sh b/scripts/install_backup_systemd.sh
index 4869f776..567ce0f4 100644
--- a/scripts/install_backup_systemd.sh
+++ b/scripts/install_backup_systemd.sh
@@ -55,6 +55,16 @@ install_systemd_units() {
   "${SUDO[@]}" systemctl enable --now cockple-db-backup.timer
 }
 
+run_backup_smoke_test() {
+  if "${SUDO[@]}" systemctl start cockple-db-backup.service; then
+    return
+  fi
+
+  "${SUDO[@]}" systemctl status --no-pager cockple-db-backup.service || true
+  "${SUDO[@]}" journalctl -u cockple-db-backup.service -n 80 --no-pager || true
+  exit 1
+}
+
 cleanup_legacy_cron() {
   if [[ -f "${LEGACY_CRON_FILE}" ]]; then
     "${SUDO[@]}" rm -f "${LEGACY_CRON_FILE}"
@@ -62,7 +72,8 @@ cleanup_legacy_cron() {
 }
 
 stage_backup_runtime() {
-  "${SUDO[@]}" install -m 0755 -d "${BACKUP_ROOT}" "$(dirname "${BACKUP_ENV_FILE}")" "${BACKUP_STATE_DIR}"
+  "${SUDO[@]}" install -m 0755 -d "${BACKUP_ROOT}" "$(dirname "${BACKUP_ENV_FILE}")" "$(dirname "${BACKUP_STATE_DIR}")"
+  "${SUDO[@]}" install -m 0700 -d "${BACKUP_STATE_DIR}"
   "${SUDO[@]}" install -m 0755 "${SOURCE_DIR}/backup_db.sh" "${BACKUP_ROOT}/backup_db.sh"
   "${SUDO[@]}" install -m 0755 "${SOURCE_DIR}/run_db_backup.sh" "${BACKUP_ROOT}/run_db_backup.sh"
   "${SUDO[@]}" install -m 0644 "${SOURCE_DIR}/cockple-db-backup.service" "${BACKUP_ROOT}/cockple-db-backup.service"
@@ -71,6 +82,7 @@ stage_backup_runtime() {
 
 write_backup_env() {
   if [[ -n "${GCS_BACKUP_BUCKET:-}" ]]; then
+    "${SUDO[@]}" install -m 0644 /dev/null "${BACKUP_ENV_FILE}"
     cat <<EOF | "${SUDO[@]}" tee "${BACKUP_ENV_FILE}" >/dev/null
 GCS_BACKUP_BUCKET=${GCS_BACKUP_BUCKET}
 BACKUP_DATABASE=cockple
@@ -105,7 +117,7 @@ require_file "${TIMER_SOURCE}"
 install_systemd_units
 
 if [[ "${RUN_BACKUP_SMOKE_TEST:-false}" == "true" ]]; then
-  "/bin/bash" "${BACKUP_ROOT}/run_db_backup.sh"
+  run_backup_smoke_test
 fi
 
 echo "Backup systemd timer installed."
diff --git a/scripts/run_db_backup.sh b/scripts/run_db_backup.sh
index 17ba3dab..8a722ecc 100644
--- a/scripts/run_db_backup.sh
+++ b/scripts/run_db_backup.sh
@@ -20,6 +20,7 @@ BACKUP_DATABASE="${BACKUP_DATABASE:-cockple}"
 GCS_OBJECT_PREFIX="${GCS_OBJECT_PREFIX:-prod}"
 LOCAL_RETENTION_DAYS="${LOCAL_RETENTION_DAYS:-2}"
 
+umask 077
 mkdir -p "${BACKUP_DIR}"
 
 exec 9>"${LOCK_FILE}"