From 5b3bfed144e10a74c222b693095b55d77ee07816 Mon Sep 17 00:00:00 2001
From: Luca <102960244+Luca-Timo@users.noreply.github.com>
Date: Fri, 29 May 2026 18:05:40 +0200
Subject: [PATCH] revert(docker): drop /backup chown from wait-for-db.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The fix shipped in 3ab3756 added /backup to the boot-time chown list.
That broke installs that don't bind-mount ./backup:/backup — the
single greedy `chown -R /a /b /c /backup` returned non-zero on any
individual failure, exiting the script and putting the backend into
a restart loop.

Reverting to the upstream-stable version. The original EACCES at
backup time is better fixed by admins pointing the backup destination
at a writable path via the admin UI (e.g. /app/storage/backups,
which the script already chowns) rather than baking a /backup
assumption into every install's boot path.
---
 backend/wait-for-db.sh | 21 +++------------------
 1 file changed, 3 insertions(+), 18 deletions(-)

diff --git a/backend/wait-for-db.sh b/backend/wait-for-db.sh
index 3c993855..6471326f 100755
--- a/backend/wait-for-db.sh
+++ b/backend/wait-for-db.sh
@@ -11,15 +11,8 @@ set -e
 # other than root skip this branch — they own permissions themselves and hit
 # the preflight check below instead.
 if [ "$(id -u)" = "0" ]; then
-  # /backup is the docker-compose `./backup:/backup` mount used by the
-  # CRM + database backup writers. It's only chowned when it actually
-  # exists as a bind mount — installs that don't mount it (e.g. native
-  # / k8s deployments using a different backup destination) skip
-  # cleanly via the `[ -d /backup ]` guard.
-  _chown_dirs="/app/storage /app/data /app/logs"
-  [ -d /backup ] && _chown_dirs="$_chown_dirs /backup"
-  if ! chown -R nodejs:nodejs $_chown_dirs 2>/dev/null; then
-    echo "ERROR: failed to chown $_chown_dirs to nodejs (UID 1001)." >&2
+  if ! chown -R nodejs:nodejs /app/storage /app/data /app/logs 2>/dev/null; then
+    echo "ERROR: failed to chown /app/storage, /app/data, /app/logs to nodejs (UID 1001)." >&2
     echo "  This usually means the host filesystem rejects chown (e.g. NFS without root squash" >&2
     echo "  disabled, or a SELinux/AppArmor policy blocking the operation)." >&2
     echo "  Workaround: pre-chown the host directories to 1001:1001 and pin 'user: \"1001:1001\"'" >&2
@@ -36,15 +29,7 @@ fi
 # followed by a confusing migration error and a restart loop.
 _uid="$(id -u)"
 _gid="$(id -g)"
-# /backup is included here for symmetry with the root branch above:
-# when the compose `user:` override is set, the host operator is
-# expected to have chowned the bind mount themselves. Skip the
-# check when the mount isn't present so non-bind-mounted setups
-# (e.g. backup destination configured to local storage path) still
-# boot cleanly.
-_writable_dirs="/app/storage /app/data /app/logs"
-[ -d /backup ] && _writable_dirs="$_writable_dirs /backup"
-for _dir in $_writable_dirs; do
+for _dir in /app/storage /app/data /app/logs; do
   if [ ! -w "$_dir" ]; then
     echo "ERROR: $_dir is not writable by UID $_uid." >&2
     echo "  Either drop the 'user:' override from your compose file so the container starts as" >&2