steps:
  - name: Preserve the previous hook
    sudo: true
    shell: cp -p /etc/restic/pre-backup.sh /etc/restic/pre-backup.sh.before-repair-20260910
    creates: /etc/restic/pre-backup.sh.before-repair-20260910
  - name: Install corrected canonical hook
    sudo: true
    upload:
      src: configs/restic/ana-docker/pre-backup.sh
      dest: /etc/restic/pre-backup.sh
      mode: '0700'
  - name: Validate and produce fresh staged database backups
    sudo: true
    shell: bash -n /etc/restic/pre-backup.sh && /etc/restic/pre-backup.sh
verify:
  - name: Verify Gitea and Vaultwarden archive structure
    sudo: true
    shell: |
      set -euo pipefail
      pg_restore --list /var/lib/restic/stage/vaultwarden.pg_dump >/dev/null
      tar -tf /var/lib/restic/stage/gitea-dump.tar | grep -x 'gitea-db.sql'
      ls -lh /var/lib/restic/stage/gitea-dump.tar /var/lib/restic/stage/vaultwarden.pg_dump
      test -z "$(docker exec gitea find /tmp -maxdepth 1 -type d -name 'gitea-backup.*')"