Feat/backup script update

[mertilginoglu]

Updates for backup script

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (807e750)	9843	4033	40.97%
Head commit (2bfd854)	9843 (+0)	4033 (+0)	40.97% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#967)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{TIP This summary will be updated as you push new changes. Give us feedback}

[github-actions]

Thanks for contributing to Helios 🌞

Please use PR titles according to Conventional Commits specification and it looks like your proposed title needs to be adjusted.

Details

[chatgpt-codex-connector]

💡 Codex Review

Helios/ops/backup/README.md

Line 73 in 7309e67

gunzip -c /opt/backups/helios/2026-04-10_021500/app.sql.gz | psql -U postgres -d helios_app

Restore app dump into the configured database name

The manual restore example hardcodes -d helios_app, but the backup script writes app.sql.gz from POSTGRES_DB; when those differ (including the repository default in .env.example, which is helios), operators will restore into the wrong/nonexistent database and the application data will not actually be recovered.

---

Helios/ops/backup/README.md

Line 28 in 7309e67

install -m 0755 ops/backup/helios-restore.sh /usr/local/bin/helios-restore.sh

Stop documenting a restore script that is not present

The install and restore usage sections instruct users to copy and run ops/backup/helios-restore.sh, but this commit does not add that script in the repository, so the documented workflow fails immediately and gives a false impression that an automated restore path exists.

---

Helios/ops/backup/helios-backup.sh

Lines 181 to 184 in 7309e67

	mkdir -p "$BACKUP_BASE"
	STAMP="$(date +%F_%H%M%S)"
	TARGET="$BACKUP_BASE/$STAMP"
	mkdir -p "$TARGET"

Restrict permissions on backup output

This script writes sensitive artifacts (.env, private keys, and SQL dumps) into $TARGET, but it relies on the process umask when creating backup directories/files; with common defaults (e.g., 022), those artifacts become readable by other local users on shared hosts. Set a restrictive umask (such as 077) or apply explicit chmod before writing backups.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".