Harden backup integrity, implement verified restore and safe upgrades

systemd/app-backup.service

@@ -1,19 +1,24 @@
 [Unit]
-Description=Resilient daily app backup (WP/Nextcloud/Mail) to OneDrive via rclone + mail report
+Description=Verified application backup to rclone crypt storage
 Wants=network-online.target
 After=network-online.target
 
 [Service]
 Type=oneshot
 ExecStart=/usr/local/sbin/app-backup.sh
-TimeoutStartSec=6h
-
+# Timeout sends TERM: Bash runs its recovery trap; grace time permits service restart.
+TimeoutStartSec=12h
+TimeoutStopSec=5min
+KillMode=mixed
+UMask=0077
 Nice=10
 IOSchedulingClass=best-effort
 IOSchedulingPriority=6
-
+PrivateTmp=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
 Environment=LANG=C
 Environment=LC_ALL=C
-
-[Install]
-WantedBy=multi-user.target
+StandardOutput=journal
+StandardError=journal