consolidate samba passdb into system/ + add selinux step to runbook

scripts/backup.sh

@@ -40,17 +40,14 @@ for db in jellyfin library; do
         || FAILURES+=("jellyfin ${db} sqlite backup")
 done
 
-# Single rsync covers everything: configs, app data, media, DB dumps
+# Single rsync covers everything: configs, app data, media, DB dumps,
+# and the samba passdb (mirrored into /opt/argento/system/samba-private/
+# by sync-system.sh, gitignored)
 RSYNC_OPTS="-a --delete"
 [ -t 1 ] && RSYNC_OPTS="$RSYNC_OPTS --info=progress2"
 rsync $RSYNC_OPTS /opt/argento/ /mnt/backup/argento/ \
     || FAILURES+=("rsync argento")
 
-# Back up samba passdb (binary — holds SMB password hashes, not in /opt/argento)
-mkdir -p /mnt/backup/samba-private
-rsync -a --delete /var/lib/samba/private/ /mnt/backup/samba-private/ \
-    || FAILURES+=("rsync samba passdb")
-
 if [ ${#FAILURES[@]} -gt 0 ]; then
     echo "BACKUP FAILED: ${FAILURES[*]}" >&2
     exit 1

scripts/restore-users.sh

@@ -117,18 +117,19 @@ done
 
 echo ""
 echo "=== samba passdb ==="
+PASSDB_SRC=/mnt/backup/argento/system/samba-private
 if ! mountpoint -q /mnt/backup; then
     echo "[!] /mnt/backup is not mounted — skipping samba passdb restore"
     echo "    mount the USB backup drive (RUNBOOK step 5) and re-run if you want"
     echo "    to restore preserved SMB passwords; otherwise set them manually:"
     echo "      for u in timothykim yireh isaac; do smbpasswd -a \"\$u\"; done"
-elif [ -f /mnt/backup/samba-private/passdb.tdb ]; then
+elif [ -f "$PASSDB_SRC/passdb.tdb" ]; then
     install -d -m 700 /var/lib/samba/private
-    cp /mnt/backup/samba-private/*.tdb /var/lib/samba/private/
+    cp "$PASSDB_SRC"/*.tdb /var/lib/samba/private/
     chmod 600 /var/lib/samba/private/*.tdb
-    echo "[+] restored samba passdb from /mnt/backup/samba-private/"
+    echo "[+] restored samba passdb from $PASSDB_SRC/"
 else
-    echo "[!] no samba passdb backup found at /mnt/backup/samba-private/"
+    echo "[!] no samba passdb backup found at $PASSDB_SRC/"
     echo "    run: for u in timothykim yireh isaac; do smbpasswd -a \"\$u\"; done"
 fi
 

scripts/sync-system.sh

@@ -17,6 +17,12 @@ done < "$REPO/system/tracked-configs"
 
 sed -i 's/^password .*/password REDACTED/' "$REPO/system/msmtprc"
 
+# Mirror samba's binary passdb files into the repo so backup.sh's standard
+# rsync of /opt/argento/ picks them up. Gitignored — credential hashes don't
+# belong in version control, but they DO need to ride along on the USB backup.
+install -d -m 700 "$REPO/system/samba-private"
+rsync -a --delete /var/lib/samba/private/ "$REPO/system/samba-private/"
+
 # Sync root crontab
 crontab -l > "$REPO/system/root-crontab" 2>/dev/null || true