From 8e2a70d8862fe7f1d12be97316748b6d0ecac1d8 Mon Sep 17 00:00:00 2001
From: "v.karaychentsev" <105486287+vk-aterise@users.noreply.github.com>
Date: Fri, 20 Feb 2026 19:35:20 +0300
Subject: [PATCH] backrest: bypass file permissions while making backups

---
 hosts/home-morefine/systemd/backrest/backrest.service | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hosts/home-morefine/systemd/backrest/backrest.service b/hosts/home-morefine/systemd/backrest/backrest.service
index 71d989c..60348e0 100644
--- a/hosts/home-morefine/systemd/backrest/backrest.service
+++ b/hosts/home-morefine/systemd/backrest/backrest.service
@@ -9,6 +9,8 @@ ExecStart=/usr/local/bin/backrest
 WorkingDirectory=/home/backups/backrest
 # wrap with caddy reverse proxy
 Environment="BACKREST_PORT=172.17.0.1:9898"
+AmbientCapabilities=CAP_DAC_READ_SEARCH
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH
 
 [Install]
 WantedBy=multi-user.target