Add check-connection.sh read-only PBS connectivity check

check-connection.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=backup.env
+source "$SCRIPT_DIR/backup.env"
+
+# ==============================================================================
+# CONNECTION CHECK
+# ==============================================================================
+BACKUP_LABEL="${HOSTNAME}-root"
+EXCLUDE_FILE="/opt/backup/exclude"
+
+fail() {
+    echo "check-connection: FAIL: $*" >&2
+    exit 1
+}
+
+echo "PBS target: ${PBS_SERVER}:${PBS_PORT}  datastore=${PBS_DATASTORE}  namespace=${BACKUP_NS:-default}"
+echo
+
+# 1. Preflight — the files backup.sh itself requires
+[ -s "$ENCRYPTION_KEY_FILE" ] || fail "encryption key not found at $ENCRYPTION_KEY_FILE"
+echo "[ok] encryption key present: $ENCRYPTION_KEY_FILE"
+[ -f "$EXCLUDE_FILE" ] || fail "exclude list not found at $EXCLUDE_FILE"
+echo "[ok] exclude list present: $EXCLUDE_FILE"
+echo
+
+# 2. TCP reachability of the PBS server
+if ! timeout 5 bash -c "exec 3<>/dev/tcp/${PBS_SERVER}/${PBS_PORT}" 2>/dev/null; then
+    fail "cannot open TCP connection to ${PBS_SERVER}:${PBS_PORT} (hostname resolution or firewall?)"
+fi
+echo "[ok] TCP connection to ${PBS_SERVER}:${PBS_PORT}"
+echo
+
+# 3. Authenticated round-trip: list existing snapshots for this host
+if ! SNAP_OUT="$(timeout 30 proxmox-backup-client snapshot list "host/${BACKUP_LABEL}" --ns "$BACKUP_NS" 2>&1)"; then
+    echo "$SNAP_OUT" >&2
+    fail "authenticated request failed — check PBS_AUTH_ID / PBS_PASSWORD in backup.env"
+fi
+echo "[ok] authentication + API round-trip to the server"
+if [ -n "$SNAP_OUT" ]; then
+    echo "existing snapshots for ${BACKUP_LABEL}:"
+    echo "$SNAP_OUT"
+else
+    echo "    (none yet for ${BACKUP_LABEL} — the first backup has not run)"
+fi
+
+echo
+echo "All checks passed. The next backup should succeed."