Add failure logging/email notification in backup.sh; harden /opt/backup perms

backup.sh

@@ -10,6 +10,7 @@ source "$SCRIPT_DIR/backup.env"
 # ==============================================================================
 BACKUP_LABEL="${HOSTNAME}-root"
 EXCLUDE_FILE="/opt/backup/exclude"
+LOG_FILE="${SCRIPT_DIR}/backup.log"
 
 # ==============================================================================
 # EXECUTION
@@ -27,9 +28,24 @@ while IFS= read -r line; do
     EXCLUDE_ARGS+=(--exclude "$line")
 done < "$EXCLUDE_FILE"
 
-proxmox-backup-client backup "${BACKUP_LABEL}.pxar:/" \
+if proxmox-backup-client backup "${BACKUP_LABEL}.pxar:/" \
     --keyfile "$ENCRYPTION_KEY_FILE" \
     --ns "$BACKUP_NS" \
-    "${EXCLUDE_ARGS[@]}"
-
-echo "Backup completed successfully!"
+    "${EXCLUDE_ARGS[@]}" 2>&1 | tee "$LOG_FILE"; then
+    echo "Backup completed successfully!"
+else
+    echo "Backup FAILED — see $LOG_FILE" >&2
+    if [ -n "${NOTIFY_EMAIL:-}" ]; then
+        {
+            echo "To: $NOTIFY_EMAIL"
+            echo "From: root@${HOSTNAME}"
+            echo "Subject: [pbs-backup] FAILED on ${HOSTNAME}"
+            echo
+            echo "The Proxmox backup on ${HOSTNAME} failed at $(date -R)."
+            echo
+            echo "--- backup log ---"
+            cat "$LOG_FILE"
+        } | sendmail -t
+    fi
+    exit 1
+fi