rclone-backup: snapshot live SQLite DBs instead of copying them raw

Copying gitea.db / filebrowser database.db / MusicLibrary.db while they
are being written fails md5 verification every run (the file changes mid
-transfer). Take a consistent sqlite .backup into /data/db-snapshots and
exclude the live DB files from the sync, so the job completes cleanly and
the backup holds restorable DB copies.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/fileserver.nix

@@ -302,7 +302,25 @@
     description = "Backup /data to Google Drive via rclone";
     serviceConfig = {
       Type = "oneshot";
-      ExecStart = ''
+      ExecStart = pkgs.writeShellScript "rclone-backup" ''
+        set -uo pipefail
+
+        # Laufende SQLite-DBs lassen sich nicht als Datei kopieren — sie ändern
+        # sich während des Transfers (md5-Fehler). Daher vorab ein konsistentes
+        # Hot-Backup (.backup) in einen Snapshot-Ordner ziehen, der mitgesichert
+        # wird; die Live-Dateien selbst schließen wir unten aus.
+        SNAP=/data/db-snapshots
+        mkdir -p "$SNAP"
+        for db in \
+          /data/gitea/gitea/gitea.db \
+          /data/filebrowser/database.db \
+          /data/daten/DJing/Data/MusicLibrary.db; do
+          [ -f "$db" ] || continue
+          out="$SNAP/$(echo "$db" | sed 's#^/data/##; s#/#_#g')"
+          ${pkgs.sqlite}/bin/sqlite3 "$db" ".timeout 15000" ".backup '$out'" \
+            || echo "WARN: snapshot of $db failed" >&2
+        done
+
         ${pkgs.rclone}/bin/rclone sync /data gdrive:backup-daten \
           --fast-list \
           --drive-stop-on-upload-limit \
@@ -312,6 +330,9 @@
           --exclude "**/*.db-journal" \
           --exclude "**/*.db-wal" \
           --exclude "**/*.db-shm" \
+          --exclude "gitea/gitea/gitea.db" \
+          --exclude "filebrowser/database.db" \
+          --exclude "daten/DJing/Data/MusicLibrary.db" \
           --log-file=/var/log/rclone-backup.log \
           --log-level=INFO
       '';