Fix bugs from BUGHUNT.md: restore race conditions, infra backup, DR wiring, docker-setup.sh, restore.html

controller/internal/report/infra_backup.go

@@ -2,6 +2,8 @@ package report
 
 import (
 	"encoding/base64"
+	"fmt"
+	"log"
 	"os"
 	"time"
 
@@ -43,6 +45,7 @@ func BuildInfraBackup(
 	systemDataPath string,
 	sett *settings.Settings,
 	stackProvider backup.StackDataProvider,
+	logger *log.Logger,
 ) (*InfraBackup, error) {
 	ib := &InfraBackup{
 		CustomerID:        customerID,
@@ -51,22 +54,29 @@ func BuildInfraBackup(
 		Timestamp:         time.Now().UTC().Format(time.RFC3339),
 	}
 
-	// Read and encode controller.yaml
-	if data, err := os.ReadFile(controllerYAMLPath); err == nil {
-		ib.ControllerConfigB64 = base64.StdEncoding.EncodeToString(data)
+	// Read and encode controller.yaml (critical — fail if unreadable)
+	data, err := os.ReadFile(controllerYAMLPath)
+	if err != nil {
+		return nil, fmt.Errorf("reading controller config %s: %w", controllerYAMLPath, err)
 	}
+	ib.ControllerConfigB64 = base64.StdEncoding.EncodeToString(data)
 
-	// Read and encode settings.json
+	// Read and encode settings.json (important but non-fatal)
 	if data, err := os.ReadFile(settingsPath); err == nil {
 		ib.SettingsJSONB64 = base64.StdEncoding.EncodeToString(data)
+	} else if !os.IsNotExist(err) {
+		logger.Printf("[WARN] Infra backup: could not read settings.json: %v", err)
 	}
 
-	// Read primary restic password
+	// Read primary restic password (important but non-fatal)
 	if data, err := os.ReadFile(resticPasswordFile); err == nil {
 		ib.ResticPassword = base64.StdEncoding.EncodeToString(data)
+	} else if !os.IsNotExist(err) {
+		logger.Printf("[WARN] Infra backup: could not read restic password file: %v", err)
 	}
 
-	// Read cross-drive restic password
+	// Cross-drive password is stored as plain text (not base64) because it's
+	// already a string in settings, unlike ResticPassword which comes from a file.
 	if pw := sett.GetCrossDriveResticPassword(); pw != "" {
 		ib.CrossDrivePassword = pw
 	}