Add .env bundle to daily Nextcloud backup

Collects .env files from all app LXCs via SSH and uploads a single
env_bundle_TIMESTAMP.tar.gz to HNF-Backups/configs/ on Nextcloud.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backup/backup.sh

@@ -85,7 +85,7 @@ NC_DAV="${NC_BASE_URL%/}/remote.php/dav/files/${NC_USER}/${NC_PATH}"
 log "Target: ${NC_BASE_URL} → /${NC_PATH}"
 
 # Ensure Nextcloud directory tree exists (MKCOL silently ignores 405 = already exists)
-for dir in "" "/postgres" "/postgres/daily" "/postgres/weekly" "/volumes"; do
+for dir in "" "/postgres" "/postgres/daily" "/postgres/weekly" "/volumes" "/configs"; do
   curl -sf -X MKCOL -u "${NC_USER}:${NC_PASS}" \
     "${NC_DAV}${dir}" -o /dev/null 2>/dev/null || true
 done
@@ -212,6 +212,58 @@ if [ -d /kuma_data ] && [ "$(ls -A /kuma_data 2>/dev/null)" ]; then
   rm -f "$tmp"
 fi
 
+# ── Config (.env) backups ─────────────────────────────────────────────────────
+log "Config (.env) backups..."
+TMP_ENV_DIR=$(mktemp -d /tmp/envs.XXXXXX)
+ENV_COLLECTED=0
+
+collect_env() {
+  local host="$1" app="$2"
+  if ssh -i "$SSH_KEY" \
+        -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+        -o ConnectTimeout=5 -o BatchMode=yes \
+        "root@${host}" "cat /opt/${app}/.env" \
+        > "${TMP_ENV_DIR}/${app}.env" 2>/dev/null \
+     && [ -s "${TMP_ENV_DIR}/${app}.env" ]; then
+    log "  ${app} collected"
+    ENV_COLLECTED=$((ENV_COLLECTED + 1))
+  else
+    log "  ${app} skipped (offline or no .env)"
+    rm -f "${TMP_ENV_DIR}/${app}.env"
+  fi
+}
+
+collect_env "10.10.10.101" "auth"
+collect_env "10.10.10.105" "management"
+collect_env "10.10.10.112" "noticeboard"
+collect_env "10.10.10.113" "forecasting"
+collect_env "10.10.10.115" "rates"
+collect_env "10.10.10.116" "settings"
+collect_env "10.10.10.117" "cashup"
+collect_env "10.10.10.118" "hk-planner"
+collect_env "10.10.10.119" "twin-optimiser"
+
+TMP_ENV_BUNDLE=$(mktemp /tmp/envs_bundle.XXXXXX)
+if [ "$ENV_COLLECTED" -gt 0 ] && tar czf "$TMP_ENV_BUNDLE" -C "$TMP_ENV_DIR" . 2>/dev/null && [ -s "$TMP_ENV_BUNDLE" ]; then
+  TARGET="${NC_DAV}/configs/env_bundle_${TIMESTAMP}.tar.gz"
+  HTTP=$(curl -sf -T "$TMP_ENV_BUNDLE" -u "${NC_USER}:${NC_PASS}" \
+         -o /dev/null -w "%{http_code}" "$TARGET" 2>/dev/null || echo "000")
+  SIZE=$(wc -c < "$TMP_ENV_BUNDLE" 2>/dev/null || echo 0)
+  if echo "$HTTP" | grep -qE '^2'; then
+    log "  env bundle OK (${ENV_COLLECTED} files, ${SIZE} bytes)"
+    add_item "config" "env-bundle" "ok" "$SIZE"
+  else
+    err "  env bundle upload failed (HTTP ${HTTP})"
+    add_item "config" "env-bundle" "error" "0" "Upload failed (HTTP ${HTTP})"
+    ERRORS=$((ERRORS + 1))
+  fi
+else
+  err "  env bundle: nothing collected"
+  add_item "config" "env-bundle" "error" "0" "No .env files collected"
+  ERRORS=$((ERRORS + 1))
+fi
+rm -rf "$TMP_ENV_DIR" "$TMP_ENV_BUNDLE"
+
 # ── Finalise ──────────────────────────────────────────────────────────────────
 STATUS="success"
 [ "$ERRORS" -gt 0 ] && STATUS="partial"