From def419a7cdd3b87b163883a8b40a1d5e8bc28a36 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernhard=20Rosenkr=C3=A4nzer?= <bero@federated.computer>
Date: Sat, 22 Feb 2025 20:08:59 +0000
Subject: [PATCH] Don't use a lot of space on / if /federated is external
 storage

---
 bin/backuptool | 80 +++++++++++++++++++++++++-------------------------
 1 file changed, 40 insertions(+), 40 deletions(-)

diff --git a/bin/backuptool b/bin/backuptool
index 175f911..efc4ba6 100755
--- a/bin/backuptool
+++ b/bin/backuptool
@@ -38,19 +38,19 @@ createbucket() {
 listbackup_system() {
     echo "* Listing backup system files for /federated/{bin,certs,lib,logs}.."
     echo "* Listing backup system files for /federated/bin.."
-    PASSPHRASE=$GPG_PASSPHRASE duplicity list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/bin/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/bin/
     [ $? -ne 0 ] && failcheck "* Couldn't list backup files"
 
     echo "* Listing backup system files for /federated/certs.."
-    PASSPHRASE=$GPG_PASSPHRASE duplicity list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/certs/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/certs/
     [ $? -ne 0 ] && failcheck "* Couldn't list backup files"
 
     echo "* Listing backup system files for /federated/lib.."
-    PASSPHRASE=$GPG_PASSPHRASE duplicity list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/lib/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/lib/
     [ $? -ne 0 ] && failcheck "* Couldn't list backup files"
 
     echo "* Listing backup system files for /federated/logs.."
-    PASSPHRASE=$GPG_PASSPHRASE duplicity list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/logs/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/logs/
     [ $? -ne 0 ] && failcheck "* Couldn't list backup files"
 }
 listbackup_allservices() {
@@ -58,13 +58,13 @@ listbackup_allservices() {
     for i in "${SERVICES[@]}"; do
     [ ! -d "/federated/apps/$i" ] && echo "$i not installed, skipping." && continue
       echo "* Listing backup files for /federated/apps/$i.."
-      PASSPHRASE=$GPG_PASSPHRASE duplicity list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't list backup files"
     done
 }
 listbackup_service() {
     echo "* Listing backup files for /federated/apps/$SERVICE.."
-    PASSPHRASE=$GPG_PASSPHRASE duplicity list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't list backup files"
 }
 backup_service() {
@@ -85,7 +85,7 @@ backup_service() {
       fi
     done
     docker exec postgresql /bin/bash -c "pg_dumpall --globals-only -c -U postgres | gzip -9 > /docker-entrypoint-initdb.d/dump_$SERVICE.sql.gz"
-    PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't backup files"
     rm /federated/apps/postgresql/data/docker-entrypoint-initdb.d/dump_*
 
@@ -106,42 +106,42 @@ backup_service() {
 
     # Backup mysql user table
     docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} mysql user | gzip -9 > /federated/apps/pdnsmysql/dump_$SERVICE.sql.gz
-    PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't backup files"
     rm /federated/apps/pdnsmysql/dump_*
   elif [ "$SERVICE" = "pdns" ]; then
     docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} pdns | gzip -9 > /federated/apps/pdns/dump_$SERVICE.sql.gz
-    PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't backup files"
     rm /federated/apps/pdns/dump_$SERVICE.sql.gz
   elif [ "$SERVICE" = "pdnsadmin" ]; then
     docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} pdns | gzip -9 > /federated/apps/pdnsadmin/dump_$SERVICE.sql.gz
-    PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't backup files"
     rm /federated/apps/pdnsadmin/dump_$SERVICE.sql.gz
   elif [ "$SERVICE" = "castopod" ]; then
     docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} castopod | gzip -9 > /federated/apps/castopod/dump_$SERVICE.sql.gz
-    PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't backup files"
     rm /federated/apps/castopod/dump_$SERVICE.sql.gz
   elif [ "$SERVICE" = "wordpress" -o "$SERVICE" = "wordpressshop" ]; then
     docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} ${SERVICE} | gzip -9 > /federated/apps/${SERVICE}/dump_$SERVICE.sql.gz
-    PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't backup files"
     rm /federated/apps/wordpress/dump_$SERVICE.sql.gz
   elif [ "$SERVICE" = "bookstack" ]; then
     docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} bookstack | gzip -9 > /federated/apps/bookstack/dump_$SERVICE.sql.gz
-    PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't backup files"
     rm /federated/apps/bookstack/dump_$SERVICE.sql.gz
   elif [ "$SERVICE" = "espocrm" ]; then
     docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} espocrm | gzip -9 > /federated/apps/espocrm/dump_$SERVICE.sql.gz
-    PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't backup files"
     rm /federated/apps/espocrm/dump_$SERVICE.sql.gz
   elif [ "$SERVICE" = "roundcube" ]; then
     docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} roundcube | gzip -9 > /federated/apps/roundcube/dump_$SERVICE.sql.gz
-    PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't backup files"
     rm /federated/apps/espocrm/dump_$SERVICE.sql.gz
   else
@@ -152,7 +152,7 @@ backup_service() {
       [ $? -ne 0 ] && failcheck "* Couldn't pg_dump files"
       mv /federated/apps/postgresql/data/docker-entrypoint-initdb.d/dump_$SERVICE.sql.gz /federated/apps/$SERVICE/
     fi
-    PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/apps/$SERVICE b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/
     [ $? -ne 0 ] && failcheck "* Couldn't backup files"
     [ -f "/federated/apps/$SERVICE/dump_$SERVICE.sql.gz" ] && rm /federated/apps/$SERVICE/dump_$SERVICE.sql.gz
   fi
@@ -163,19 +163,19 @@ backup_system() {
 
   echo "* Backing up system files in /federated/{bin,certs,lib,logs}.."
   echo "* Backing up system files in /federated/bin.."
-  PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/bin b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/bin/
+  PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/bin b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/bin/
   [ $? -ne 0 ] && failcheck "* Couldn't backup files"
 
   echo "* Backing up system files in /federated/certs.."
-  PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/certs b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/certs/
+  PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/certs b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/certs/
   [ $? -ne 0 ] && failcheck "* Couldn't backup files"
 
   echo "* Backing up system files in /federated/lib.."
-  PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/lib b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/lib/
+  PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/lib b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/lib/
   [ $? -ne 0 ] && failcheck "* Couldn't backup files"
 
   echo "* Backing up system files in /federated/logs.."
-  PASSPHRASE=$GPG_PASSPHRASE duplicity /federated/logs b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/logs/
+  PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp /federated/logs b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/logs/
   [ $? -ne 0 ] && failcheck "* Couldn't backup files"
 }
 backup_allservices() {
@@ -203,7 +203,7 @@ backup_allservices() {
 
       # Dump postgresql global objects only, no databases, then send everything to Backblaze
       docker exec postgresql /bin/bash -c "pg_dumpall --globals-only -c -U postgres | gzip -9 > /docker-entrypoint-initdb.d/dump_$i.sql.gz"
-      PASSPHRASE=$GPG_PASSPHRASE duplicity --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't backup files"
       rm /federated/apps/postgresql/data/docker-entrypoint-initdb.d/dump_*
     elif [ "$i" = "pdnsmysql" ]; then
@@ -222,42 +222,42 @@ backup_allservices() {
 
       # Backup pdnsmysql mysql user table and send to backblaze
       docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} mysql user | gzip -9 > /federated/apps/pdnsmysql/dump_$i.sql.gz
-      PASSPHRASE=$GPG_PASSPHRASE duplicity --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't backup files"
       rm /federated/apps/pdnsmysql/dump_*
     elif [ "$i" = "pdns" ]; then
       docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} pdns | gzip -9 > /federated/apps/pdns/dump_$i.sql.gz
-      PASSPHRASE=$GPG_PASSPHRASE duplicity --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't backup files"
       rm /federated/apps/pdns/dump_$i.sql.gz
     elif [ "$i" = "pdnsadmin" ]; then
       docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} pdns | gzip -9 > /federated/apps/pdnsadmin/dump_$i.sql.gz
-      PASSPHRASE=$GPG_PASSPHRASE duplicity --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't backup files"
       rm /federated/apps/pdnsadmin/dump_$i.sql.gz
     elif [ "$i" = "castopod" ]; then
       docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} castopod | gzip -9 > /federated/apps/castopod/dump_$i.sql.gz
-      PASSPHRASE=$GPG_PASSPHRASE duplicity --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't backup files"
       rm /federated/apps/castopod/dump_$i.sql.gz
     elif [ "$i" = "wordpress" ]; then
       docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} wordpress | gzip -9 > /federated/apps/wordpress/dump_$i.sql.gz
-      PASSPHRASE=$GPG_PASSPHRASE duplicity --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't backup files"
       rm /federated/apps/wordpress/dump_$i.sql.gz
     elif [ "$i" = "bookstack" ]; then
       docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} bookstack | gzip -9 > /federated/apps/bookstack/dump_$i.sql.gz
-      PASSPHRASE=$GPG_PASSPHRASE duplicity --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't backup files"
       rm /federated/apps/bookstack/dump_$i.sql.gz
     elif [ "$i" = "espocrm" ]; then
       docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} espocrm | gzip -9 > /federated/apps/espocrm/dump_$i.sql.gz
-      PASSPHRASE=$GPG_PASSPHRASE duplicity --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't backup files"
       rm /federated/apps/espocrm/dump_$i.sql.gz
     elif [ "$i" = "roundcube" ]; then
       docker exec pdnsmysql mariadb-dump -uroot -p${MYSQL_PASSWORD} roundcube | gzip -9 > /federated/apps/roundcube/dump_$i.sql.gz
-      PASSPHRASE=$GPG_PASSPHRASE duplicity --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't backup files"
       rm /federated/apps/roundcube/dump_$i.sql.gz
     else
@@ -267,7 +267,7 @@ backup_allservices() {
         [ $? -ne 0 ] && failcheck "* Couldn't pg_dump files"
         mv /federated/apps/postgresql/data/docker-entrypoint-initdb.d/dump_$i.sql.gz /federated/apps/$i/
       fi
-      PASSPHRASE=$GPG_PASSPHRASE duplicity --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
+      PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --full-if-older-than 1M /federated/apps/$i b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/
       [ $? -ne 0 ] && failcheck "* Couldn't backup files"
       [ -f "/federated/apps/$i/dump_$i.sql.gz" ] && rm /federated/apps/$i/dump_$i.sql.gz
     fi
@@ -281,7 +281,7 @@ backup_nfsmounts() {
   else
     echo "* NFS mount found: $NFSMOUNT"
     echo "* Backing up NFS.."
-    PASSPHRASE=$GPG_PASSPHRASE duplicity $NFSMOUNT b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/$NFSMOUNT/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp $NFSMOUNT b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/$NFSMOUNT/
     [ $? -ne 0 ] && failcheck "* Couldn't backup NFS mount"
   fi
 }
@@ -293,7 +293,7 @@ listbackup_nfsmounts() {
   else
     echo "* NFS mount found: $NFSMOUNT"
     echo "* Listing NFS.."
-    PASSPHRASE=$GPG_PASSPHRASE duplicity list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/$NFSMOUNT/
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp list-current-files b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/$NFSMOUNT/
     [ $? -ne 0 ] && failcheck "* Couldn't list NFS mount"
   fi
 }
@@ -307,31 +307,31 @@ delete_backup() {
 restorebackup_system() {
   echo "* Restoring system files to /federated.restore/{bin,certs,lib,logs}.."
   echo "* Restoring system files to /federated.restore/bin.."
-  PASSPHRASE=$GPG_PASSPHRASE duplicity --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/bin/ /federated.restore/bin
+  PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/bin/ /federated.restore/bin
   [ $? -ne 0 ] && failcheck "* Couldn't restore files"
 
   echo "* Restoring system files to /federated.restore/certs.."
-  PASSPHRASE=$GPG_PASSPHRASE duplicity --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/certs/ /federated.restore/certs
+  PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/certs/ /federated.restore/certs
   [ $? -ne 0 ] && failcheck "* Couldn't restore files"
 
   echo "* Restoring system files to /federated.restore/lib.."
-  PASSPHRASE=$GPG_PASSPHRASE duplicity --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/lib/ /federated.restore/lib
+  PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/lib/ /federated.restore/lib
   [ $? -ne 0 ] && failcheck "* Couldn't restore files"
 
   echo "* Restoring system files to /federated.restore/logs.."
-  PASSPHRASE=$GPG_PASSPHRASE duplicity --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/lib/ /federated.restore/logs
+  PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/lib/ /federated.restore/logs
   [ $? -ne 0 ] && failcheck "* Couldn't restore files"
 }
 restorebackup_service() {
   echo "* Restoring $SERVICE to /federated.restore/apps/$SERVICE.."
-  PASSPHRASE=$GPG_PASSPHRASE duplicity --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/ /federated.restore/apps/$SERVICE
+  PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$SERVICE/ /federated.restore/apps/$SERVICE
   [ $? -ne 0 ] && failcheck "* Couldn't restore files"
 }
 restorebackup_allservices() {
   echo "* Restoring all services.."
   for i in "${SERVICES[@]}"; do
     echo "** Restoring $i to /federated.restore/apps/$i.."
-    PASSPHRASE=$GPG_PASSPHRASE duplicity --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/ /federated.restore/apps/$i
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/federated/apps/$i/ /federated.restore/apps/$i
   done
 }
 restorebackup_nfsmounts() {
@@ -342,13 +342,13 @@ restorebackup_nfsmounts() {
   else
     echo "* NFS mount found: $NFSMOUNT"
     echo "* Restoring NFS.."
-    PASSPHRASE=$GPG_PASSPHRASE duplicity --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/$NFSMOUNT/ /federated.restore/$NFSMOUNT
+    PASSPHRASE=$GPG_PASSPHRASE duplicity --tempdir /federated/tmp --force b2://$B2_APPLICATION_KEY_ID:$B2_APPLICATION_KEY@fed-customers/$UUID/$NFSMOUNT/ /federated.restore/$NFSMOUNT
     [ $? -ne 0 ] && failcheck "* Couldn't restore NFS mount"
   fi
 }
 check_freedisk() {
   # Check if there is enough free disk space (needs 15G minimum)
-  FREEDISK=$(df / | awk 'NR==2{print int($4/1024/1024)}')
+  FREEDISK=$(df /federated | awk 'NR==2{print int($4/1024/1024)}')
   if [ $FREEDISK -lt 15 ]; then
     send_alert_backups
     failcheck "Disk is below 15G, can't backup."