Found while verifying the hourly snapshot from !145 on bay1.
Both backup scripts write archives containing the whole database, and both landed them 0644:
-rw-r--r-- 1 gitbay gitbay 1896404 /var/backups/gitbay/db/gitbay-db-20260901-052250.tar.gz
-rw-r--r-- 1 gitbay gitbay 551136023 /var/backups/gitbay/gitbay-20260830-090541.tar.gz
/var/backups/gitbay is 0750, so traversal blocks other local users — the same containment the live database file had, and the same reason to fix the mode anyway. umask 027 in both scripts. The db/ subdirectory was also inheriting 0755 from mkdir -p, so it is now created 0750 to match its parent.
No Go code.
Ref #28