manatee: Remove stale restic locks before each backup

hosts/manatee/modules/restic/default.nix

@@ -115,6 +115,12 @@ let
     echo "state-backup: dump complete"
   '';
 
+  # A run killed mid-way (e.g. DNS dropping during an upload) leaves its lock
+  # behind, and every later run then fails in the pre-start "cat config"
+  # check. unlock only removes stale locks; "|| true" keeps a first run
+  # against a not-yet-initialized repo working.
+  backupPrepareCommand = "${pkgs.restic}/bin/restic unlock || true";
+
   # Retention shared by all jobs.
   pruneOpts = [
     "--keep-daily 1"
@@ -142,7 +148,7 @@ in
           OnCalendar = "*-*-* 0/12:00:00";
           Persistent = true;
         };
-        inherit pruneOpts;
+        inherit pruneOpts backupPrepareCommand;
       };
 
       "sync-to-cloud" = {
@@ -155,7 +161,7 @@ in
           OnCalendar = "*-*-* 0/12:00:00";
           Persistent = true;
         };
-        inherit pruneOpts;
+        inherit pruneOpts backupPrepareCommand;
       };
 
       # Service state (databases etc.). No timer of their own: the state-backup
@@ -167,7 +173,7 @@ in
         paths = [ stateDir ];
         repository = "/mnt/backup/restic";
         timerConfig = null;
-        inherit pruneOpts;
+        inherit pruneOpts backupPrepareCommand;
       };
 
       "state-to-cloud" = {
@@ -177,7 +183,7 @@ in
         repositoryFile = config.age.secrets.restic-cloud-sync-repository.path;
         paths = [ stateDir ];
         timerConfig = null;
-        inherit pruneOpts;
+        inherit pruneOpts backupPrepareCommand;
       };
     };