log-guard: root supervisord program keeps dated log files cloudron-owned

A host-side daily job creates the next day's dated log files as root:root at
00:00 UTC; LibreChat (cloudron user) then EACCES-crashes on its first log
write of the day (2026-10-22 and 2026-10-23 incidents). The guard pre-creates
today's and tomorrow's files as cloudron and repairs strays every minute.
Defense-in-depth until the host rotation config is fixed.

assets/log-guard.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# Log ownership guard for /app/data/logs.
+#
+# A host-side daily job creates the next day's dated log files
+# (error-<date>.log, meiliSync-<date>.log, ...) as root:root at 00:00 UTC.
+# LibreChat runs as the `cloudron` user and crashes (EACCES on uncaught
+# error) the first time it tries to append to a root-owned log. This guard
+# runs as root (via supervisord) and, every minute:
+#   1. pre-creates TODAY's and TOMORROW's dated files owned by cloudron
+#      (an existing correctly-owned file defeats the ownership flip —
+#      open(O_TRUNC) preserves the inode's owner),
+#   2. chowns any root-owned strays back to cloudron.
+#
+# This is a defense-in-depth stopgap; the host-side rotation config should
+# still be fixed to create files as cloudron (see co-op/support thread and
+# the overlay README).
+set -u
+LOGDIR="/app/data/logs"
+mkdir -p "$LOGDIR"
+
+while true; do
+    for offset in 0 1; do
+        d=$(date -u -d "+${offset} day" +%F 2>/dev/null)
+        [ -z "$d" ] && continue
+        for prefix in error meiliSync; do
+            f="$LOGDIR/${prefix}-${d}.log"
+            [ -e "$f" ] || : > "$f"
+        done
+    done
+    # Repair any root-owned strays (covers unknown file prefixes too).
+    find "$LOGDIR" ! -user cloudron -exec chown cloudron:cloudron {} \; 2>/dev/null
+    sleep 60
+done