fix: time-box LFS to 10min/repo, prevent buildroot blocking seedhammer

seedsigner/buildroot LFS push was taking hours, hitting the systemd
timeout, causing restart loop that never reached seedhammer.

- LFS fetch/push now wrapped in timeout (LFS_TIMEOUT=600s default)
- Systemd timeout raised to 8h for safety
- Git refs always push first (the critical data), LFS is best-effort

config/mirror.env.example

@@ -48,5 +48,9 @@ TELEGRAM_CHAT_ID=""
 # Stale-repo alert threshold in days
 STALE_DAYS=7
 
+# Max seconds for LFS fetch/push PER REPO (0 = no limit)
+# Prevents huge repos like buildroot from blocking the entire sync
+LFS_TIMEOUT=600
+
 # Force HTTP/1.1 (helps with Cloudflare Tunnel)
 FORCE_HTTP11="true"

scripts/breakglass-sync.sh

@@ -473,9 +473,11 @@ sync_repo() {
   # If upstream deleted a branch, our copy keeps it. That's the point.
 
   # ── LFS objects ──────────────────────────────────────
+  # Time-boxed: LFS is best-effort. We never let it block the whole sync.
+  LFS_TIMEOUT="${LFS_TIMEOUT:-600}"  # 10 min default per repo
   if command -v git-lfs &>/dev/null && git config --get-regexp 'lfs\.' &>/dev/null 2>&1; then
-    log "    fetching LFS objects …"
-    git lfs fetch origin --all 2>>"$LOG_FILE" || warn "LFS fetch incomplete for ${gh_owner}/${repo}"
+    log "    fetching LFS objects (timeout: ${LFS_TIMEOUT}s) …"
+    timeout "$LFS_TIMEOUT" git lfs fetch origin --all 2>>"$LOG_FILE" || warn "LFS fetch skipped/incomplete for ${gh_owner}/${repo}"
   fi
 
   # ── Push to Gitea ───────────────────────────────────
@@ -508,10 +510,12 @@ push_to_gitea() {
     return 1
   fi
 
-  # Push LFS to Gitea
+  # Push LFS to Gitea — time-boxed to avoid blocking on huge repos (e.g. buildroot)
+  LFS_TIMEOUT="${LFS_TIMEOUT:-600}"
   if command -v git-lfs &>/dev/null && git config --get-regexp 'lfs\.' &>/dev/null 2>&1; then
-    git -C "$bare_dir" lfs push gitea --all 2>>"$LOG_FILE" || \
-      warn "LFS push incomplete for ${gitea_org}/${repo}"
+    log "    pushing LFS to Gitea (timeout: ${LFS_TIMEOUT}s) …"
+    timeout "$LFS_TIMEOUT" git -C "$bare_dir" lfs push gitea --all 2>>"$LOG_FILE" || \
+      warn "LFS push skipped/incomplete for ${gitea_org}/${repo} (may have timed out)"
   fi
 
   audit "PUSHED repo=${gitea_org}/${repo}"

systemd/breakglass-sync.service

@@ -25,8 +25,8 @@ PrivateDevices=true
 MemoryMax=1G
 CPUQuota=80%
 
-# Allow long runs (bitcoin/bitcoin alone takes ~35 min to push)
-TimeoutStartSec=14400
+# Allow long runs (full sync across all orgs can take several hours)
+TimeoutStartSec=28800
 
 # Restart on failure after 5 minutes (transient network issues)
 Restart=on-failure