Bash Backup script for password DB - Improved

1. That's a LOT of unnecessary subshells! You might want to use more {...}s than (...)s, see https://www.gnu.org/software/bash/manual/html_node/Command-Grouping.html.
2. The output of log goes to stdout but it should go to stderr instead.
3. You have at least 3 different ways of reporting error messages, e.g.:

git clone [email protected]:notfound/notfound.git 2>> "$log_file"
log "ERROR - Failed to clone remote repository"
echo "ERROR - Clone failed."

where the first one writes to $log_file without a timestamp, the second one writes to $log_file with a timestamp, and the third one doesn't write to $log_file. Come up with 1 method of error reporting (e.g. calling your log function but making sure its output goes to stderr) and then use that consistently, e.g. maybe something like (untested):

log() {
    {
        if (( $# > 0 )); then
            printf '%s\n' "$*"
        else
            cat
        fi
    } |
    ts '[%F %H:%M:%.S]' 2>&1 |
    tee -a "$log_file" >&2
}
...
git clone [email protected]:notfound/notfound.git 2> >(log); wait
log 'ERROR - Failed to clone remote repository'
log 'ERROR - Clone failed.'

The wait after >(log); is necessary because log is being executed in a subprocess and, courtesy of the pipes, 3 subprocesses are being executed within log and we wouldn't want the line after log is called to execute before log completes or we could see output lines in the wrong order in the log file.

Overall, I find that the process is not very efficient, because you clone the file locally to determine if it differs from your local version. This would not scale well with large files.

You could as well push the file based on different criteria, for example the last updated timestamp. Yes, you've written in the comments that the file could change without entries being actually added/removed, but the changes could perhaps be still meaningful. The file should be very small anyway, so you don't have to think a lot about tradeoffs.

My approach:

• From time to time, I backup my home directory to an external hard drive, that includes my KeepassXC file (I am the old school type)
• I also use Rclone for remote backups, and Rclone can encrypt data on the fly. So in theory the data is useless to anybody who could come into possession of it.

Also, Rclone skips files that are unchanged:

Copy the source to the destination. Does not transfer files that are identical on source and destination, testing by size and modification time or MD5SUM.

Using a git-based mechanism provides you with a full history, but do you really need that and for what? A rolling backup should be sufficient, keeping the most recent versions of the file.

KeePassXC also has a sync mechanism called KeeShare. I don't use it at the moment, but maybe it could be useful in some use cases?

Variables

You have a number of variables like file paths etc, I would move them to the top of your script, so they are set as soon as possible. This can be a source of nasty bugs sometimes. If the variable is not yet initialized when a function needs it, then it will be treated as empty.

Git/ssh

Your custom git command is like this:

export GIT_SSH_COMMAND="SSH_AUTH_SOCK='/run/user/1000/keyring/ssh' ssh -i $repo_identity_file -o IdentitiesOnly=yes -F /dev/null"

What man ssh says:

-F configfile Specifies an alternative per-user configuration file. If a configuration file is given on the command line, the system-wide configuration file (/etc/ssh/ssh_config) will be ignored. The default for the per-user configuration file is ~/.ssh/config. If set to “none”, no configuration files will be read.

Accordingly, you could write -F none instead of /dev/null. Or you could really add an entry in your SSH config file for gitlab.com, specifying which key to use, and some other options. If you are thinking about the portability of the script, you still need the appropriate private key anyway, and your script cannot work without certain user-specific prerequisites.

Return codes

Your functions could use the return statement to provide a success/failure code. I have noticed that you use false, I find that unusual but I am not the expert.

Logging

You can use the Linux logger as an alternative. Also, you can use level (severity) to filter entries. This can be an interesting option on systems that have a log monitoring system in place eg. syslog-ng, ELK, Loki. These systems can trigger alerts when anomalies are found in the logs (because nobody reads them anyway).

If you are writing a systemd service, then you can use journalctl to query your logs.