Bastian de Byl
0ab423ca55
The data-only rsync left no way to restore a working instance: mysql/ and config/ were never backed up, so a recovery would have files but no shares, users or metadata. Dump the database before syncing files (a DB older than the files is repairable with occ files:scan; a newer one references blobs that never made it into the backup) and ship config/ alongside it. Capture the --chmod=Du=rwx,Dgo=rx flag that had been hand-added to the deployed skudak-cloud script. It was outside git, so every deploy silently reverted it. It now lives in backup_rsync_extra_args. Add OnFailure= alerting. The units failed silently before, which is how an iDrive sync failure sat unnoticed since May. msmtp rather than the esmtp already installed: the OpenSRS relay is port 465 (implicit TLS) and libesmtp only speaks STARTTLS. Exclude nextcloud.log* from the sync and cap log_rotate_size. skudak-cloud was running at loglevel 0 and had written a 64 GB log that was being rsynced and pushed to S3; set it to 2 to match the home instance. Stagger the timers (04:00 / 04:30) so both finish before the 05:00 TrueNAS snapshot task, and bound TimeoutStartSec so a wedged rsync cannot leave the unit activating forever and skip every subsequent trigger. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
110 lines
3.1 KiB
YAML
110 lines
3.1 KiB
YAML
---
|
|
- name: create required cloud volumes
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: "{{ podman_subuid.stdout }}"
|
|
group: "{{ podman_subuid.stdout }}"
|
|
mode: 0755
|
|
notify: restorecon podman
|
|
loop:
|
|
- "{{ cloud_path }}/apps"
|
|
- "{{ cloud_path }}/config"
|
|
- "{{ cloud_path }}/data"
|
|
- "{{ cloud_path }}/mysql"
|
|
|
|
- name: unshare chown the nextcloud volumes
|
|
become: true
|
|
become_user: "{{ podman_user }}"
|
|
changed_when: false
|
|
ansible.builtin.command: |
|
|
podman unshare chown -R 33:33 {{ cloud_path }}/apps {{ cloud_path }}/data {{ cloud_path}}/config
|
|
|
|
- name: flush handlers
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- import_tasks: podman/podman-check.yml
|
|
vars:
|
|
container_name: cloud-db
|
|
container_image: "{{ db_image }}"
|
|
|
|
- name: create cloud-db container
|
|
become: true
|
|
become_user: "{{ podman_user }}"
|
|
containers.podman.podman_container:
|
|
name: cloud-db
|
|
image: "{{ db_image }}"
|
|
restart_policy: on-failure:3
|
|
log_driver: journald
|
|
network:
|
|
- shared
|
|
env:
|
|
MYSQL_ROOT_PASSWORD: "{{ cloud_db_root_pass }}"
|
|
MYSQL_DATABASE: cloud
|
|
MYSQL_PASSWORD: "{{ cloud_db_pass }}"
|
|
MYSQL_USER: cloud
|
|
volumes:
|
|
- "{{ cloud_path }}/mysql:/var/lib/mysql"
|
|
|
|
- name: create systemd startup job for cloud-db
|
|
include_tasks: podman/systemd-generate.yml
|
|
vars:
|
|
container_name: cloud-db
|
|
|
|
- import_tasks: podman/podman-check.yml
|
|
vars:
|
|
container_name: cloud
|
|
container_image: "{{ image }}"
|
|
|
|
- name: create cloud container
|
|
become: true
|
|
become_user: "{{ podman_user }}"
|
|
containers.podman.podman_container:
|
|
name: cloud
|
|
image: "{{ image }}"
|
|
restart_policy: on-failure:3
|
|
log_driver: journald
|
|
network:
|
|
- shared
|
|
env:
|
|
MYSQL_PASSWORD: "{{ cloud_db_pass }}"
|
|
MYSQL_DATABASE: cloud
|
|
MYSQL_HOST: cloud-db
|
|
MYSQL_USER: cloud
|
|
volumes:
|
|
- "{{ cloud_path }}/apps:/var/www/html/custom_apps"
|
|
- "{{ cloud_path }}/data:/var/www/html/data"
|
|
- "{{ cloud_path }}/config:/var/www/html/config"
|
|
ports:
|
|
- "8089:80"
|
|
|
|
- name: create systemd startup job for cloud
|
|
include_tasks: podman/systemd-generate.yml
|
|
vars:
|
|
container_name: cloud
|
|
|
|
# Unbounded by default: nextcloud.log.1 had reached 1.12 GB and was being
|
|
# rsynced to TrueNAS and pushed to S3 on every run. Cap at 10 MiB.
|
|
- name: cap nextcloud log rotation size for cloud
|
|
become: true
|
|
become_user: "{{ podman_user }}"
|
|
ansible.builtin.command: >
|
|
podman exec -u www-data cloud
|
|
php occ config:system:set log_rotate_size --value 10485760 --type integer
|
|
register: cloud_log_rotate
|
|
changed_when: "'System config value log_rotate_size' in cloud_log_rotate.stdout"
|
|
failed_when: false
|
|
|
|
- include_tasks: containers/cloud-backup.yml
|
|
vars:
|
|
backup_name: cloud
|
|
data_path: "{{ cloud_path }}/data"
|
|
config_path: "{{ cloud_path }}/config"
|
|
db_container: cloud-db
|
|
ssh_key_path: /etc/ssh/backup_keys/cloud
|
|
ssh_key_content: "{{ cloud_backup_ssh_key }}"
|
|
ssh_user: cloud
|
|
remote_path: /mnt/glacier/nextcloud
|
|
script_path: /usr/local/bin/cloud-backup.sh
|