Bastian de Byl
c184099b2d
A host-to-iDrive S3 stage was added here and is now removed. It would have written the same data into the same `backup-all` bucket that the TrueNAS cloud-sync task already fills -- duplicate storage, two writers to one prefix, for no additional coverage. Offsite to business-owned storage was already solved: the rsync feeds /mnt/glacier/skudakcloud and TrueNAS cloud-syncs that to Skudak's own iDrive e2 account. The earlier note in skudak/cloud.yml proposed adding S3 *and then dropping the rsync* -- replacement, not addition -- and building both was a misreading of it. If offsite is ever moved onto this host it must REPLACE the rsync, not run beside it. Settle first whether the TrueNAS -> iDrive leg is independently verifiable; keeping this chain means trusting it. Also removes the now-orphaned /etc/backup_s3 credential file. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
93 lines
2.6 KiB
YAML
93 lines
2.6 KiB
YAML
---
|
|
- name: create backup SSH key directory
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/backup_keys
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: 0700
|
|
|
|
- name: deploy {{ backup_name }} backup SSH key
|
|
become: true
|
|
ansible.builtin.copy:
|
|
content: "{{ ssh_key_content }}"
|
|
dest: "{{ ssh_key_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: 0600
|
|
setype: ssh_home_t
|
|
|
|
# A direct host-to-S3 stage was added here and then removed. Offsite already
|
|
# happens: the TrueNAS rsync below feeds /mnt/glacier/skudakcloud, and a
|
|
# TrueNAS cloud-sync task pushes that to Skudak's own iDrive e2 bucket. A
|
|
# second, direct push would have written the same data into the same bucket
|
|
# twice. If offsite is ever moved onto this host, it should REPLACE the rsync
|
|
# rather than run alongside it.
|
|
- name: remove obsolete backup S3 credentials
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: "/etc/backup_s3/{{ backup_name }}"
|
|
state: absent
|
|
|
|
- name: template {{ backup_name }} backup script
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nextcloud/cloud-backup.sh.j2
|
|
dest: "{{ script_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
setype: bin_t
|
|
|
|
# Shared by every backup instance. Rendered once per include; the second and
|
|
# later renders are no-ops.
|
|
- name: template nextcloud backup alert script
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nextcloud/nextcloud-backup-alert.sh.j2
|
|
dest: /usr/local/bin/nextcloud-backup-alert.sh
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
setype: bin_t
|
|
|
|
- name: template nextcloud backup failure handler unit
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nextcloud/nextcloud-backup-failed@.service.j2
|
|
dest: /etc/systemd/system/nextcloud-backup-failed@.service
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
|
|
- name: template {{ backup_name }} backup systemd service
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nextcloud/cloud-backup.service.j2
|
|
dest: "/etc/systemd/system/{{ backup_name }}-backup.service"
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
vars:
|
|
instance_name: "{{ backup_name }}"
|
|
|
|
- name: template {{ backup_name }} backup systemd timer
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nextcloud/cloud-backup.timer.j2
|
|
dest: "/etc/systemd/system/{{ backup_name }}-backup.timer"
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
vars:
|
|
instance_name: "{{ backup_name }}"
|
|
|
|
- name: enable and start {{ backup_name }} backup timer
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: "{{ backup_name }}-backup.timer"
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|