Bastian de Byl
0ab423ca55
The data-only rsync left no way to restore a working instance: mysql/ and config/ were never backed up, so a recovery would have files but no shares, users or metadata. Dump the database before syncing files (a DB older than the files is repairable with occ files:scan; a newer one references blobs that never made it into the backup) and ship config/ alongside it. Capture the --chmod=Du=rwx,Dgo=rx flag that had been hand-added to the deployed skudak-cloud script. It was outside git, so every deploy silently reverted it. It now lives in backup_rsync_extra_args. Add OnFailure= alerting. The units failed silently before, which is how an iDrive sync failure sat unnoticed since May. msmtp rather than the esmtp already installed: the OpenSRS relay is port 465 (implicit TLS) and libesmtp only speaks STARTTLS. Exclude nextcloud.log* from the sync and cap log_rotate_size. skudak-cloud was running at loglevel 0 and had written a 64 GB log that was being rsynced and pushed to S3; set it to 2 to match the home instance. Stagger the timers (04:00 / 04:30) so both finish before the 05:00 TrueNAS snapshot task, and bound TimeoutStartSec so a wedged rsync cannot leave the unit activating forever and skip every subsequent trigger. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
81 lines
2.0 KiB
YAML
81 lines
2.0 KiB
YAML
---
|
|
- name: create backup SSH key directory
|
|
become: true
|
|
ansible.builtin.file:
|
|
path: /etc/ssh/backup_keys
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: 0700
|
|
|
|
- name: deploy {{ backup_name }} backup SSH key
|
|
become: true
|
|
ansible.builtin.copy:
|
|
content: "{{ ssh_key_content }}"
|
|
dest: "{{ ssh_key_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: 0600
|
|
setype: ssh_home_t
|
|
|
|
- name: template {{ backup_name }} backup script
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nextcloud/cloud-backup.sh.j2
|
|
dest: "{{ script_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
setype: bin_t
|
|
|
|
# Shared by every backup instance. Rendered once per include; the second and
|
|
# later renders are no-ops.
|
|
- name: template nextcloud backup alert script
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nextcloud/nextcloud-backup-alert.sh.j2
|
|
dest: /usr/local/bin/nextcloud-backup-alert.sh
|
|
owner: root
|
|
group: root
|
|
mode: 0755
|
|
setype: bin_t
|
|
|
|
- name: template nextcloud backup failure handler unit
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nextcloud/nextcloud-backup-failed@.service.j2
|
|
dest: /etc/systemd/system/nextcloud-backup-failed@.service
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
|
|
- name: template {{ backup_name }} backup systemd service
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nextcloud/cloud-backup.service.j2
|
|
dest: "/etc/systemd/system/{{ backup_name }}-backup.service"
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
vars:
|
|
instance_name: "{{ backup_name }}"
|
|
|
|
- name: template {{ backup_name }} backup systemd timer
|
|
become: true
|
|
ansible.builtin.template:
|
|
src: nextcloud/cloud-backup.timer.j2
|
|
dest: "/etc/systemd/system/{{ backup_name }}-backup.timer"
|
|
owner: root
|
|
group: root
|
|
mode: 0644
|
|
vars:
|
|
instance_name: "{{ backup_name }}"
|
|
|
|
- name: enable and start {{ backup_name }} backup timer
|
|
become: true
|
|
ansible.builtin.systemd:
|
|
name: "{{ backup_name }}-backup.timer"
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|