From 8d96529d8f20aaa74809b03237453304e128358b Mon Sep 17 00:00:00 2001
From: alessandrovitali <mail@alessandrovitali.net>
Date: Thu, 9 Jul 2026 15:51:45 +0200
Subject: [PATCH] feat: add backup role using restic

---
 roles/backup/tasks/main.yml                   | 31 +++++++++++++++++++
 .../backup/templates/restic-backup.service.j2 |  7 +++++
 roles/backup/templates/restic-backup.sh.j2    | 23 ++++++++++++++
 roles/backup/templates/restic-backup.timer.j2 | 10 ++++++
 4 files changed, 71 insertions(+)
 create mode 100644 roles/backup/tasks/main.yml
 create mode 100644 roles/backup/templates/restic-backup.service.j2
 create mode 100644 roles/backup/templates/restic-backup.sh.j2
 create mode 100644 roles/backup/templates/restic-backup.timer.j2

diff --git a/roles/backup/tasks/main.yml b/roles/backup/tasks/main.yml
new file mode 100644
index 0000000..e2954dc
--- /dev/null
+++ b/roles/backup/tasks/main.yml
@@ -0,0 +1,31 @@
+---
+- name: Install Restic
+  ansible.builtin.apt:
+    name: restic
+    state: present
+  become: true
+
+- name: Deploy restic backup script
+  ansible.builtin.template:
+    src: restic-backup.sh.j2
+    dest: /usr/local/bin/restic-backup.sh
+    mode: "0700" # Only root can read/execute this because it contains secrets
+
+- name: Deploy restic systemd service
+  ansible.builtin.template:
+    src: restic-backup.service.j2
+    dest: /etc/systemd/system/restic-backup.service
+    mode: "0644"
+
+- name: Deploy restic systemd timer
+  ansible.builtin.template:
+    src: restic-backup.timer.j2
+    dest: /etc/systemd/system/restic-backup.timer
+    mode: "0644"
+
+- name: Enable and start backup timer
+  ansible.builtin.systemd:
+    name: restic-backup.timer
+    enabled: yes
+    state: started
+    daemon_reload: yes
diff --git a/roles/backup/templates/restic-backup.service.j2 b/roles/backup/templates/restic-backup.service.j2
new file mode 100644
index 0000000..c0c0020
--- /dev/null
+++ b/roles/backup/templates/restic-backup.service.j2
@@ -0,0 +1,7 @@
+[Unit]
+Description=Run Restic Backup
+After=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/restic-backup.sh
diff --git a/roles/backup/templates/restic-backup.sh.j2 b/roles/backup/templates/restic-backup.sh.j2
new file mode 100644
index 0000000..1f33c22
--- /dev/null
+++ b/roles/backup/templates/restic-backup.sh.j2
@@ -0,0 +1,23 @@
+#!/bin/bash
+## Ansible managed
+
+## Secrets are passed via Ansible Vault variables
+export RESTIC_REPOSITORY="{{ vault_restic_repo_url }}"
+export RESTIC_PASSWORD="{{ vault_restic_password }}"
+export AWS_ACCESS_KEY_ID="{{ vault_aws_access_key }}"
+export AWS_SECRET_ACCESS_KEY="{{ vault_aws_secret_key }}"
+
+set -e
+
+echo "Starting Restic Backup at $(date)"
+
+## Run the backup (docker volumes & config files)
+restic backup \
+  /etc \
+  /opt/docker-data \
+  --exclude /opt/docker-data/tmp \
+  --cleanup-cache
+
+restic forget --prune --keep-daily 7 --keep-weekly 4 --keep-monthly 6
+
+echo "Restic backup completed at $(date)"
diff --git a/roles/backup/templates/restic-backup.timer.j2 b/roles/backup/templates/restic-backup.timer.j2
new file mode 100644
index 0000000..b9ca4c1
--- /dev/null
+++ b/roles/backup/templates/restic-backup.timer.j2
@@ -0,0 +1,10 @@
+[Unit]
+Description=Run Restic Backup Daily at 4:00 AM
+
+[Timer]
+OnCalendar=*-*-* 04:00:00
+Persistent=true
+RandomizedDelaySec=1800
+
+[Install]
+WantedBy=timers.target