alessandrovitali
71a02e0f86
move secrets to .env file so they work on their own, initialize restic repo on fresh deployments
62 lines
1.6 KiB
YAML
62 lines
1.6 KiB
YAML
---
|
|
- name: Install restic
|
|
ansible.builtin.apt:
|
|
name: restic
|
|
state: present
|
|
|
|
- name: Initialize restic repository
|
|
environment:
|
|
RESTIC_REPOSITORY: "{{ vault_restic_repo_url }}"
|
|
RESTIC_PASSWORD: "{{ vault_restic_password }}"
|
|
AWS_ACCESS_KEY_ID: "{{ vault_aws_access_key }}"
|
|
AWS_SECRET_ACCESS_KEY: "{{ vault_aws_secret_key }}"
|
|
block:
|
|
- name: Check if already initialized
|
|
ansible.builtin.command: restic snapshots
|
|
register: restic_check
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: Initialize repository
|
|
ansible.builtin.command: restic init
|
|
when: restic_check.rc != 0
|
|
|
|
- name: Deploy restic environment file
|
|
ansible.builtin.template:
|
|
src: restic-backup.env.j2
|
|
dest: /etc/restic-backup.env
|
|
owner: root
|
|
group: root
|
|
mode: "0600" # Only root can read this file because it contains sensitive credentials
|
|
|
|
- name: Deploy restic backup script
|
|
ansible.builtin.template:
|
|
src: restic-backup.sh.j2
|
|
dest: /usr/local/bin/restic-backup.sh
|
|
owner: root
|
|
group: root
|
|
mode: "0700" # Only root can execute this backup script
|
|
|
|
- name: Deploy restic systemd service
|
|
ansible.builtin.template:
|
|
src: restic-backup.service.j2
|
|
dest: /etc/systemd/system/restic-backup.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Deploy restic systemd timer
|
|
ansible.builtin.template:
|
|
src: restic-backup.timer.j2
|
|
dest: /etc/systemd/system/restic-backup.timer
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Enable and start backup timer
|
|
ansible.builtin.systemd:
|
|
name: restic-backup.timer
|
|
enabled: yes
|
|
state: started
|
|
daemon_reload: yes
|