vps/ansible/roles/restic/tasks/main.yml

---
- name: Require explicit Restic opt-in
  ansible.builtin.assert:
    that:
      - restic_enabled | bool
    fail_msg: >-
      Restic is disabled by default. Set restic_enabled=true and provision the
      repository configuration only on the target host after backend approval.

- name: Validate supported Restic source profile
  ansible.builtin.assert:
    that:
      - restic_backup_profile in restic_sources
    fail_msg: "No approved Restic source profile for {{ restic_backup_profile }}."

- name: Verify Restic binary exists on target
  ansible.builtin.stat:
    path: "{{ restic_binary }}"
  register: restic_binary_stat

- name: Require target-side Restic binary
  ansible.builtin.assert:
    that: restic_binary_stat.stat.exists
    fail_msg: "Install Restic through an approved host maintenance change first."

- name: Verify target-side repository configuration exists
  ansible.builtin.stat:
    path: "{{ restic_config_path }}"
  register: restic_config_stat

- name: Require root-only repository configuration
  ansible.builtin.assert:
    that:
      - restic_config_stat.stat.exists
      - restic_config_stat.stat.mode == '0600'
    fail_msg: >-
      Provision {{ restic_config_path }} directly on the host with mode 0600.
      It must contain RESTIC_REPOSITORY, RESTIC_PASSWORD_FILE, and any backend
      credentials; do not commit or pass them via Ansible.

- name: Install Restic state and log directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: "0750"
  loop:
    - "{{ restic_state_dir }}"
    - "{{ restic_log_dir }}"

- name: Install Restic script directory
  ansible.builtin.file:
    path: /usr/local/lib/vps-restic
    state: directory
    owner: root
    group: root
    mode: "0755"

- name: Install Restic scripts
  ansible.builtin.template:
    src: "{{ item }}.j2"
    dest: "/usr/local/lib/vps-restic/{{ item }}"
    owner: root
    group: root
    mode: "0750"
  loop:
    - backup
    - check
    - forget-prune

- name: Install Restic systemd units and timers
  ansible.builtin.template:
    src: "{{ item }}.j2"
    dest: "/etc/systemd/system/{{ item }}"
    owner: root
    group: root
    mode: "0644"
  loop:
    - vps-restic-backup.service
    - vps-restic-backup.timer
    - vps-restic-check.service
    - vps-restic-check.timer
    - vps-restic-forget-prune.service
    - vps-restic-forget-prune.timer
  notify: Reload systemd

- name: Enable Restic timers
  ansible.builtin.systemd_service:
    name: "{{ item }}"
    enabled: true
    state: started
    daemon_reload: true
  loop:
    - vps-restic-backup.timer
    - vps-restic-check.timer
    - vps-restic-forget-prune.timer