Initial VPS operations handbook

ansible/roles/matrix_backup/tasks/main.yml

@@ -0,0 +1,49 @@
+---
+- name: Require explicit approval before installing backup automation
+  ansible.builtin.assert:
+    that:
+      - matrix_backup_enabled | bool
+    fail_msg: >-
+      Refusing to install Matrix backup automation until matrix_backup_enabled=true
+      is supplied deliberately.
+
+- name: Create root-only Matrix backup directory
+  ansible.builtin.file:
+    path: "{{ matrix_backup_path }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Install Matrix backup script
+  ansible.builtin.template:
+    src: matrix-backup.sh.j2
+    dest: "{{ matrix_backup_script_path }}"
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: Install Matrix backup systemd service
+  ansible.builtin.template:
+    src: matrix-backup.service.j2
+    dest: "/etc/systemd/system/{{ matrix_backup_service_name }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload systemd
+
+- name: Install Matrix backup systemd timer
+  ansible.builtin.template:
+    src: matrix-backup.timer.j2
+    dest: "/etc/systemd/system/{{ matrix_backup_timer_name }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: Reload systemd
+
+- name: Enable Matrix backup timer
+  ansible.builtin.systemd:
+    name: "{{ matrix_backup_timer_name }}"
+    enabled: true
+    state: started
+    daemon_reload: true