Initial VPS operations handbook

ansible/roles/restic/templates/backup.j2

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# Repository and password credentials are host-local in {{ restic_config_path }}.
+# shellcheck source=/dev/null
+source '{{ restic_config_path }}'
+exec '{{ restic_binary }}' backup --tag '{{ healthcheck_profile }}' --tag "$(hostname -s)" {% for source in restic_sources[healthcheck_profile] %}{{ source | quote }} {% endfor %}

ansible/roles/restic/templates/check.j2

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# shellcheck source=/dev/null
+source '{{ restic_config_path }}'
+exec '{{ restic_binary }}' check --read-data-subset=5%

ansible/roles/restic/templates/forget-prune.j2

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+# shellcheck source=/dev/null
+source '{{ restic_config_path }}'
+exec '{{ restic_binary }}' forget --prune --keep-daily {{ restic_keep_daily }} --keep-weekly {{ restic_keep_weekly }} --keep-monthly {{ restic_keep_monthly }} --tag '{{ healthcheck_profile }}'

ansible/roles/restic/templates/vps-restic-backup.service.j2

@@ -0,0 +1,11 @@
+[Unit]
+Description=Restic backup for approved {{ healthcheck_profile }} sources
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+UMask=0077
+ExecStart=/usr/local/lib/vps-restic/backup

ansible/roles/restic/templates/vps-restic-backup.timer.j2

@@ -0,0 +1,11 @@
+[Unit]
+Description=Daily Restic backup timer
+
+[Timer]
+OnCalendar={{ restic_backup_on_calendar }}
+Persistent=true
+RandomizedDelaySec=20m
+Unit=vps-restic-backup.service
+
+[Install]
+WantedBy=timers.target

ansible/roles/restic/templates/vps-restic-check.service.j2

@@ -0,0 +1,9 @@
+[Unit]
+Description=Restic repository integrity check
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+UMask=0077
+ExecStart=/usr/local/lib/vps-restic/check

ansible/roles/restic/templates/vps-restic-check.timer.j2

@@ -0,0 +1,11 @@
+[Unit]
+Description=Weekly Restic integrity check timer
+
+[Timer]
+OnCalendar={{ restic_check_on_calendar }}
+Persistent=true
+RandomizedDelaySec=30m
+Unit=vps-restic-check.service
+
+[Install]
+WantedBy=timers.target

ansible/roles/restic/templates/vps-restic-forget-prune.service.j2

@@ -0,0 +1,9 @@
+[Unit]
+Description=Restic retention and prune
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+UMask=0077
+ExecStart=/usr/local/lib/vps-restic/forget-prune

ansible/roles/restic/templates/vps-restic-forget-prune.timer.j2

@@ -0,0 +1,11 @@
+[Unit]
+Description=Weekly Restic retention timer
+
+[Timer]
+OnCalendar={{ restic_forget_on_calendar }}
+Persistent=true
+RandomizedDelaySec=30m
+Unit=vps-restic-forget-prune.service
+
+[Install]
+WantedBy=timers.target