diff --git a/ansible/inventory/hosts.yml b/ansible/inventory/hosts.yml index 2b27372..72235a9 100644 --- a/ansible/inventory/hosts.yml +++ b/ansible/inventory/hosts.yml @@ -17,7 +17,7 @@ all: ansible_host_ipv4: 194.163.160.244 service_role: mailcow compose_project_dir: /opt/mail - healthcheck_profile: mailcow + healthcheck_profiles: [mailcow] service_reconcile_services: all: compose_args: [--force-recreate] @@ -26,7 +26,8 @@ all: ansible_host_ipv4: 193.9.44.165 service_role: vaultwarden compose_project_dir: /opt/vaultwarden - healthcheck_profile: vaultwarden + healthcheck_profiles: [vaultwarden] + restic_backup_profile: vaultwarden service_reconcile_services: vaultwarden: compose_args: [--force-recreate] @@ -36,7 +37,8 @@ all: ansible_host_ipv4: 154.36.174.161 service_role: powerdns compose_project_dir: /opt/pdns - healthcheck_profile: pdns + healthcheck_profiles: [pdns, rustdesk, hk2aux] + restic_backup_profile: pdns service_reconcile_services: auth: compose_args: [--force-recreate] @@ -45,12 +47,16 @@ all: backup: compose_args: [--no-deps, --force-recreate] service_reconcile_traefik_restart_targets: [poweradmin] + # RustDesk server (same host, separate compose project) + rustdesk_compose_dir: /opt/rustdesk + rustdesk_relay: hk2.chans.xyz:21117 + rustdesk_image: rustdesk/rustdesk-server:1.1.14 us4: ansible_host: us4.wsvc.info ansible_host_ipv4: 185.201.226.122 service_role: wireguard compose_project_dir: /opt/wireguard - healthcheck_profile: wireguard + healthcheck_profiles: [wireguard] wireguard_image: >- lscr.io/linuxserver/wireguard@sha256:ac43e1226878d2611315172d6ea357a95cb326ee73124b91108118efc8666889 service_reconcile_services: @@ -61,7 +67,7 @@ all: ansible_host_ipv4: 192.168.66.36 service_role: adguardhome compose_project_dir: /opt/adguardhome - healthcheck_profile: adguardhome + healthcheck_profiles: [adguardhome] service_reconcile_services: adguardhome: compose_args: [--no-deps, --force-recreate] @@ -74,6 +80,9 @@ all: powerdns: hosts: hk2: + rustdesk: + hosts: + hk2: wireguard: hosts: us4: diff --git a/ansible/playbooks/audit.yml b/ansible/playbooks/audit.yml index 00d29d9..9384b94 100644 --- a/ansible/playbooks/audit.yml +++ b/ansible/playbooks/audit.yml @@ -64,7 +64,7 @@ ansible.builtin.debug: msg: host: "{{ inventory_hostname }}" - profile: "{{ healthcheck_profile }}" + profiles: "{{ healthcheck_profiles | default([]) | join(', ') }}" os: "{{ ansible_distribution }} {{ ansible_distribution_version }}" kernel: "{{ ansible_kernel }}" compose_rc: "{{ audit_compose_ps.rc }}" diff --git a/ansible/roles/restic/defaults/main.yml b/ansible/roles/restic/defaults/main.yml index fc15455..d9b2d60 100644 --- a/ansible/roles/restic/defaults/main.yml +++ b/ansible/roles/restic/defaults/main.yml @@ -1,5 +1,8 @@ --- restic_enabled: false +# Approved Restic source profile (a key of restic_sources) for the host. Set +# per-host in inventory; the role fails if it is not an approved source. +restic_backup_profile: "" restic_binary: /usr/bin/restic restic_config_path: /etc/vps-restic/repository.env restic_state_dir: /var/lib/vps-restic diff --git a/ansible/roles/restic/tasks/main.yml b/ansible/roles/restic/tasks/main.yml index 7cadfc5..fc0dc00 100644 --- a/ansible/roles/restic/tasks/main.yml +++ b/ansible/roles/restic/tasks/main.yml @@ -10,8 +10,8 @@ - name: Validate supported Restic source profile ansible.builtin.assert: that: - - healthcheck_profile in restic_sources - fail_msg: "No approved Restic source profile for {{ healthcheck_profile }}." + - restic_backup_profile in restic_sources + fail_msg: "No approved Restic source profile for {{ restic_backup_profile }}." - name: Verify Restic binary exists on target ansible.builtin.stat: diff --git a/ansible/roles/restic/templates/backup.j2 b/ansible/roles/restic/templates/backup.j2 index 2193494..27b9434 100644 --- a/ansible/roles/restic/templates/backup.j2 +++ b/ansible/roles/restic/templates/backup.j2 @@ -3,4 +3,4 @@ set -euo pipefail # Repository and password credentials are host-local in {{ restic_config_path }}. # shellcheck source=/dev/null source '{{ restic_config_path }}' -exec '{{ restic_binary }}' backup --tag '{{ healthcheck_profile }}' --tag "$(hostname -s)" {% for source in restic_sources[healthcheck_profile] %}{{ source | quote }} {% endfor %} +exec '{{ restic_binary }}' backup --tag '{{ restic_backup_profile }}' --tag "$(hostname -s)" {% for source in restic_sources[restic_backup_profile] %}{{ source | quote }} {% endfor %} diff --git a/ansible/roles/restic/templates/forget-prune.j2 b/ansible/roles/restic/templates/forget-prune.j2 index 7b4ce30..2dc9f9a 100644 --- a/ansible/roles/restic/templates/forget-prune.j2 +++ b/ansible/roles/restic/templates/forget-prune.j2 @@ -2,4 +2,4 @@ set -euo pipefail # shellcheck source=/dev/null source '{{ restic_config_path }}' -exec '{{ restic_binary }}' forget --prune --keep-daily {{ restic_keep_daily }} --keep-weekly {{ restic_keep_weekly }} --keep-monthly {{ restic_keep_monthly }} --tag '{{ healthcheck_profile }}' +exec '{{ restic_binary }}' forget --prune --keep-daily {{ restic_keep_daily }} --keep-weekly {{ restic_keep_weekly }} --keep-monthly {{ restic_keep_monthly }} --tag '{{ restic_backup_profile }}' diff --git a/ansible/roles/restic/templates/vps-restic-backup.service.j2 b/ansible/roles/restic/templates/vps-restic-backup.service.j2 index b9e2154..9cd1e1a 100644 --- a/ansible/roles/restic/templates/vps-restic-backup.service.j2 +++ b/ansible/roles/restic/templates/vps-restic-backup.service.j2 @@ -1,5 +1,5 @@ [Unit] -Description=Restic backup for approved {{ healthcheck_profile }} sources +Description=Restic backup for approved {{ restic_backup_profile }} sources After=network-online.target Wants=network-online.target