windyboy
e7296e664a
Inventory now declares the plural healthcheck_profiles list per host (hk2 runs pdns, rustdesk, hk2aux) instead of a single healthcheck_profile, and carries the rustdesk server vars (rustdesk_compose_dir/relay/image) plus the rustdesk host group. The restic role relied on the removed singular healthcheck_profile var; it now uses its own restic_backup_profile (set per host to vaultwarden on us2 and pdns on hk2), so the health-check rename no longer breaks it. audit.yml's summary labels the host's profile list instead of the singular var.
98 lines
2.6 KiB
YAML
98 lines
2.6 KiB
YAML
---
|
|
- name: Require explicit Restic opt-in
|
|
ansible.builtin.assert:
|
|
that:
|
|
- restic_enabled | bool
|
|
fail_msg: >-
|
|
Restic is disabled by default. Set restic_enabled=true and provision the
|
|
repository configuration only on the target host after backend approval.
|
|
|
|
- name: Validate supported Restic source profile
|
|
ansible.builtin.assert:
|
|
that:
|
|
- restic_backup_profile in restic_sources
|
|
fail_msg: "No approved Restic source profile for {{ restic_backup_profile }}."
|
|
|
|
- name: Verify Restic binary exists on target
|
|
ansible.builtin.stat:
|
|
path: "{{ restic_binary }}"
|
|
register: restic_binary_stat
|
|
|
|
- name: Require target-side Restic binary
|
|
ansible.builtin.assert:
|
|
that: restic_binary_stat.stat.exists
|
|
fail_msg: "Install Restic through an approved host maintenance change first."
|
|
|
|
- name: Verify target-side repository configuration exists
|
|
ansible.builtin.stat:
|
|
path: "{{ restic_config_path }}"
|
|
register: restic_config_stat
|
|
|
|
- name: Require root-only repository configuration
|
|
ansible.builtin.assert:
|
|
that:
|
|
- restic_config_stat.stat.exists
|
|
- restic_config_stat.stat.mode == '0600'
|
|
fail_msg: >-
|
|
Provision {{ restic_config_path }} directly on the host with mode 0600.
|
|
It must contain RESTIC_REPOSITORY, RESTIC_PASSWORD_FILE, and any backend
|
|
credentials; do not commit or pass them via Ansible.
|
|
|
|
- name: Install Restic state and log directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
loop:
|
|
- "{{ restic_state_dir }}"
|
|
- "{{ restic_log_dir }}"
|
|
|
|
- name: Install Restic script directory
|
|
ansible.builtin.file:
|
|
path: /usr/local/lib/vps-restic
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Install Restic scripts
|
|
ansible.builtin.template:
|
|
src: "{{ item }}.j2"
|
|
dest: "/usr/local/lib/vps-restic/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
loop:
|
|
- backup
|
|
- check
|
|
- forget-prune
|
|
|
|
- name: Install Restic systemd units and timers
|
|
ansible.builtin.template:
|
|
src: "{{ item }}.j2"
|
|
dest: "/etc/systemd/system/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop:
|
|
- vps-restic-backup.service
|
|
- vps-restic-backup.timer
|
|
- vps-restic-check.service
|
|
- vps-restic-check.timer
|
|
- vps-restic-forget-prune.service
|
|
- vps-restic-forget-prune.timer
|
|
notify: Reload systemd
|
|
|
|
- name: Enable Restic timers
|
|
ansible.builtin.systemd_service:
|
|
name: "{{ item }}"
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
loop:
|
|
- vps-restic-backup.timer
|
|
- vps-restic-check.timer
|
|
- vps-restic-forget-prune.timer
|