jakub
b84afb3abf
Ship borgmatic.service and borgmatic.timer from the backup role instead of relying on the package-provided units. The units are deployed to /etc/systemd/system (overriding the package units), with a configurable schedule via role defaults. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
106 lines
3.3 KiB
YAML
106 lines
3.3 KiB
YAML
---
|
|
- name: Skip hosts without backup config
|
|
ansible.builtin.debug:
|
|
msg: "No entry in backup_hosts for {{ inventory_hostname }}; skipping backup role."
|
|
when: inventory_hostname not in (backup_hosts | default({}))
|
|
|
|
- name: Configure borgmatic
|
|
when: inventory_hostname in (backup_hosts | default({}))
|
|
block:
|
|
|
|
- name: Ensure borg_passphrase is set (Semaphore secret)
|
|
ansible.builtin.assert:
|
|
that:
|
|
- borg_passphrase is defined
|
|
- borg_passphrase | length > 0
|
|
fail_msg: "borg_passphrase must be defined (provided by Semaphore secrets)"
|
|
|
|
- name: Install borgmatic
|
|
ansible.builtin.package:
|
|
name: borgmatic
|
|
state: present
|
|
|
|
- name: Ensure /etc/borgmatic exists
|
|
ansible.builtin.file:
|
|
path: /etc/borgmatic
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: '0750'
|
|
|
|
- name: Write borg passphrase file
|
|
ansible.builtin.copy:
|
|
dest: /etc/borgmatic/passphrase
|
|
content: "{{ borg_passphrase }}"
|
|
owner: root
|
|
group: root
|
|
mode: '0600'
|
|
no_log: true
|
|
|
|
- name: Ensure root has an SSH key for the borg server
|
|
ansible.builtin.user:
|
|
name: root
|
|
generate_ssh_key: true
|
|
ssh_key_type: ed25519
|
|
ssh_key_file: .ssh/id_ed25519
|
|
ssh_key_comment: "borgmatic@{{ inventory_hostname }}"
|
|
register: root_ssh
|
|
|
|
- name: Register / look up repository on borg controller
|
|
ansible.builtin.include_tasks: borgcontroller.yml
|
|
when:
|
|
- borgcontroller_username is defined
|
|
- borgcontroller_password is defined
|
|
|
|
- name: Build borgmatic config (strip controller-only keys, inject repository + passcommand)
|
|
ansible.builtin.set_fact:
|
|
_borgmatic_config: >-
|
|
{{
|
|
(backup_hosts[inventory_hostname]
|
|
| dict2items
|
|
| rejectattr('key', 'in', ['storage_size_gb'])
|
|
| items2dict)
|
|
| combine({'encryption_passcommand': 'cat /etc/borgmatic/passphrase'})
|
|
| combine(
|
|
{'repositories': [{'path': borgcontroller_repo_uri, 'label': inventory_hostname}]}
|
|
if borgcontroller_repo_uri is defined else {}
|
|
)
|
|
}}
|
|
|
|
- name: Deploy borgmatic config
|
|
ansible.builtin.template:
|
|
src: borgmatic.yaml.j2
|
|
dest: /etc/borgmatic/config.yaml
|
|
owner: root
|
|
group: root
|
|
mode: '0640'
|
|
|
|
- name: Deploy borgmatic systemd service (overrides package unit)
|
|
ansible.builtin.template:
|
|
src: borgmatic.service.j2
|
|
dest: /etc/systemd/system/borgmatic.service
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: _borgmatic_service_unit
|
|
|
|
- name: Deploy borgmatic systemd timer (overrides package unit)
|
|
ansible.builtin.template:
|
|
src: borgmatic.timer.j2
|
|
dest: /etc/systemd/system/borgmatic.timer
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
register: _borgmatic_timer_unit
|
|
|
|
- name: Reload systemd if units changed
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|
|
when: _borgmatic_service_unit is changed or _borgmatic_timer_unit is changed
|
|
|
|
- name: Enable and start borgmatic timer
|
|
ansible.builtin.systemd:
|
|
name: borgmatic.timer
|
|
enabled: true
|
|
state: started
|