diff --git a/host_vars/goldenrod.yaml b/host_vars/goldenrod.yaml index 564e2f8..cdf8d0b 100644 --- a/host_vars/goldenrod.yaml +++ b/host_vars/goldenrod.yaml @@ -9,3 +9,80 @@ ansible_become_password: !vault | 31653163653066653561393333343263653732333335633566363136353164666330 podman_config_base_dir: /home/{{ ansible_user }}/podman podman_quadlet_base_dir: "/home/{{ ansible_user }}/.config/containers/systemd" + +rclone_remotes: + - remote_name: server-gdrive + client_id: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 39326465313031353665303231376432333337303261373331663163316666343261313237636237 + 3236393437623731653966636230623432646165653937630a373633363738653662313664636634 + 32376234643637613430383038393533363063336330623631393335636434393531396366636463 + 3130366462356364370a333764343431363365663637393339663962343765363839653837383434 + 39386438363634316131313764333937366535306463323635653534613236333064633435323061 + 31643364313634663037333936373132333335343966373232363136346361363461313532373033 + 38663239383330336238353232636361306530396535363833636632383232613662383334613839 + 36613662636336633762 + client_secret: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 62343763323438343864633238613435663738393563306663356333313830306662613038363139 + 3663366562633036636136613464653666616333633230320a333438633264313932633763303663 + 66393336393030313739363062623737343534353063633230643264663939323730393564613638 + 3639306334613330340a323363366431383039616566643237386162333234623866326230393063 + 61613231326465353139316166636338383939623034353132656365316339636530393435633034 + 6661636237316238633564373730373031346532396136626130 + client_auth_token: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 35383162613236346339663135366239316134353133356635363731303032353536663064336335 + 3237633033633336623862616664323730373234373737650a333336326136346637653137316137 + 39333566356432643866663064343435333861646231643962383335643937333330373461636239 + 3333633366323339300a333535386135326631613362366337363264343137313532333563633865 + 34313636356332633265343832376336343765326237386538333439386238666632363432656638 + 63343363353664313030653930306237636363386235626535663532643231343463663161623235 + 33386339346461646337353638346337303233653262373361386563366631366231336266366661 + 61623937346134626661626232383130326432656237663034393062656236663764366263343939 + 34306433303333373566383538386463353164656466633534653563393336356638663338323339 + 36316334653936386331623538623334326139653463343366346166333934383439303538326364 + 39623865343736373364363332616130656162363530366631373032636435353830626539303962 + 62373530343738353131363237663131306334363235653137356430383264396132633466623964 + 61356239636362353036333732656663643435626662633737373939343338376464646262653864 + 39393331353837643938616132666234356161626263623932643038376439356362656539623165 + 32643663346538383635643338376636633864663362323833383161316362653461363663343361 + 65303061306331663132656464343462366533376536323339393339383336313865383865353832 + 61626635353762363334313536313830353930306164316633656263326233373164326138316265 + 65663437323235363734323430393038313432616636326437336339386133643030656464663333 + 66616134636663666565326265633236336434363461333633343335646439653034393538353662 + 34353064653264353064336534393931356638646432363263376430323965383834326232393663 + 33326463363062323431396534313836363030313633356434616239633939626239636330303361 + 37356363346466393936373866333565616639353764363530303862646261626437663231393131 + 66623961663836333637303439376133376133316565343564393032336636353035626632663836 + 35643465336239396332353233373830333161366263313539643733316239333137653230663665 + 30366634346266306636646263323463656538613462363062316238333636663965393831393132 + 66623766616533646132316465333563326462353665643835663933346134393135636362613262 + 63633636313337623439373564386538313130633630386333623831396631386664343635646362 + 32396439333031653930 + team_drive_id: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 36343736643764353661393361333134346632303135303832396562656333613036626338636661 + 6335303438663939623931386635333336646332653439310a623439653730346633373031613264 + 36323637666664643332383637666461373638316434633762636131653763393366623061633464 + 6334366336376135380a396233656138303237326565316635616433373061633438396364663165 + 63336634343039646665313833383938303338663934323065383231656235666131 + +restic_password: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 39346537333832343832363633363638363438393866323162366661643732333734643766393039 + 3465653230373864626562656365613731303739383536350a666238373337333061386264623738 + 34613561666433656663373338343536663062613564353135623530643338656565366666333738 + 3865636531386134330a333438306465303535636538346565333962353665393539313938343165 + 32663830356532373038326662303262633266353766383364636636623330386139 + +backup_name: "goldenrod-backup" +restic_repo_url: "rclone:server-gdrive:{{ backup_name }}" +restic_password_file: "/etc/restic/password" +rclone_config_path: "/etc/rclone/rclone.conf" +backup_paths: + - /home + - /etc + - /var +keep_daily: 7 +keep_weekly: 4 diff --git a/host_vars/new-bark.yaml b/host_vars/new-bark.yaml index 9d9c865..6a1437b 100644 --- a/host_vars/new-bark.yaml +++ b/host_vars/new-bark.yaml @@ -1,4 +1,5 @@ --- + ansible_user: jdelpilar ansible_become_password: !vault | $ANSIBLE_VAULT;1.1;AES256 @@ -42,3 +43,197 @@ runner_services: 3631366361653166310a616432386638613461623332383062336566613131353433303337366633 37663263626532656630646332303532653165653835666362656263616162356137316465336332 3934303430626561306166393262646139646234333364656237 + +rclone_remotes: + - remote_name: server-gdrive + client_id: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 35656534356131623134363663623637633638623333653036643632643138353966656361363939 + 3438636231366462663233333531646434333166363439610a643333333766636630626230316436 + 38303133633164353266633338653666663339346662393665336534303265663831666532346461 + 3336666434393563370a393536633232616564323132663363366334303337376264646264323239 + 35343062653131396138626365323539396235383465396234303734623231656432656635653734 + 66316531363833333237373562663062363436626237373464646463613564646565613836363631 + 65656437376631626138323332653033343833636131633036363338646361383236613664383935 + 65376664646136333237 + client_secret: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 37346363333430356563616334383762666330393365343766333238636439336333643535393230 + 3437616365303765376461616662303330613062373732640a343362386631386166363464393733 + 33333164633165346361363331393635323730343463646634646563323937316164643234326233 + 3463323730623064610a646635653764656536346663613734613764323863353938353731303033 + 38666533613137323063646635306364636337336533373132613861393837313037633038313237 + 3436353939633031376139613934323466326330613030326339 + client_auth_token: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 33663639396136356262653233623639663562653330393063616531353932633764363062663961 + 3961636162376237616432393866343832633038373037360a313438353438346134393566343032 + 33323637666235383431333733643763393635353936386437393766373338313132666236376562 + 6230383336653764390a353464303765326130396262613362646165316438306536373361363833 + 31653964613433666435626662356433623236306636303730383132636233626139333333616363 + 32343164363930666236323037326332353861353236613431613431316130663965393061343838 + 34393663633537613137393838323334616333633262393366346633313661373665653039616532 + 63356166616132393330666135613664643864373161366631663065663935646433663666323466 + 39343661646637326230383636336465666333353765653265346661623861613565303133366563 + 61366231363363303266623339666138353036346530646235666263383131623435383661656164 + 63633766663763353435623839386262303165666439353462646133343832313832363630633739 + 39396535623465396561323565323735633933363131356235663534373462303631373939353331 + 30316439653930326164316237383364643561333931653736323362636334313065343732656363 + 30613637393430346433656436623834643831363037633534656561323165663030623032623535 + 33366337336363343533363233323932393835666638306662323830636661303132613131366632 + 38373062316134383137626535633131663961636236663831656261363031663839646135383762 + 30356432626366363665656465306264643238393962643661383062393334333836323666613962 + 35393730323135646365393133333936303235623133303230333930663839396630383739356338 + 31333161623230386264346362383738303238366332333566366564303033366437666435666634 + 61366437386334306438616162666130396565306438643565316462626437313466666561396562 + 30313537393937326238373331313832323664663737313330343263363766326662383735653731 + 30303562363562633138343437623935383339656538623237383435663136363934313962373131 + 37613938616263666163336432653034393637356562303533643961343636623863383235383433 + 34633439636663663864636232303164633366626364373830333230346336363761336637343764 + 62633036643534633963373839346335653438663433626665326535303464633435383735383630 + 35643361326366396535326337303961396132346230346536333239323666626365636636326435 + 63393538386234623962346232666262363931643336323666383666643539326563373161656434 + 39653636353632346535 + team_drive_id: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 36343736643764353661393361333134346632303135303832396562656333613036626338636661 + 6335303438663939623931386635333336646332653439310a623439653730346633373031613264 + 36323637666664643332383637666461373638316434633762636131653763393366623061633464 + 6334366336376135380a396233656138303237326565316635616433373061633438396364663165 + 63336634343039646665313833383938303338663934323065383231656235666131 + + - remote_name: jordan-gdrive + client_id: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 35656534356131623134363663623637633638623333653036643632643138353966656361363939 + 3438636231366462663233333531646434333166363439610a643333333766636630626230316436 + 38303133633164353266633338653666663339346662393665336534303265663831666532346461 + 3336666434393563370a393536633232616564323132663363366334303337376264646264323239 + 35343062653131396138626365323539396235383465396234303734623231656432656635653734 + 66316531363833333237373562663062363436626237373464646463613564646565613836363631 + 65656437376631626138323332653033343833636131633036363338646361383236613664383935 + 65376664646136333237 + client_secret: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 37346363333430356563616334383762666330393365343766333238636439336333643535393230 + 3437616365303765376461616662303330613062373732640a343362386631386166363464393733 + 33333164633165346361363331393635323730343463646634646563323937316164643234326233 + 3463323730623064610a646635653764656536346663613734613764323863353938353731303033 + 38666533613137323063646635306364636337336533373132613861393837313037633038313237 + 3436353939633031376139613934323466326330613030326339 + client_auth_token: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 33663639396136356262653233623639663562653330393063616531353932633764363062663961 + 3961636162376237616432393866343832633038373037360a313438353438346134393566343032 + 33323637666235383431333733643763393635353936386437393766373338313132666236376562 + 6230383336653764390a353464303765326130396262613362646165316438306536373361363833 + 31653964613433666435626662356433623236306636303730383132636233626139333333616363 + 32343164363930666236323037326332353861353236613431613431316130663965393061343838 + 34393663633537613137393838323334616333633262393366346633313661373665653039616532 + 63356166616132393330666135613664643864373161366631663065663935646433663666323466 + 39343661646637326230383636336465666333353765653265346661623861613565303133366563 + 61366231363363303266623339666138353036346530646235666263383131623435383661656164 + 63633766663763353435623839386262303165666439353462646133343832313832363630633739 + 39396535623465396561323565323735633933363131356235663534373462303631373939353331 + 30316439653930326164316237383364643561333931653736323362636334313065343732656363 + 30613637393430346433656436623834643831363037633534656561323165663030623032623535 + 33366337336363343533363233323932393835666638306662323830636661303132613131366632 + 38373062316134383137626535633131663961636236663831656261363031663839646135383762 + 30356432626366363665656465306264643238393962643661383062393334333836323666613962 + 35393730323135646365393133333936303235623133303230333930663839396630383739356338 + 31333161623230386264346362383738303238366332333566366564303033366437666435666634 + 61366437386334306438616162666130396565306438643565316462626437313466666561396562 + 30313537393937326238373331313832323664663737313330343263363766326662383735653731 + 30303562363562633138343437623935383339656538623237383435663136363934313962373131 + 37613938616263666163336432653034393637356562303533643961343636623863383235383433 + 34633439636663663864636232303164633366626364373830333230346336363761336637343764 + 62633036643534633963373839346335653438663433626665326535303464633435383735383630 + 35643361326366396535326337303961396132346230346536333239323666626365636636326435 + 63393538386234623962346232666262363931643336323666383666643539326563373161656434 + 39653636353632346535 + team_drive_id: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 36393866646531386133356639633730356463633064636537353335376635303366376534646635 + 6564333233366233383230633038353064663863363361360a366637333435636436353532623039 + 64356339363062373737666133333537633334323139636262386337373438316539356664313835 + 3536613564323934340a343865393263303936393232373734376430633239366161353762313264 + 65316566626132333934646465383432326364633037316563393739343162343062 + + - remote_name: elizabeth-gdrive + client_id: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 35656534356131623134363663623637633638623333653036643632643138353966656361363939 + 3438636231366462663233333531646434333166363439610a643333333766636630626230316436 + 38303133633164353266633338653666663339346662393665336534303265663831666532346461 + 3336666434393563370a393536633232616564323132663363366334303337376264646264323239 + 35343062653131396138626365323539396235383465396234303734623231656432656635653734 + 66316531363833333237373562663062363436626237373464646463613564646565613836363631 + 65656437376631626138323332653033343833636131633036363338646361383236613664383935 + 65376664646136333237 + client_secret: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 37346363333430356563616334383762666330393365343766333238636439336333643535393230 + 3437616365303765376461616662303330613062373732640a343362386631386166363464393733 + 33333164633165346361363331393635323730343463646634646563323937316164643234326233 + 3463323730623064610a646635653764656536346663613734613764323863353938353731303033 + 38666533613137323063646635306364636337336533373132613861393837313037633038313237 + 3436353939633031376139613934323466326330613030326339 + client_auth_token: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 33663639396136356262653233623639663562653330393063616531353932633764363062663961 + 3961636162376237616432393866343832633038373037360a313438353438346134393566343032 + 33323637666235383431333733643763393635353936386437393766373338313132666236376562 + 6230383336653764390a353464303765326130396262613362646165316438306536373361363833 + 31653964613433666435626662356433623236306636303730383132636233626139333333616363 + 32343164363930666236323037326332353861353236613431613431316130663965393061343838 + 34393663633537613137393838323334616333633262393366346633313661373665653039616532 + 63356166616132393330666135613664643864373161366631663065663935646433663666323466 + 39343661646637326230383636336465666333353765653265346661623861613565303133366563 + 61366231363363303266623339666138353036346530646235666263383131623435383661656164 + 63633766663763353435623839386262303165666439353462646133343832313832363630633739 + 39396535623465396561323565323735633933363131356235663534373462303631373939353331 + 30316439653930326164316237383364643561333931653736323362636334313065343732656363 + 30613637393430346433656436623834643831363037633534656561323165663030623032623535 + 33366337336363343533363233323932393835666638306662323830636661303132613131366632 + 38373062316134383137626535633131663961636236663831656261363031663839646135383762 + 30356432626366363665656465306264643238393962643661383062393334333836323666613962 + 35393730323135646365393133333936303235623133303230333930663839396630383739356338 + 31333161623230386264346362383738303238366332333566366564303033366437666435666634 + 61366437386334306438616162666130396565306438643565316462626437313466666561396562 + 30313537393937326238373331313832323664663737313330343263363766326662383735653731 + 30303562363562633138343437623935383339656538623237383435663136363934313962373131 + 37613938616263666163336432653034393637356562303533643961343636623863383235383433 + 34633439636663663864636232303164633366626364373830333230346336363761336637343764 + 62633036643534633963373839346335653438663433626665326535303464633435383735383630 + 35643361326366396535326337303961396132346230346536333239323666626365636636326435 + 63393538386234623962346232666262363931643336323666383666643539326563373161656434 + 39653636353632346535 + team_drive_id: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 61303739653966393033663733306134343738623362643966333831653935643031323835663834 + 6663656466333831653331616662366364626638306665370a663038333439663763363133346631 + 61613463633063653834353066636632643230353738336434656262343464626663653831313638 + 6234623834303536350a643436623139373730616434633263626533373563393861666664346463 + 65653530303939643533383336656634383861663237383633323636396430356137 + +restic_password: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 39346537333832343832363633363638363438393866323162366661643732333734643766393039 + 3465653230373864626562656365613731303739383536350a666238373337333061386264623738 + 34613561666433656663373338343536663062613564353135623530643338656565366666333738 + 3865636531386134330a333438306465303535636538346565333962353665393539313938343165 + 32663830356532373038326662303262633266353766383364636636623330386139 + +backup_name: "new-bark-backup" +restic_repo_url: "rclone:server-gdrive:{{ backup_name }}" +restic_password_file: "/etc/restic/password" +rclone_config_path: "/etc/rclone/rclone.conf" +backup_paths: + - /home + - /etc + - /var/log + - /appdata + - /storage/projects + - /storage/public-assets +keep_daily: 7 +keep_weekly: 4 diff --git a/roles/backup/files/restic-backup.timer b/roles/backup/files/restic-backup.timer new file mode 100644 index 0000000..464509c --- /dev/null +++ b/roles/backup/files/restic-backup.timer @@ -0,0 +1,10 @@ +[Unit] +Description=Run Restic Daily Backup + +[Timer] +OnCalendar=*-*-* 03:00:00 +RandomizedDelaySec=15min +Persistent=true + +[Install] +WantedBy=timers.target diff --git a/roles/backup/files/restic-prune.timer b/roles/backup/files/restic-prune.timer new file mode 100644 index 0000000..8ca72c5 --- /dev/null +++ b/roles/backup/files/restic-prune.timer @@ -0,0 +1,10 @@ +[Unit] +Description=Run Restic Weekly Prune + +[Timer] +OnCalendar=Sun *-*-* 04:00:00 +RandomizedDelaySec=30min +Persistent=true + +[Install] +WantedBy=timers.target diff --git a/roles/backup/handlers/main.yaml b/roles/backup/handlers/main.yaml new file mode 100644 index 0000000..f96f7bc --- /dev/null +++ b/roles/backup/handlers/main.yaml @@ -0,0 +1,15 @@ +- name: Reload systemd Daemon + ansible.builtin.systemd: + daemon_reload: true + become: true + +- name: Enable and start restic timers + ansible.builtin.systemd: + name: "{{ item }}" + enabled: true + state: started + daemon_reload: true + loop: + - restic-backup.timer + - restic-prune.timer + become: true diff --git a/roles/backup/tasks/main.yaml b/roles/backup/tasks/main.yaml new file mode 100644 index 0000000..6992ea8 --- /dev/null +++ b/roles/backup/tasks/main.yaml @@ -0,0 +1,69 @@ +--- + +- name: Install rclone + ansible.builtin.package: + name: rclone + state: present + become: true + +- name: Install restic + ansible.builtin.package: + name: restic + state: present + become: true + +- name: Create rclone config dir + ansible.builtin.file: + path: /etc/rclone + state: directory + mode: "0700" + become: true + +- name: Create rclone.conf + ansible.builtin.template: + src: rclone.conf.j2 + dest: /etc/rclone/rclone.conf + mode: "0700" + become: true + +- name: Create restic dir + ansible.builtin.file: + path: /etc/restic + state: directory + mode: "0600" + become: true + +- name: Create the restic password file + ansible.builtin.copy: + content: "{{ restic_password }}" + dest: "/etc/restic/password" + owner: root + group: root + mode: '0400' + become: true + +- name: Template systemd units for restic + ansible.builtin.template: + src: "{{ item }}.j2" + dest: "/etc/systemd/system/{{ item }}" + owner: root + group: root + mode: '0644' + loop: + - restic-backup.service + - restic-prune.service + become: true + notify: Reload systemd Daemon + +- name: Copy systemd timers + ansible.builtin.copy: + src: "{{ item }}" + dest: "/etc/systemd/system/{{ item }}" + owner: root + group: root + mode: '0644' + loop: + - restic-backup.timer + - restic-prune.timer + become: true + notify: Enable and start restic timers diff --git a/roles/backup/templates/rclone.conf.j2 b/roles/backup/templates/rclone.conf.j2 new file mode 100644 index 0000000..7640918 --- /dev/null +++ b/roles/backup/templates/rclone.conf.j2 @@ -0,0 +1,11 @@ +{% for remote in rclone_remotes %} +[{{ remote.remote_name }}] +type = drive +client_id = {{ remote.client_id }} +client_secret = {{ remote.client_secret }} +scope = drive +token = {{ remote.client_auth_token }} +team_drive = {{ remote.team_drive_id }} +root_folder_id = + +{% endfor %} diff --git a/roles/backup/templates/restic-backup.service.j2 b/roles/backup/templates/restic-backup.service.j2 new file mode 100644 index 0000000..1290c82 --- /dev/null +++ b/roles/backup/templates/restic-backup.service.j2 @@ -0,0 +1,16 @@ +[Unit] +Description=Restic Backup: {{ backup_name }} +After=network-online.target + +[Service] +Type=oneshot +User=root +Environment=RESTIC_REPOSITORY={{ restic_repo_url }} +Environment=RESTIC_PASSWORD_FILE={{ restic_password_file }} +Environment=RCLONE_CONFIG={{ rclone_config_path }} + +# Back up the specified paths +ExecStart=/usr/bin/restic backup {{ backup_paths | join(' ') }} + +# Forget/Prune policy +ExecStartPost=/usr/bin/restic forget --keep-daily {{ keep_daily }} --keep-weekly {{ keep_weekly }} diff --git a/roles/backup/templates/restic-prune.service.j2 b/roles/backup/templates/restic-prune.service.j2 new file mode 100644 index 0000000..0bdba8f --- /dev/null +++ b/roles/backup/templates/restic-prune.service.j2 @@ -0,0 +1,12 @@ +[Unit] +Description=Restic Prune: {{ backup_name }} +After=network-online.target + +[Service] +Type=oneshot +User=root +Environment=RESTIC_REPOSITORY={{ restic_repo_url }} +Environment=RESTIC_PASSWORD_FILE={{ restic_password_file }} +Environment=RCLONE_CONFIG={{ rclone_config_path }} + +ExecStart=/usr/bin/restic prune diff --git a/site.yaml b/site.yaml index 8072154..9eea2a0 100644 --- a/site.yaml +++ b/site.yaml @@ -21,3 +21,11 @@ tags: - gitea - core + +- name: Setup Backups + hosts: all + roles: + - backup + tags: + - common + - backup