2026-07-12 12:01:24 -07:00
10 changed files with 423 additions and 0 deletions
@@ -9,3 +9,80 @@ ansible_become_password: !vault |
  31653163653066653561393333343263653732333335633566363136353164666330
 podman_config_base_dir: /home/{{ ansible_user }}/podman
 podman_quadlet_base_dir: "/home/{{ ansible_user }}/.config/containers/systemd"
+
+rclone_remotes:
+  - remote_name: server-gdrive
+    client_id: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          39326465313031353665303231376432333337303261373331663163316666343261313237636237
+          3236393437623731653966636230623432646165653937630a373633363738653662313664636634
+          32376234643637613430383038393533363063336330623631393335636434393531396366636463
+          3130366462356364370a333764343431363365663637393339663962343765363839653837383434
+          39386438363634316131313764333937366535306463323635653534613236333064633435323061
+          31643364313634663037333936373132333335343966373232363136346361363461313532373033
+          38663239383330336238353232636361306530396535363833636632383232613662383334613839
+          36613662636336633762
+    client_secret: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          62343763323438343864633238613435663738393563306663356333313830306662613038363139
+          3663366562633036636136613464653666616333633230320a333438633264313932633763303663
+          66393336393030313739363062623737343534353063633230643264663939323730393564613638
+          3639306334613330340a323363366431383039616566643237386162333234623866326230393063
+          61613231326465353139316166636338383939623034353132656365316339636530393435633034
+          6661636237316238633564373730373031346532396136626130
+    client_auth_token: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          35383162613236346339663135366239316134353133356635363731303032353536663064336335
+          3237633033633336623862616664323730373234373737650a333336326136346637653137316137
+          39333566356432643866663064343435333861646231643962383335643937333330373461636239
+          3333633366323339300a333535386135326631613362366337363264343137313532333563633865
+          34313636356332633265343832376336343765326237386538333439386238666632363432656638
+          63343363353664313030653930306237636363386235626535663532643231343463663161623235
+          33386339346461646337353638346337303233653262373361386563366631366231336266366661
+          61623937346134626661626232383130326432656237663034393062656236663764366263343939
+          34306433303333373566383538386463353164656466633534653563393336356638663338323339
+          36316334653936386331623538623334326139653463343366346166333934383439303538326364
+          39623865343736373364363332616130656162363530366631373032636435353830626539303962
+          62373530343738353131363237663131306334363235653137356430383264396132633466623964
+          61356239636362353036333732656663643435626662633737373939343338376464646262653864
+          39393331353837643938616132666234356161626263623932643038376439356362656539623165
+          32643663346538383635643338376636633864663362323833383161316362653461363663343361
+          65303061306331663132656464343462366533376536323339393339383336313865383865353832
+          61626635353762363334313536313830353930306164316633656263326233373164326138316265
+          65663437323235363734323430393038313432616636326437336339386133643030656464663333
+          66616134636663666565326265633236336434363461333633343335646439653034393538353662
+          34353064653264353064336534393931356638646432363263376430323965383834326232393663
+          33326463363062323431396534313836363030313633356434616239633939626239636330303361
+          37356363346466393936373866333565616639353764363530303862646261626437663231393131
+          66623961663836333637303439376133376133316565343564393032336636353035626632663836
+          35643465336239396332353233373830333161366263313539643733316239333137653230663665
+          30366634346266306636646263323463656538613462363062316238333636663965393831393132
+          66623766616533646132316465333563326462353665643835663933346134393135636362613262
+          63633636313337623439373564386538313130633630386333623831396631386664343635646362
+          32396439333031653930
+    team_drive_id: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          36343736643764353661393361333134346632303135303832396562656333613036626338636661
+          6335303438663939623931386635333336646332653439310a623439653730346633373031613264
+          36323637666664643332383637666461373638316434633762636131653763393366623061633464
+          6334366336376135380a396233656138303237326565316635616433373061633438396364663165
+          63336634343039646665313833383938303338663934323065383231656235666131
+
+restic_password: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          39346537333832343832363633363638363438393866323162366661643732333734643766393039
+          3465653230373864626562656365613731303739383536350a666238373337333061386264623738
+          34613561666433656663373338343536663062613564353135623530643338656565366666333738
+          3865636531386134330a333438306465303535636538346565333962353665393539313938343165
+          32663830356532373038326662303262633266353766383364636636623330386139
+
+backup_name: "goldenrod-backup"
+restic_repo_url: "rclone:server-gdrive:{{ backup_name }}"
+restic_password_file: "/etc/restic/password"
+rclone_config_path: "/etc/rclone/rclone.conf"
+backup_paths:
+  - /home
+  - /etc
+  - /var
+keep_daily: 7
+keep_weekly: 4
@@ -1,4 +1,5 @@
 ---
+
 ansible_user: jdelpilar
 ansible_become_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
@@ -42,3 +43,197 @@ runner_services:
          3631366361653166310a616432386638613461623332383062336566613131353433303337366633
          37663263626532656630646332303532653165653835666362656263616162356137316465336332
          3934303430626561306166393262646139646234333364656237
+
+rclone_remotes:
+  - remote_name: server-gdrive
+    client_id: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          35656534356131623134363663623637633638623333653036643632643138353966656361363939
+          3438636231366462663233333531646434333166363439610a643333333766636630626230316436
+          38303133633164353266633338653666663339346662393665336534303265663831666532346461
+          3336666434393563370a393536633232616564323132663363366334303337376264646264323239
+          35343062653131396138626365323539396235383465396234303734623231656432656635653734
+          66316531363833333237373562663062363436626237373464646463613564646565613836363631
+          65656437376631626138323332653033343833636131633036363338646361383236613664383935
+          65376664646136333237
+    client_secret: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          37346363333430356563616334383762666330393365343766333238636439336333643535393230
+          3437616365303765376461616662303330613062373732640a343362386631386166363464393733
+          33333164633165346361363331393635323730343463646634646563323937316164643234326233
+          3463323730623064610a646635653764656536346663613734613764323863353938353731303033
+          38666533613137323063646635306364636337336533373132613861393837313037633038313237
+          3436353939633031376139613934323466326330613030326339
+    client_auth_token: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          33663639396136356262653233623639663562653330393063616531353932633764363062663961
+          3961636162376237616432393866343832633038373037360a313438353438346134393566343032
+          33323637666235383431333733643763393635353936386437393766373338313132666236376562
+          6230383336653764390a353464303765326130396262613362646165316438306536373361363833
+          31653964613433666435626662356433623236306636303730383132636233626139333333616363
+          32343164363930666236323037326332353861353236613431613431316130663965393061343838
+          34393663633537613137393838323334616333633262393366346633313661373665653039616532
+          63356166616132393330666135613664643864373161366631663065663935646433663666323466
+          39343661646637326230383636336465666333353765653265346661623861613565303133366563
+          61366231363363303266623339666138353036346530646235666263383131623435383661656164
+          63633766663763353435623839386262303165666439353462646133343832313832363630633739
+          39396535623465396561323565323735633933363131356235663534373462303631373939353331
+          30316439653930326164316237383364643561333931653736323362636334313065343732656363
+          30613637393430346433656436623834643831363037633534656561323165663030623032623535
+          33366337336363343533363233323932393835666638306662323830636661303132613131366632
+          38373062316134383137626535633131663961636236663831656261363031663839646135383762
+          30356432626366363665656465306264643238393962643661383062393334333836323666613962
+          35393730323135646365393133333936303235623133303230333930663839396630383739356338
+          31333161623230386264346362383738303238366332333566366564303033366437666435666634
+          61366437386334306438616162666130396565306438643565316462626437313466666561396562
+          30313537393937326238373331313832323664663737313330343263363766326662383735653731
+          30303562363562633138343437623935383339656538623237383435663136363934313962373131
+          37613938616263666163336432653034393637356562303533643961343636623863383235383433
+          34633439636663663864636232303164633366626364373830333230346336363761336637343764
+          62633036643534633963373839346335653438663433626665326535303464633435383735383630
+          35643361326366396535326337303961396132346230346536333239323666626365636636326435
+          63393538386234623962346232666262363931643336323666383666643539326563373161656434
+          39653636353632346535
+    team_drive_id: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          36343736643764353661393361333134346632303135303832396562656333613036626338636661
+          6335303438663939623931386635333336646332653439310a623439653730346633373031613264
+          36323637666664643332383637666461373638316434633762636131653763393366623061633464
+          6334366336376135380a396233656138303237326565316635616433373061633438396364663165
+          63336634343039646665313833383938303338663934323065383231656235666131
+
+  - remote_name: jordan-gdrive
+    client_id: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          35656534356131623134363663623637633638623333653036643632643138353966656361363939
+          3438636231366462663233333531646434333166363439610a643333333766636630626230316436
+          38303133633164353266633338653666663339346662393665336534303265663831666532346461
+          3336666434393563370a393536633232616564323132663363366334303337376264646264323239
+          35343062653131396138626365323539396235383465396234303734623231656432656635653734
+          66316531363833333237373562663062363436626237373464646463613564646565613836363631
+          65656437376631626138323332653033343833636131633036363338646361383236613664383935
+          65376664646136333237
+    client_secret: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          37346363333430356563616334383762666330393365343766333238636439336333643535393230
+          3437616365303765376461616662303330613062373732640a343362386631386166363464393733
+          33333164633165346361363331393635323730343463646634646563323937316164643234326233
+          3463323730623064610a646635653764656536346663613734613764323863353938353731303033
+          38666533613137323063646635306364636337336533373132613861393837313037633038313237
+          3436353939633031376139613934323466326330613030326339
+    client_auth_token: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          33663639396136356262653233623639663562653330393063616531353932633764363062663961
+          3961636162376237616432393866343832633038373037360a313438353438346134393566343032
+          33323637666235383431333733643763393635353936386437393766373338313132666236376562
+          6230383336653764390a353464303765326130396262613362646165316438306536373361363833
+          31653964613433666435626662356433623236306636303730383132636233626139333333616363
+          32343164363930666236323037326332353861353236613431613431316130663965393061343838
+          34393663633537613137393838323334616333633262393366346633313661373665653039616532
+          63356166616132393330666135613664643864373161366631663065663935646433663666323466
+          39343661646637326230383636336465666333353765653265346661623861613565303133366563
+          61366231363363303266623339666138353036346530646235666263383131623435383661656164
+          63633766663763353435623839386262303165666439353462646133343832313832363630633739
+          39396535623465396561323565323735633933363131356235663534373462303631373939353331
+          30316439653930326164316237383364643561333931653736323362636334313065343732656363
+          30613637393430346433656436623834643831363037633534656561323165663030623032623535
+          33366337336363343533363233323932393835666638306662323830636661303132613131366632
+          38373062316134383137626535633131663961636236663831656261363031663839646135383762
+          30356432626366363665656465306264643238393962643661383062393334333836323666613962
+          35393730323135646365393133333936303235623133303230333930663839396630383739356338
+          31333161623230386264346362383738303238366332333566366564303033366437666435666634
+          61366437386334306438616162666130396565306438643565316462626437313466666561396562
+          30313537393937326238373331313832323664663737313330343263363766326662383735653731
+          30303562363562633138343437623935383339656538623237383435663136363934313962373131
+          37613938616263666163336432653034393637356562303533643961343636623863383235383433
+          34633439636663663864636232303164633366626364373830333230346336363761336637343764
+          62633036643534633963373839346335653438663433626665326535303464633435383735383630
+          35643361326366396535326337303961396132346230346536333239323666626365636636326435
+          63393538386234623962346232666262363931643336323666383666643539326563373161656434
+          39653636353632346535
+    team_drive_id: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          36393866646531386133356639633730356463633064636537353335376635303366376534646635
+          6564333233366233383230633038353064663863363361360a366637333435636436353532623039
+          64356339363062373737666133333537633334323139636262386337373438316539356664313835
+          3536613564323934340a343865393263303936393232373734376430633239366161353762313264
+          65316566626132333934646465383432326364633037316563393739343162343062
+
+  - remote_name: elizabeth-gdrive
+    client_id: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          35656534356131623134363663623637633638623333653036643632643138353966656361363939
+          3438636231366462663233333531646434333166363439610a643333333766636630626230316436
+          38303133633164353266633338653666663339346662393665336534303265663831666532346461
+          3336666434393563370a393536633232616564323132663363366334303337376264646264323239
+          35343062653131396138626365323539396235383465396234303734623231656432656635653734
+          66316531363833333237373562663062363436626237373464646463613564646565613836363631
+          65656437376631626138323332653033343833636131633036363338646361383236613664383935
+          65376664646136333237
+    client_secret: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          37346363333430356563616334383762666330393365343766333238636439336333643535393230
+          3437616365303765376461616662303330613062373732640a343362386631386166363464393733
+          33333164633165346361363331393635323730343463646634646563323937316164643234326233
+          3463323730623064610a646635653764656536346663613734613764323863353938353731303033
+          38666533613137323063646635306364636337336533373132613861393837313037633038313237
+          3436353939633031376139613934323466326330613030326339
+    client_auth_token: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          33663639396136356262653233623639663562653330393063616531353932633764363062663961
+          3961636162376237616432393866343832633038373037360a313438353438346134393566343032
+          33323637666235383431333733643763393635353936386437393766373338313132666236376562
+          6230383336653764390a353464303765326130396262613362646165316438306536373361363833
+          31653964613433666435626662356433623236306636303730383132636233626139333333616363
+          32343164363930666236323037326332353861353236613431613431316130663965393061343838
+          34393663633537613137393838323334616333633262393366346633313661373665653039616532
+          63356166616132393330666135613664643864373161366631663065663935646433663666323466
+          39343661646637326230383636336465666333353765653265346661623861613565303133366563
+          61366231363363303266623339666138353036346530646235666263383131623435383661656164
+          63633766663763353435623839386262303165666439353462646133343832313832363630633739
+          39396535623465396561323565323735633933363131356235663534373462303631373939353331
+          30316439653930326164316237383364643561333931653736323362636334313065343732656363
+          30613637393430346433656436623834643831363037633534656561323165663030623032623535
+          33366337336363343533363233323932393835666638306662323830636661303132613131366632
+          38373062316134383137626535633131663961636236663831656261363031663839646135383762
+          30356432626366363665656465306264643238393962643661383062393334333836323666613962
+          35393730323135646365393133333936303235623133303230333930663839396630383739356338
+          31333161623230386264346362383738303238366332333566366564303033366437666435666634
+          61366437386334306438616162666130396565306438643565316462626437313466666561396562
+          30313537393937326238373331313832323664663737313330343263363766326662383735653731
+          30303562363562633138343437623935383339656538623237383435663136363934313962373131
+          37613938616263666163336432653034393637356562303533643961343636623863383235383433
+          34633439636663663864636232303164633366626364373830333230346336363761336637343764
+          62633036643534633963373839346335653438663433626665326535303464633435383735383630
+          35643361326366396535326337303961396132346230346536333239323666626365636636326435
+          63393538386234623962346232666262363931643336323666383666643539326563373161656434
+          39653636353632346535
+    team_drive_id: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          61303739653966393033663733306134343738623362643966333831653935643031323835663834
+          6663656466333831653331616662366364626638306665370a663038333439663763363133346631
+          61613463633063653834353066636632643230353738336434656262343464626663653831313638
+          6234623834303536350a643436623139373730616434633263626533373563393861666664346463
+          65653530303939643533383336656634383861663237383633323636396430356137
+
+restic_password: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          39346537333832343832363633363638363438393866323162366661643732333734643766393039
+          3465653230373864626562656365613731303739383536350a666238373337333061386264623738
+          34613561666433656663373338343536663062613564353135623530643338656565366666333738
+          3865636531386134330a333438306465303535636538346565333962353665393539313938343165
+          32663830356532373038326662303262633266353766383364636636623330386139
+
+backup_name: "new-bark-backup"
+restic_repo_url: "rclone:server-gdrive:{{ backup_name }}"
+restic_password_file: "/etc/restic/password"
+rclone_config_path: "/etc/rclone/rclone.conf"
+backup_paths:
+  - /home
+  - /etc
+  - /var/log
+  - /appdata
+  - /storage/projects
+  - /storage/public-assets
+keep_daily: 7
+keep_weekly: 4
@@ -0,0 +1,10 @@
+[Unit]
+Description=Run Restic Daily Backup
+
+[Timer]
+OnCalendar=*-*-* 03:00:00
+RandomizedDelaySec=15min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,10 @@
+[Unit]
+Description=Run Restic Weekly Prune
+
+[Timer]
+OnCalendar=Sun *-*-* 04:00:00
+RandomizedDelaySec=30min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
@@ -0,0 +1,15 @@
+- name: Reload systemd Daemon
+  ansible.builtin.systemd:
+    daemon_reload: true
+  become: true
+
+- name: Enable and start restic timers
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+    daemon_reload: true
+  loop:
+    - restic-backup.timer
+    - restic-prune.timer
+  become: true
@@ -0,0 +1,69 @@
+---
+
+- name: Install rclone
+  ansible.builtin.package:
+    name: rclone
+    state: present
+  become: true
+
+- name: Install restic
+  ansible.builtin.package:
+    name: restic
+    state: present
+  become: true
+
+- name: Create rclone config dir
+  ansible.builtin.file:
+    path: /etc/rclone
+    state: directory
+    mode: "0700"
+  become: true
+
+- name: Create rclone.conf
+  ansible.builtin.template:
+    src: rclone.conf.j2
+    dest: /etc/rclone/rclone.conf
+    mode: "0700"
+  become: true
+
+- name: Create restic dir
+  ansible.builtin.file:
+    path: /etc/restic
+    state: directory
+    mode: "0600"
+  become: true
+
+- name: Create the restic password file
+  ansible.builtin.copy:
+    content: "{{ restic_password }}"
+    dest: "/etc/restic/password"
+    owner: root
+    group: root
+    mode: '0400'
+  become: true
+
+- name: Template systemd units for restic
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: '0644'
+  loop:
+    - restic-backup.service
+    - restic-prune.service
+  become: true
+  notify: Reload systemd Daemon
+
+- name: Copy systemd timers
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
+    owner: root
+    group: root
+    mode: '0644'
+  loop:
+    - restic-backup.timer
+    - restic-prune.timer
+  become: true
+  notify: Enable and start restic timers
@@ -0,0 +1,11 @@
+{% for remote in rclone_remotes %}
+[{{ remote.remote_name }}]
+type = drive
+client_id = {{ remote.client_id }}
+client_secret = {{ remote.client_secret }}
+scope = drive
+token = {{ remote.client_auth_token }}
+team_drive = {{ remote.team_drive_id }}
+root_folder_id = 
+
+{% endfor %}
@@ -0,0 +1,16 @@
+[Unit]
+Description=Restic Backup: {{ backup_name }}
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+Environment=RESTIC_REPOSITORY={{ restic_repo_url }}
+Environment=RESTIC_PASSWORD_FILE={{ restic_password_file }}
+Environment=RCLONE_CONFIG={{ rclone_config_path }}
+
+# Back up the specified paths
+ExecStart=/usr/bin/restic backup {{ backup_paths | join(' ') }}
+
+# Forget/Prune policy
+ExecStartPost=/usr/bin/restic forget --keep-daily {{ keep_daily }} --keep-weekly {{ keep_weekly }}
@@ -0,0 +1,12 @@
+[Unit]
+Description=Restic Prune: {{ backup_name }}
+After=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+Environment=RESTIC_REPOSITORY={{ restic_repo_url }}
+Environment=RESTIC_PASSWORD_FILE={{ restic_password_file }}
+Environment=RCLONE_CONFIG={{ rclone_config_path }}
+
+ExecStart=/usr/bin/restic prune
@@ -21,3 +21,11 @@
  tags:
    - gitea
    - core
+
+- name: Setup Backups
+  hosts: all
+  roles:
+    - backup
+  tags:
+    - common
+    - backup