S37: Ansible backup role + rclone template
- SHA
3ab6f7d9b495b15bd2d6ca87ac9b1c040b3f89c8- Parents
-
c22a906 - Tree
f1a80bf
tenseleyflow/shithub
/
3ab6f7d
Browse files
2 changed files
| Status | File | + | - |
|---|---|---|---|
| A |
deploy/ansible/roles/backup/tasks/main.yml
|
39 | 0 |
| A |
deploy/ansible/roles/backup/templates/rclone.conf.j2
|
19 | 0 |
deploy/ansible/roles/backup/tasks/main.ymladded@@ -0,0 +1,39 @@ | ||
| 1 | +--- | |
| 2 | +# SPDX-License-Identifier: AGPL-3.0-or-later | |
| 3 | +# Logical backup cron + cross-region Spaces sync. The actual scripts | |
| 4 | +# live under deploy/postgres/ and deploy/spaces/ so they can be | |
| 5 | +# read/edited without booting Ansible. | |
| 6 | + | |
| 7 | +- name: Backup scripts — install | |
| 8 | + copy: | |
| 9 | + src: "{{ playbook_dir }}/../{{ item.src }}" | |
| 10 | + dest: "{{ item.dest }}" | |
| 11 | + mode: "0755" | |
| 12 | + loop: | |
| 13 | + - { src: postgres/backup-daily.sh, dest: /usr/local/bin/shithub-backup-daily } | |
| 14 | + - { src: spaces/sync-cross-region.sh, dest: /usr/local/bin/shithub-spaces-sync } | |
| 15 | + | |
| 16 | +- name: rclone config dir | |
| 17 | + file: | |
| 18 | + path: /root/.config/rclone | |
| 19 | + state: directory | |
| 20 | + mode: "0700" | |
| 21 | + | |
| 22 | +- name: rclone config — Spaces credentials | |
| 23 | + template: | |
| 24 | + src: rclone.conf.j2 | |
| 25 | + dest: /root/.config/rclone/rclone.conf | |
| 26 | + mode: "0600" | |
| 27 | + | |
| 28 | +- name: cron — daily logical backup | |
| 29 | + cron: | |
| 30 | + name: shithub-backup-daily | |
| 31 | + job: /usr/local/bin/shithub-backup-daily >> /var/log/shithub-backup.log 2>&1 | |
| 32 | + minute: "17" | |
| 33 | + hour: "3" | |
| 34 | + | |
| 35 | +- name: cron — hourly cross-region sync | |
| 36 | + cron: | |
| 37 | + name: shithub-spaces-sync | |
| 38 | + job: /usr/local/bin/shithub-spaces-sync >> /var/log/shithub-spaces-sync.log 2>&1 | |
| 39 | + minute: "23" | |
deploy/ansible/roles/backup/templates/rclone.conf.j2added@@ -0,0 +1,19 @@ | ||
| 1 | +# Managed by Ansible. | |
| 2 | +# Two remotes: primary (where shithubd writes) and dr (cross-region | |
| 3 | +# backup target). Sync runs hourly via cron. | |
| 4 | + | |
| 5 | +[spaces-prod] | |
| 6 | +type = s3 | |
| 7 | +provider = DigitalOcean | |
| 8 | +access_key_id = {{ spaces_prod_access_key }} | |
| 9 | +secret_access_key = {{ spaces_prod_secret_key }} | |
| 10 | +endpoint = {{ spaces_prod_endpoint }} | |
| 11 | +acl = private | |
| 12 | + | |
| 13 | +[spaces-dr] | |
| 14 | +type = s3 | |
| 15 | +provider = DigitalOcean | |
| 16 | +access_key_id = {{ spaces_dr_access_key }} | |
| 17 | +secret_access_key = {{ spaces_dr_secret_key }} | |
| 18 | +endpoint = {{ spaces_dr_endpoint }} | |
| 19 | +acl = private | |