Dustin C. Hatch
0f4dea9007
The `restic.yml` playbook applies the _restic_ role to hosts in the _restic_ group. The _restic_ role installs `restic` and creates a systemd timer and service unit to run `restic backup` every day. Restic doesn't really have a configuration file; all its settings are controlled either by environment variables or command-line options. Some options, such as the list of files to include in or exclude from backups, take paths to files containing the values. We can make use of these to provide some configurability via Ansible variables. The `restic_env` variable is a map of environment variables and values to set for `restic`. The `restic_include` and `restic_exclude` variables are lists of paths/patterns to include and exclude, respectively. Finally, the `restic_password` variable contains the password to decrypt the repository contents. The password is written to a file and exposed to the _restic-backup.service_ unit using [systemd credentials][0]. When using S3 or a compatible service for respository storage, Restic of course needs authentication credentials. These can be set using the `restic_aws_credentials` variable. If this variable is defined, it should be a map containing the`aws_access_key_id` and `aws_secret_access_key` keys, which will be written to an AWS shared credentials file. This file is then exposed to the _restic-backup.service_ unit using [systemd credentials][0]. [0]: https://systemd.io/CREDENTIALS/
107 lines
2.0 KiB
YAML
107 lines
2.0 KiB
YAML
- name: ensure restic is installed
|
|
package:
|
|
name: restic
|
|
state: present
|
|
tags:
|
|
- install
|
|
|
|
- name: ensure restic configuration directory exists
|
|
file:
|
|
path: /etc/restic
|
|
owner: root
|
|
group: root
|
|
mode: u=rwx,go=rx
|
|
state: directory
|
|
tags:
|
|
- config
|
|
|
|
- name: ensure restic environment is configured
|
|
template:
|
|
src: restic.env.j2
|
|
dest: /etc/restic/environment
|
|
owner: root
|
|
group: root
|
|
mode: u=rw,go=r
|
|
tags:
|
|
- config
|
|
- restic-environment
|
|
- name: ensure restic file list is populated
|
|
template:
|
|
src: include.j2
|
|
dest: /etc/restic/include
|
|
owner: root
|
|
group: root
|
|
mode: u=rw,go=r
|
|
tags:
|
|
- config
|
|
- restic-include
|
|
- name: ensure restic exclude list is populated
|
|
template:
|
|
src: exclude.j2
|
|
dest: /etc/restic/exclude
|
|
owner: root
|
|
group: root
|
|
mode: u=rw,go=r
|
|
tags:
|
|
- config
|
|
- restic-exclude
|
|
|
|
- name: ensure restic password is set
|
|
copy:
|
|
content: >-
|
|
{{ restic_password }}
|
|
dest: /etc/credstore/restic.password
|
|
owner: root
|
|
group: root
|
|
mode: a=
|
|
diff: false
|
|
tags:
|
|
- config
|
|
- credentials
|
|
- name: ensure restic aws credentials are set
|
|
template:
|
|
src: credentials.j2
|
|
dest: /etc/credstore/restic.aws.credentials
|
|
owner: root
|
|
group: root
|
|
mode: a=
|
|
diff: false
|
|
tags:
|
|
- config
|
|
- credentials
|
|
|
|
- name: ensure restic-backup systemd service unit is installed
|
|
copy:
|
|
src: restic-backup.service
|
|
dest: /etc/systemd/system/restic-backup.service
|
|
owner: root
|
|
group: root
|
|
mode: u=rw,go=r
|
|
tags:
|
|
- systemd
|
|
notify:
|
|
- reload systemd
|
|
- restart restic backup timer
|
|
- name: ensure restic-backup systemd timer unit is installed
|
|
copy:
|
|
src: restic-backup.timer
|
|
dest: /etc/systemd/system/restic-backup.timer
|
|
owner: root
|
|
group: root
|
|
mode: u=rw,go=r
|
|
tags:
|
|
- systemd
|
|
|
|
- name: ensure restic-backup timer is enabled
|
|
systemd:
|
|
name: restic-backup.timer
|
|
enabled: true
|
|
tags:
|
|
- service
|
|
- name: ensure restic-backup timer is running
|
|
systemd:
|
|
name: restic-backup.timer
|
|
state: started
|
|
tags:
|
|
- service
|