Dustin C. Hatch
0f4dea9007
The `restic.yml` playbook applies the _restic_ role to hosts in the _restic_ group. The _restic_ role installs `restic` and creates a systemd timer and service unit to run `restic backup` every day. Restic doesn't really have a configuration file; all its settings are controlled either by environment variables or command-line options. Some options, such as the list of files to include in or exclude from backups, take paths to files containing the values. We can make use of these to provide some configurability via Ansible variables. The `restic_env` variable is a map of environment variables and values to set for `restic`. The `restic_include` and `restic_exclude` variables are lists of paths/patterns to include and exclude, respectively. Finally, the `restic_password` variable contains the password to decrypt the repository contents. The password is written to a file and exposed to the _restic-backup.service_ unit using [systemd credentials][0]. When using S3 or a compatible service for respository storage, Restic of course needs authentication credentials. These can be set using the `restic_aws_credentials` variable. If this variable is defined, it should be a map containing the`aws_access_key_id` and `aws_secret_access_key` keys, which will be written to an AWS shared credentials file. This file is then exposed to the _restic-backup.service_ unit using [systemd credentials][0]. [0]: https://systemd.io/CREDENTIALS/
23 lines
1.3 KiB
YAML
23 lines
1.3 KiB
YAML
restic_env:
|
|
RESTIC_REPOSITORY: s3:s3.backups.pyrocufflink.blue/restic
|
|
restic_password: !vault |
|
|
$ANSIBLE_VAULT;1.1;AES256
|
|
62663336623030623165636439326337623638303633356564376136323338363532363837326138
|
|
3037613363383238346661336437663464363735323664340a393764343230353938383730633934
|
|
32616434303834636236663835663233356431306665613331613433353531373266323430663463
|
|
3935343335663837390a663961623764316236653234393333663533383638666230356362303432
|
|
65626335306165326262393763306533393430356134623666646339353663326137353236383464
|
|
32376366363239666636323734343864313231363765303537313464646464623666373939306131
|
|
33343265383636313938306630386164656163663463653731666364633261333230303565326231
|
|
39306636373331633764
|
|
restic_aws_credentials:
|
|
aws_access_key_id: qVjUcNjwrISvDVXbkFMZ
|
|
aws_secret_access_key: !vault |
|
|
$ANSIBLE_VAULT;1.1;AES256
|
|
62303466353962396236626337323839303836386465636231643463363662343033353564616336
|
|
3138316166363333663531616561346134376666373830610a633535333134323733653834616332
|
|
33623230343933323532633831326633343931633438313037633634646563653730386131373831
|
|
6639313765373262650a323138346161376138396536623632636663356532616136336166303861
|
|
37643566346231333531623131633763323433313834643566373061366164663430623562623331
|
|
3462396662383536386535373263666631393835343534393561
|