---
# Deploys the backup script + a daily cron job on rn-platform-01. The script itself
# (infra/backup/backup-postgres.sh) is identical to what infra/backup/test-backup-restore.sh
# exercises locally — same code path, just pointed at real production values here.

- name: Install postgresql-client + gpg (backup script dependencies)
  ansible.builtin.apt:
    name: [postgresql-client, gnupg]
    state: present

- name: Create backup directories
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: "0700"
  loop:
    - /opt/rootnode/backup
    - "{{ rootnode_data_root }}/backups"

- name: Deploy backup script
  ansible.builtin.copy:
    src: "{{ role_path }}/../../../backup/backup-postgres.sh"
    dest: /opt/rootnode/backup/backup-postgres.sh
    mode: "0750"

- name: Deploy restore + verify scripts (not run by cron, kept alongside for the runbook)
  ansible.builtin.copy:
    src: "{{ role_path }}/../../../backup/{{ item }}"
    dest: "/opt/rootnode/backup/{{ item }}"
    mode: "0750"
  loop:
    - restore-postgres.sh
    - verify-restore.sh

- name: Deploy the backup env file (PLATFORM_DB_URL, encryption passphrase, offsite target)
  ansible.builtin.template:
    src: backup.env.j2
    dest: /etc/rootnode/backup.env
    owner: root
    group: root
    mode: "0600"

- name: Deploy cron wrapper (sources the env file, writes to syslog too)
  ansible.builtin.template:
    src: run-backup.sh.j2
    dest: /opt/rootnode/backup/run-backup.sh
    mode: "0750"

- name: Install daily backup cron job
  ansible.builtin.cron:
    name: rootnode-postgres-backup
    user: root
    minute: "15"
    hour: "3"
    job: /opt/rootnode/backup/run-backup.sh

- name: Ensure node-exporter's textfile collector directory exists (backup metrics land here)
  ansible.builtin.file:
    path: /var/lib/node-exporter/textfile
    state: directory
    mode: "0755"