ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
10 lines
396 B
Django/Jinja
10 lines
396 B
Django/Jinja
#!/usr/bin/env bash
|
|
# Cron wrapper — sources the deployed env file and runs the real backup script, logging to
|
|
# syslog (visible via journalctl and shipped to Loki by promtail like every other unit) in
|
|
# addition to whatever cron itself captures.
|
|
set -euo pipefail
|
|
set -a
|
|
source /etc/rootnode/backup.env
|
|
set +a
|
|
exec /opt/rootnode/backup/backup-postgres.sh 2>&1 | systemd-cat -t rootnode-backup
|