ced4568
507ac4c5d3
common/firewall/docker-tls/platform/lab-host/monitoring-agent/backup roles, orchestrated by site.yml with the ordering that matters (firewall/TLS land before the services that depend on them). Ansible Vault for secrets, no new tool introduced for this project's modest secret surface. Explicit dev/staging/production environment separation, no secrets committed (.gitignore covers vault plaintext, TLS keys, Terraform state, *.env). Validated: ansible-playbook --syntax-check clean.
64 lines
1.9 KiB
YAML
64 lines
1.9 KiB
YAML
---
|
|
# Deploys the backup script + a daily cron job on rn-platform-01. The script itself
|
|
# (infra/backup/backup-postgres.sh) is identical to what infra/backup/test-backup-restore.sh
|
|
# exercises locally — same code path, just pointed at real production values here.
|
|
|
|
- name: Install postgresql-client + gpg (backup script dependencies)
|
|
ansible.builtin.apt:
|
|
name: [postgresql-client, gnupg]
|
|
state: present
|
|
|
|
- name: Create backup directories
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
loop:
|
|
- /opt/rootnode/backup
|
|
- "{{ rootnode_data_root }}/backups"
|
|
|
|
- name: Deploy backup script
|
|
ansible.builtin.copy:
|
|
src: "{{ role_path }}/../../../backup/backup-postgres.sh"
|
|
dest: /opt/rootnode/backup/backup-postgres.sh
|
|
mode: "0750"
|
|
|
|
- name: Deploy restore + verify scripts (not run by cron, kept alongside for the runbook)
|
|
ansible.builtin.copy:
|
|
src: "{{ role_path }}/../../../backup/{{ item }}"
|
|
dest: "/opt/rootnode/backup/{{ item }}"
|
|
mode: "0750"
|
|
loop:
|
|
- restore-postgres.sh
|
|
- verify-restore.sh
|
|
|
|
- name: Deploy the backup env file (PLATFORM_DB_URL, encryption passphrase, offsite target)
|
|
ansible.builtin.template:
|
|
src: backup.env.j2
|
|
dest: /etc/rootnode/backup.env
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
|
|
- name: Deploy cron wrapper (sources the env file, writes to syslog too)
|
|
ansible.builtin.template:
|
|
src: run-backup.sh.j2
|
|
dest: /opt/rootnode/backup/run-backup.sh
|
|
mode: "0750"
|
|
|
|
- name: Install daily backup cron job
|
|
ansible.builtin.cron:
|
|
name: rootnode-postgres-backup
|
|
user: root
|
|
minute: "15"
|
|
hour: "3"
|
|
job: /opt/rootnode/backup/run-backup.sh
|
|
|
|
- name: Ensure node-exporter's textfile collector directory exists (backup metrics land here)
|
|
ansible.builtin.file:
|
|
path: /var/lib/node-exporter/textfile
|
|
state: directory
|
|
mode: "0755"
|