Akatosh

tasks/backup_source.yml

@@ -0,0 +1,55 @@
+# daily DB dumps into {{ backup_dump_dir }}
+# read-only rsync access for the backup host's pull key (user `backup`)
+- name: Resolve the backup pull public key from the backup host
+  when: aurbis_backup_pubkey is not defined
+  block:
+    - name: Read the pull public key
+      slurp:
+        src: "{{ hostvars[groups['backup'][0]].backup_key_path }}.pub"
+      delegate_to: "{{ groups['backup'][0] }}"
+      register: _pull_pubkey
+    - name: Set the pull pubkey fact
+      set_fact:
+        aurbis_backup_pubkey: "{{ _pull_pubkey.content | b64decode | trim }}"
+
+- name: Install database dump script
+  template:
+    src: "backup/aurbis-dump-{{ inventory_hostname }}.sh.j2"
+    dest: /usr/local/bin/aurbis-dump
+    mode: "0750"
+
+- name: Install dump service and timer
+  copy:
+    src: "backup/{{ item }}"
+    dest: /etc/systemd/system/
+    mode: "0644"
+  with_items:
+    - aurbis-dump.service
+    - aurbis-dump.timer
+
+- name: Enable dump timer
+  systemd:
+    name: aurbis-dump.timer
+    enabled: yes
+    state: started
+    daemon_reload: yes
+
+- name: Install read-only rsync wrapper for the backup user
+  copy:
+    src: backup/backup-rsync-shell
+    dest: /usr/local/bin/backup-rsync-shell
+    mode: "0755"
+
+- name: Allow backup user to run read-only rsync as root
+  community.general.sudoers:
+    name: backup-rsync
+    state: present
+    user: backup
+    commands: /usr/bin/rsync --server --sender *
+
+- name: Authorize the backup host's pull key (forced read-only rsync)
+  ansible.posix.authorized_key:
+    user: backup
+    state: present
+    key: "{{ aurbis_backup_pubkey }}"
+    key_options: 'command="/usr/local/bin/backup-rsync-shell",restrict'