56 lines
1.6 KiB
YAML
56 lines
1.6 KiB
YAML
# daily DB dumps into {{ backup_dump_dir }}
|
|
# read-only rsync access for the backup host's pull key (user `backup`)
|
|
- name: Resolve the backup pull public key from the backup host
|
|
when: aurbis_backup_pubkey is not defined
|
|
block:
|
|
- name: Read the pull public key
|
|
slurp:
|
|
src: "{{ hostvars[groups['backup'][0]].backup_key_path }}.pub"
|
|
delegate_to: "{{ groups['backup'][0] }}"
|
|
register: _pull_pubkey
|
|
- name: Set the pull pubkey fact
|
|
set_fact:
|
|
aurbis_backup_pubkey: "{{ _pull_pubkey.content | b64decode | trim }}"
|
|
|
|
- name: Install database dump script
|
|
template:
|
|
src: "backup/aurbis-dump-{{ inventory_hostname }}.sh.j2"
|
|
dest: /usr/local/bin/aurbis-dump
|
|
mode: "0750"
|
|
|
|
- name: Install dump service and timer
|
|
copy:
|
|
src: "backup/{{ item }}"
|
|
dest: /etc/systemd/system/
|
|
mode: "0644"
|
|
with_items:
|
|
- aurbis-dump.service
|
|
- aurbis-dump.timer
|
|
|
|
- name: Enable dump timer
|
|
systemd:
|
|
name: aurbis-dump.timer
|
|
enabled: yes
|
|
state: started
|
|
daemon_reload: yes
|
|
|
|
- name: Install read-only rsync wrapper for the backup user
|
|
copy:
|
|
src: backup/backup-rsync-shell
|
|
dest: /usr/local/bin/backup-rsync-shell
|
|
mode: "0755"
|
|
|
|
- name: Allow backup user to run read-only rsync as root
|
|
community.general.sudoers:
|
|
name: backup-rsync
|
|
state: present
|
|
user: backup
|
|
commands: /usr/bin/rsync --server --sender *
|
|
|
|
- name: Authorize the backup host's pull key (forced read-only rsync)
|
|
ansible.posix.authorized_key:
|
|
user: backup
|
|
state: present
|
|
key: "{{ aurbis_backup_pubkey }}"
|
|
key_options: 'command="/usr/local/bin/backup-rsync-shell",restrict'
|