blob: eb6c9a1b29fe244ff9258a4d37e5233a447012a7 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
---
- name: Create SSH Directory
ansible.builtin.file:
path: /root/.ssh
owner: root
group: root
mode: '0640'
state: directory
become: true
- name: Add borg server to known_hosts
ansible.builtin.known_hosts:
name: '{{ borg_server_host_url }}'
key: '{{ borg_server_host_url }} {{ borg_server_host_ssh_key }}'
path: /root/.ssh/known_hosts
state: present
become: true
- name: Generate SSH keys
community.crypto.openssh_keypair:
path: /root/.ssh/id_rsa
owner: root
group: root
mode: '0600'
comment: root@{{ inventory_hostname }}
become: true
register: ssh_key
- name: Deploy Keys to Borg server
ansible.builtin.lineinfile:
path: '{{ borg_server_user_home }}/.ssh/authorized_keys'
line: >
restrict,command="borg serve
{{ "--append-only" if borg_mode_append_only }}
--restrict-to-repository {{ borg_repo_name }}"
{{ ssh_key.public_key }} root@{{ inventory_hostname }}
search_string: '{{ ssh_key.public_key }}'
state: present
become: true
delegate_to: '{{ borg_server_host }}'
- name: Initialise Borg repository
ansible.builtin.command: >
borg init --encryption=repokey
borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
environment:
BORG_PASSPHRASE: '{{ borg_passphrase }}'
become: true
register: init_borg_output
changed_when: init_borg_output.rc != 2
failed_when:
- init_borg_output.rc != 2
- init_borg_output.rc != 0
- name: Make sure key file exists
ansible.builtin.file:
path: '{{ borg_decryption_keys_yaml_path }}'
state: touch
mode: '0600'
access_time: preserve
modification_time: preserve
delegate_to: localhost
become: false
- name: Read Vars file
ansible.builtin.include_vars:
file: '{{ borg_decryption_keys_yaml_path }}'
register: local
- name: Add repository encryption keys to ansible repo
when: not inventory_hostname in local.ansible_facts
throttle: 1
block:
- name: If host new read encryption keys
ansible.builtin.command: >
borg key export --paper
borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
become: true
register: borg_keys
changed_when: borg_keys.rc != 0
- name: If host new add encryption keys to vars
ansible.builtin.set_fact:
decryption_keys: '{{ local.ansible_facts | combine({inventory_hostname: borg_keys.stdout}) }}'
- name: Update encryption vars
ansible.builtin.copy:
content: '{{ decryption_keys | to_nice_yaml(indent=2, width=2048) }}'
dest: '{{ borg_decryption_keys_yaml_path }}'
mode: '0600'
when: decryption_keys is defined
delegate_to: localhost
become: false
- name: Create backup scripts
ansible.builtin.include_tasks: client_create_scripts_each.yml
loop:
- '{{ borg_backup_script_location }}'
- '{{ borg_backup_script_location }}{{ "@" if borg_backup_argument != "" }}{{ borg_backup_argument }}'
loop_control:
loop_var: script_location
- name: Configure systemd borg_backup service
ansible.builtin.template:
src: borg_backup.service.j2
dest: /etc/systemd/system/{{ borg_backup_timer_name }}{{ "@" if borg_backup_argument != "" }}{{ borg_backup_argument }}.service
mode: '0644'
owner: root
group: root
notify: Reload systemd
become: true
- name: Configure systemd borg_backup timer
ansible.builtin.template:
src: borg_backup.timer.j2
dest: /etc/systemd/system/{{ borg_backup_timer_name }}{{ "@" if borg_backup_argument != "" }}{{ borg_backup_argument }}.timer
mode: '0644'
owner: root
group: root
notify: Reload systemd
become: true
- name: Reload systemd now before enabling services
ansible.builtin.meta: flush_handlers
- name: Enable borg_backup systemd timer
ansible.builtin.systemd:
name: '{{ borg_backup_timer_name }}{{ "@" if borg_backup_argument != "" }}{{ borg_backup_argument }}.timer'
state: started
enabled: true
become: true
|
