borg (wip, failing on install)

.gitignore

@@ -1,3 +1,5 @@
+ansible/playbooks/roles/borgbackup/
+
 ## DebOps project environment
 # See https://docs.debops.org/en/master/user-guide/project-directories.html
 

README.md

@@ -7,11 +7,13 @@
 - [git-crypt](https://www.agwa.name/projects/git-crypt/)
 - [Python](https://python.org/) 3
 - [Poetry](https://python-poetry.org/)
+- [Ansible Galaxy](https://galaxy.ansible.com/)
 
 ### Install packages
 
 ```bash
 poetry install
+ansible-galaxy install -p ansible/playbooks/roles -r ansible/collections/requirements.yml
 ```
 
 ### Guix
@@ -72,6 +74,13 @@ sudo cp /etc/network/interfaces.config.d/* /etc/network/interfaces.d/
 sudo reboot
 ```
 
+### run backups
+
+```sh
+# poetry run debops run borgbackup -l static  # are you root?
+# poetry run debops run borgbackup -l static -e 'ansible_user=root'  # host unreachable
+```
+
 ## scope
 
 Ansible - debops wordt nu gebruikt voor het regelen van o.a.:

ansible/collections/requirements.yml

@@ -0,0 +1,4 @@
+---
+- src: borgbase.ansible_role_borgbackup
+  version: v1.0.1
+  name: borgbackup

ansible/playbooks/borgbackup.yml

@@ -0,0 +1,34 @@
+- hosts: all
+  roles:
+  - role: borgbackup
+    borg_encryption_passphrase: '{{ lookup("password", secret + "/borg/credentials/password length=12") }}'
+    borg_repository:
+      - ssh://kca5r27v@kca5r27v.repo.borgbase.com/./repo
+      # - hetzner
+    borg_source_directories:
+      - /var/www
+    borgmatic_hooks: # hooks
+      before_backup:
+        - echo "`date` - Starting backup."
+      postgresql_databases:
+          # Database name (required if using this hook). Or "all" to dump all databases on the host. (Also set the "format" to dump each database to a separate file instead of one combined file.) Note that using this database hook implicitly enables both read_special and one_file_system (see above) to support dump and restore streaming.
+        - name: all
+          # Database hostname to connect to. Defaults to connecting via local Unix socket.
+          hostname: borg@db.bij1.net
+          # Username with which to connect to the database. Defaults to the username of the current user. You probably want to specify the "postgres" superuser here when the database name is "all".
+          username: postgres
+          # SSL mode to use to connect to the database server. One of "disable", "allow", "prefer", "require", "verify-ca" or "verify-full". Defaults to "disable".
+          ssl_mode: prefer
+          # Database dump output format. One of "plain", "custom", "directory", or "tar". Defaults to "custom" (unlike raw pg_dump) for a single database. Or, when database name is "all" and format is blank, dumps all databases to a single file. But if a format is specified with an "all" database name, dumps each database to a separate file of that format, allowing more convenient restores of individual databases. See the pg_dump documentation for more about formats.
+          format: directory
+    borgmatic_timer: systemd # to avoid clash with debops cron
+    # borg_user: "backupuser"
+    # borg_group: "backupuser"
+    borg_retention_policy: # retention
+      keep_hourly: 3
+      keep_daily: 7
+      keep_weekly: 4
+      keep_monthly: 6
+    borg_exclude_patterns:
+      # Any paths matching these patterns are excluded from backups. Globs and tildes are expanded. Note that a glob pattern must either start with a glob or be an absolute path. Do not backslash spaces in path names. See the output of "borg help patterns" for more details.
+      - "*~"