personal_infra/ansible/roles/backup_store/tasks/main.yml

---
- name: Assert backup_store sources are sane
  ansible.builtin.assert:
    that:
      - backup_store_sources | length > 0
      - backup_store_sources | map(attribute='name') | list | length == backup_store_sources | length
      - backup_store_sources | map(attribute='source') | list | length == backup_store_sources | length
      - backup_store_sources | map(attribute='retention_days') | list | length == backup_store_sources | length
    fail_msg: "backup_store: every source needs name, source and retention_days"
    quiet: true

- name: Ensure rsync is installed
  ansible.builtin.apt:
    name: rsync
    state: present
    update_cache: yes
    cache_valid_time: 3600
  become: yes

- name: Ensure the backup store directory exists
  ansible.builtin.file:
    path: "{{ backup_store_dir }}"
    state: directory
    mode: '0700'

- name: Install the pull-backups script
  ansible.builtin.template:
    src: pull-backups.sh.j2
    dest: /usr/local/bin/pull-backups.sh
    owner: root
    group: root
    mode: '0755'
    validate: "bash -n %s"
  become: yes

# An assertion that last night actually worked. Generated from the same source
# list as the puller, so it can never drift out of sync with what is supposed to
# be arriving. Runs on a timer AND is useful by hand.
- name: Install the backup check script
  ansible.builtin.template:
    src: check-backups.sh.j2
    dest: /usr/local/bin/check-backups.sh
    owner: root
    group: root
    mode: '0755'
    validate: "bash -n %s"
  become: yes

# The .service carries the push token, so it is 0600; the .timer is not secret.
- name: Install the check-backups systemd units
  ansible.builtin.template:
    src: "check-backups.{{ item.unit }}.j2"
    dest: "/etc/systemd/system/check-backups.{{ item.unit }}"
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop:
    - {unit: service, mode: "0600"}
    - {unit: timer,   mode: "0644"}
  become: yes

# restarted, not started: `started` is a no-op on an already-active timer, so a
# changed schedule would never be picked up.
- name: Enable the check-backups timer
  ansible.builtin.systemd:
    name: check-backups.timer
    enabled: yes
    state: restarted
    daemon_reload: yes
  become: yes

- name: Install the pull-backups systemd units
  ansible.builtin.template:
    src: "pull-backups.{{ item }}.j2"
    dest: "/etc/systemd/system/pull-backups.{{ item }}"
    owner: root
    group: root
    mode: '0644'
  loop: [service, timer]
  become: yes
  notify: Reload systemd for pull-backups

- name: Enable the pull-backups timer
  ansible.builtin.systemd:
    name: pull-backups.timer
    enabled: yes
    state: started
    daemon_reload: yes
  become: yes