backup stuff

ansible/services/headscale/setup_backup_headscale.yml

@@ -0,0 +1,21 @@
+---
+- name: Configure the Headscale backup on the vpn_control host
+  hosts: vpn_control
+  become: yes
+  vars_files:
+    - ../../group_vars/all/main.yml
+    - ./headscale_vars.yml
+
+  tasks:
+    - name: Ensure Headscale dumps itself, encrypted, on a timer
+      ansible.builtin.include_role:
+        name: backup_source
+      vars:
+        backup_source_name: headscale
+        backup_source_description: "Headscale"
+        # -C / with relative paths: avoids tar's "removing leading /" and makes
+        # the restore target explicit.
+        backup_source_dump_command: "tar -czf - -C / var/lib/headscale etc/headscale"
+        backup_source_stop_service: headscale
+        backup_source_retention_days: 7
+        backup_source_on_calendar: "*-*-* 02:00:00"