age backups everywhere

ansible/services/forgejo/setup_backup_forgejo.yml

@@ -0,0 +1,25 @@
+---
+# Forgejo backup: dumps locally on vipy, encrypted with age.
+#
+# The biggest artefact in the estate (~2.7 G) and the reason retention here is
+# short: 7 days locally would be 19 G of vipy's 36 G free. The box keeps 14.
+# Forgejo is sqlite3 (DB_TYPE in app.ini), so it is stopped for the dump — the
+# old job did the same.
+- name: Configure the Forgejo backup on the edge host
+  hosts: edge
+  become: yes
+  vars_files:
+    - ../../group_vars/all/main.yml
+    - ./forgejo_vars.yml
+
+  tasks:
+    - name: Ensure Forgejo dumps itself, encrypted, on a timer
+      ansible.builtin.include_role:
+        name: backup_source
+      vars:
+        backup_source_name: forgejo
+        backup_source_description: "Forgejo"
+        backup_source_dump_command: "tar -czf - -C / var/lib/forgejo etc/forgejo"
+        backup_source_stop_service: forgejo
+        backup_source_retention_days: 2
+        backup_source_on_calendar: "*-*-* 02:30:00"

ansible/services/lnbits/setup_backup_lnbits.yml

@@ -0,0 +1,25 @@
+---
+# LNBits backup: dumps locally on vipy, encrypted with age.
+# The old job produced TWO gpg artefacts (data, then .env separately). They are
+# folded into one tar here so the wallet database and the .env that configures
+# it are always the same point in time; two artefacts written by two runs can
+# drift. Pulling one file back out needs no unpacking:
+#   age -d -i <identity> <artefact> | tar -xzO opt/lnbits/lnbits/.env
+- name: Configure the LNBits backup on the edge host
+  hosts: edge
+  become: yes
+  vars_files:
+    - ../../group_vars/all/main.yml
+    - ./lnbits_vars.yml
+
+  tasks:
+    - name: Ensure LNBits dumps itself, encrypted, on a timer
+      ansible.builtin.include_role:
+        name: backup_source
+      vars:
+        backup_source_name: lnbits
+        backup_source_description: "LNBits"
+        backup_source_dump_command: "tar -czf - -C / opt/lnbits/data opt/lnbits/lnbits/.env"
+        backup_source_stop_service: lnbits
+        backup_source_retention_days: 7
+        backup_source_on_calendar: "*-*-* 02:20:00"

ansible/services/memos/setup_backup_memos.yml

@@ -0,0 +1,26 @@
+---
+# Memos backup: dumps locally on memos-box, encrypted with age.
+# Replaces the lapy pull, which had been writing EMPTY directories since
+# 2025-12-27 — its script hardcoded 192.168.1.130, which DHCP later reassigned
+# to a different machine that has no rsync.
+- name: Configure the Memos backup on its own host
+  hosts: memos
+  become: yes
+  vars_files:
+    - ../../group_vars/all/main.yml
+    - ./memos_vars.yml
+
+  tasks:
+    - name: Ensure Memos dumps itself, encrypted, on a timer
+      ansible.builtin.include_role:
+        name: backup_source
+      vars:
+        backup_source_name: memos
+        backup_source_description: "Memos"
+        backup_source_dump_command: "tar -czf - -C / var/lib/memos"
+        # sqlite in WAL mode: stopping checkpoints the WAL, so the artefact is a
+        # consistent database rather than a torn mid-write copy. The old rsync
+        # job did not stop it.
+        backup_source_stop_service: memos
+        backup_source_retention_days: 7
+        backup_source_on_calendar: "*-*-* 02:00:00"

ansible/services/vaultwarden/setup_backup_vaultwarden.yml

@@ -0,0 +1,25 @@
+---
+# Vaultwarden backup: dumps locally on vipy, encrypted with age.
+# Previously rsynced to lapy in the CLEAR; the artefact now never exists
+# unencrypted, on disk or on the wire.
+- name: Configure the Vaultwarden backup on the edge host
+  hosts: edge
+  become: yes
+  vars_files:
+    - ../../group_vars/all/main.yml
+    - ./vaultwarden_vars.yml
+
+  tasks:
+    - name: Ensure Vaultwarden dumps itself, encrypted, on a timer
+      ansible.builtin.include_role:
+        name: backup_source
+      vars:
+        backup_source_name: vaultwarden
+        backup_source_description: "Vaultwarden"
+        backup_source_dump_command: "tar -czf - -C / opt/vaultwarden/data"
+        # Not systemd — a docker compose stack — so stop/start explicitly.
+        # sqlite in WAL mode, hence stopping at all.
+        backup_source_stop_command: "docker compose -f /opt/vaultwarden/docker-compose.yml stop"
+        backup_source_start_command: "docker compose -f /opt/vaultwarden/docker-compose.yml start"
+        backup_source_retention_days: 7
+        backup_source_on_calendar: "*-*-* 02:10:00"