age backups everywhere

ansible/services/lnbits/setup_backup_lnbits.yml

@@ -0,0 +1,25 @@
+---
+# LNBits backup: dumps locally on vipy, encrypted with age.
+# The old job produced TWO gpg artefacts (data, then .env separately). They are
+# folded into one tar here so the wallet database and the .env that configures
+# it are always the same point in time; two artefacts written by two runs can
+# drift. Pulling one file back out needs no unpacking:
+#   age -d -i <identity> <artefact> | tar -xzO opt/lnbits/lnbits/.env
+- name: Configure the LNBits backup on the edge host
+  hosts: edge
+  become: yes
+  vars_files:
+    - ../../group_vars/all/main.yml
+    - ./lnbits_vars.yml
+
+  tasks:
+    - name: Ensure LNBits dumps itself, encrypted, on a timer
+      ansible.builtin.include_role:
+        name: backup_source
+      vars:
+        backup_source_name: lnbits
+        backup_source_description: "LNBits"
+        backup_source_dump_command: "tar -czf - -C / opt/lnbits/data opt/lnbits/lnbits/.env"
+        backup_source_stop_service: lnbits
+        backup_source_retention_days: 7
+        backup_source_on_calendar: "*-*-* 02:20:00"