age backups everywhere

ansible/services/memos/setup_backup_memos.yml

@@ -0,0 +1,26 @@
+---
+# Memos backup: dumps locally on memos-box, encrypted with age.
+# Replaces the lapy pull, which had been writing EMPTY directories since
+# 2025-12-27 — its script hardcoded 192.168.1.130, which DHCP later reassigned
+# to a different machine that has no rsync.
+- name: Configure the Memos backup on its own host
+  hosts: memos
+  become: yes
+  vars_files:
+    - ../../group_vars/all/main.yml
+    - ./memos_vars.yml
+
+  tasks:
+    - name: Ensure Memos dumps itself, encrypted, on a timer
+      ansible.builtin.include_role:
+        name: backup_source
+      vars:
+        backup_source_name: memos
+        backup_source_description: "Memos"
+        backup_source_dump_command: "tar -czf - -C / var/lib/memos"
+        # sqlite in WAL mode: stopping checkpoints the WAL, so the artefact is a
+        # consistent database rather than a torn mid-write copy. The old rsync
+        # job did not stop it.
+        backup_source_stop_service: memos
+        backup_source_retention_days: 7
+        backup_source_on_calendar: "*-*-* 02:00:00"