age backups everywhere

ansible/services/vaultwarden/setup_backup_vaultwarden.yml

@@ -0,0 +1,25 @@
+---
+# Vaultwarden backup: dumps locally on vipy, encrypted with age.
+# Previously rsynced to lapy in the CLEAR; the artefact now never exists
+# unencrypted, on disk or on the wire.
+- name: Configure the Vaultwarden backup on the edge host
+  hosts: edge
+  become: yes
+  vars_files:
+    - ../../group_vars/all/main.yml
+    - ./vaultwarden_vars.yml
+
+  tasks:
+    - name: Ensure Vaultwarden dumps itself, encrypted, on a timer
+      ansible.builtin.include_role:
+        name: backup_source
+      vars:
+        backup_source_name: vaultwarden
+        backup_source_description: "Vaultwarden"
+        backup_source_dump_command: "tar -czf - -C / opt/vaultwarden/data"
+        # Not systemd — a docker compose stack — so stop/start explicitly.
+        # sqlite in WAL mode, hence stopping at all.
+        backup_source_stop_command: "docker compose -f /opt/vaultwarden/docker-compose.yml stop"
+        backup_source_start_command: "docker compose -f /opt/vaultwarden/docker-compose.yml start"
+        backup_source_retention_days: 7
+        backup_source_on_calendar: "*-*-* 02:10:00"