clean up old backing up

ansible/inventory.ini

@@ -19,7 +19,7 @@ nonkeiwaisi_local ansible_host=nonkeiwaisi-box lan_ip=192.168.1.151 ansible_user
 
 # Local connection to laptop: this assumes you're running ansible commands from your personal laptop
 [lapy]
-localhost ansible_connection=local ansible_user=counterweight gpg_recipient=counterweightoperator@protonmail.com gpg_key_id=883EDBAA726BD96C
+localhost ansible_connection=local ansible_user=counterweight
 
 [arbret]
 prd-arbret ansible_host=167.99.242.62 ansible_user=counterweight ansible_port=22 ansible_ssh_private_key_file=~/.ssh/counterganzua

ansible/services/forgejo/forgejo_vars.yml

@@ -18,6 +18,3 @@ remote_user: "{{ hostvars.get(remote_host_name, {}).get('ansible_user', 'counter
 remote_key_file: "{{ hostvars.get(remote_host_name, {}).get('ansible_ssh_private_key_file', '') }}"
 remote_port: "{{ hostvars.get(remote_host_name, {}).get('ansible_port', 22) }}"
 
-# Local backup
-local_backup_dir: "{{ lookup('env', 'HOME') }}/forgejo-backups"
-backup_script_path: "{{ lookup('env', 'HOME') }}/.local/bin/forgejo_backup.sh"

ansible/services/forgejo/setup_backup_forgejo_to_lapy.yml

@@ -1,122 +0,0 @@
----
-- name: Configure local backup for Forgejo from remote
-  hosts: control
-  gather_facts: no
-  vars_files:
-    - ../../infra_vars.yml
-    - ./forgejo_vars.yml
-  vars:
-    remote_data_path: "{{ forgejo_data_dir }}"
-    remote_config_path: "{{ forgejo_config_dir }}"
-    forgejo_service_name: "forgejo"
-    gpg_recipient: "{{ hostvars['localhost']['gpg_recipient'] | default('') }}"
-    gpg_key_id: "{{ hostvars['localhost']['gpg_key_id'] | default('') }}"
-
-  tasks:
-    - name: Debug Forgejo backup vars
-      debug:
-        msg:
-          - "remote_host={{ remote_host }}"
-          - "remote_user={{ remote_user }}"
-          - "remote_data_path='{{ remote_data_path }}'"
-          - "remote_config_path='{{ remote_config_path }}'"
-          - "local_backup_dir={{ local_backup_dir }}"
-          - "gpg_recipient={{ gpg_recipient }}"
-          - "gpg_key_id={{ gpg_key_id }}"
-
-    - name: Ensure local backup directory exists
-      ansible.builtin.file:
-        path: "{{ local_backup_dir }}"
-        state: directory
-        mode: "0755"
-
-    - name: Ensure ~/.local/bin exists
-      ansible.builtin.file:
-        path: "{{ lookup('env', 'HOME') }}/.local/bin"
-        state: directory
-        mode: "0755"
-
-    - name: Create Forgejo backup script
-      ansible.builtin.copy:
-        dest: "{{ backup_script_path }}"
-        mode: "0750"
-        content: |
-          #!/bin/bash
-          set -euo pipefail
-
-          if [ -z "{{ gpg_recipient }}" ]; then
-            echo "GPG recipient is not configured. Aborting."
-            exit 1
-          fi
-
-          TIMESTAMP=$(date +'%Y-%m-%d')
-          ENCRYPTED_BACKUP="{{ local_backup_dir }}/forgejo-backup-$TIMESTAMP.tar.gz.gpg"
-
-          {% if remote_key_file %}
-          SSH_CMD="ssh -i {{ remote_key_file }} -p {{ remote_port }}"
-          {% else %}
-          SSH_CMD="ssh -p {{ remote_port }}"
-          {% endif %}
-
-          echo "Stopping Forgejo service..."
-          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo systemctl stop {{ forgejo_service_name }}"
-
-          echo "Creating encrypted backup archive..."
-          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo tar -czf - {{ remote_data_path }} {{ remote_config_path }}" | \
-          gpg --batch --yes --encrypt --recipient "{{ gpg_recipient }}" --output "$ENCRYPTED_BACKUP"
-
-          echo "Starting Forgejo service..."
-          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo systemctl start {{ forgejo_service_name }}"
-
-          # Rotate old backups (keep 3 days)
-          # Calculate cutoff date (3 days ago) and delete backups older than that
-          CUTOFF_DATE=$(date -d '3 days ago' +'%Y-%m-%d')
-          for backup_file in "{{ local_backup_dir }}"/forgejo-backup-*.tar.gz.gpg; do
-            if [ -f "$backup_file" ]; then
-              # Extract date from filename: forgejo-backup-YYYY-MM-DD.tar.gz.gpg
-              file_date=$(basename "$backup_file" | sed -n 's/forgejo-backup-\([0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}\)\.tar\.gz\.gpg/\1/p')
-              if [ -n "$file_date" ] && [ "$file_date" != "$TIMESTAMP" ] && [ "$file_date" \< "$CUTOFF_DATE" ]; then
-                rm -f "$backup_file"
-              fi
-            fi
-          done
-
-          echo "Backup completed successfully"
-
-    - name: Ensure cronjob for Forgejo backup exists
-      ansible.builtin.cron:
-        name: "Forgejo backup"
-        user: "{{ lookup('env', 'USER') }}"
-        job: "{{ backup_script_path }}"
-        minute: 5
-        hour: "9,12,15,18"
-
-    - name: Run Forgejo backup script to create initial backup
-      ansible.builtin.command: "{{ backup_script_path }}"
-
-    - name: Verify backup was created
-      block:
-        - name: Get today's date
-          command: date +'%Y-%m-%d'
-          register: today_date
-          changed_when: false
-
-        - name: Check if backup file exists
-          stat:
-            path: "{{ local_backup_dir }}/forgejo-backup-{{ today_date.stdout }}.tar.gz.gpg"
-          register: backup_file_stat
-
-        - name: Verify backup file exists
-          assert:
-            that:
-              - backup_file_stat.stat.exists
-              - backup_file_stat.stat.isreg
-            fail_msg: "Backup file {{ local_backup_dir }}/forgejo-backup-{{ today_date.stdout }}.tar.gz.gpg was not created"
-            success_msg: "Backup file {{ local_backup_dir }}/forgejo-backup-{{ today_date.stdout }}.tar.gz.gpg exists"
-
-        - name: Verify backup file is not empty
-          assert:
-            that:
-              - backup_file_stat.stat.size > 0
-            fail_msg: "Backup file {{ local_backup_dir }}/forgejo-backup-{{ today_date.stdout }}.tar.gz.gpg exists but is empty"
-            success_msg: "Backup file size is {{ backup_file_stat.stat.size }} bytes"

ansible/services/headscale/headscale_vars.yml

@@ -19,9 +19,5 @@ remote_user: "{{ hostvars.get(remote_host_name, {}).get('ansible_user', 'counter
 remote_key_file: "{{ hostvars.get(remote_host_name, {}).get('ansible_ssh_private_key_file', '') }}"
 remote_port: "{{ hostvars.get(remote_host_name, {}).get('ansible_port', 22) }}"
 
-# Local backup
-local_backup_dir: "{{ lookup('env', 'HOME') }}/headscale-backups"
-backup_script_path: "{{ lookup('env', 'HOME') }}/.local/bin/headscale_backup.sh"
-
 # Headplane (headscale admin UI), proxied at /admin* behind Caddy basic auth
 headplane_port: 3000

ansible/services/headscale/setup_backup_headscale_to_lapy.yml

@@ -1,75 +0,0 @@
-- name: Configure local backup for Headscale from remote
-  hosts: control
-  gather_facts: no
-  vars_files:
-    - ../../infra_vars.yml
-    - ./headscale_vars.yml
-  vars:
-    remote_data_path: "{{ headscale_data_dir }}"
-    remote_config_path: "/etc/headscale"
-
-  tasks:
-    - name: Debug remote backup vars
-      debug:
-        msg:
-          - "remote_host={{ remote_host }}"
-          - "remote_user={{ remote_user }}"
-          - "remote_data_path='{{ remote_data_path }}'"
-          - "remote_config_path='{{ remote_config_path }}'"
-          - "local_backup_dir={{ local_backup_dir }}"
-
-    - name: Ensure local backup directory exists
-      file:
-        path: "{{ local_backup_dir }}"
-        state: directory
-        mode: '0755'
-
-    - name: Ensure ~/.local/bin exists
-      file:
-        path: "{{ lookup('env', 'HOME') }}/.local/bin"
-        state: directory
-        mode: '0755'
-
-    - name: Create backup script
-      copy:
-        dest: "{{ backup_script_path }}"
-        mode: '0750'
-        content: |
-          #!/bin/bash
-          set -euo pipefail
-
-          TIMESTAMP=$(date +'%Y-%m-%d')
-          BACKUP_DIR="{{ local_backup_dir }}/$TIMESTAMP"
-          mkdir -p "$BACKUP_DIR"
-
-          {% if remote_key_file %}
-          SSH_CMD="ssh -i {{ remote_key_file }} -p {{ remote_port }}"
-          {% else %}
-          SSH_CMD="ssh -p {{ remote_port }}"
-          {% endif %}
-
-          # Stop headscale service for consistent backup
-          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo systemctl stop headscale"
-
-          # Backup data directory
-          rsync -az -e "$SSH_CMD" --delete {{ remote_user }}@{{ remote_host }}:{{ remote_data_path }}/ "$BACKUP_DIR/data/"
-
-          # Backup config directory
-          rsync -az -e "$SSH_CMD" --delete {{ remote_user }}@{{ remote_host }}:{{ remote_config_path }}/ "$BACKUP_DIR/config/"
-
-          # Start headscale service again
-          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo systemctl start headscale"
-
-          # Rotate old backups (keep 14 days)
-          find "{{ local_backup_dir }}" -maxdepth 1 -type d -name '20*' -mtime +13 -exec rm -rf {} \;
-
-    - name: Ensure cronjob for backup exists
-      cron:
-        name: "Headscale backup"
-        user: "{{ lookup('env', 'USER') }}"
-        job: "{{ backup_script_path }}"
-        minute: 5
-        hour: "9,12,15,18"
-
-    - name: Run the backup script to make the first backup
-      command: "{{ backup_script_path }}"

ansible/services/lnbits/lnbits_vars.yml

@@ -12,6 +12,3 @@ remote_user: "{{ hostvars.get(remote_host_name, {}).get('ansible_user', 'counter
 remote_key_file: "{{ hostvars.get(remote_host_name, {}).get('ansible_ssh_private_key_file', '') }}"
 remote_port: "{{ hostvars.get(remote_host_name, {}).get('ansible_port', 22) }}"
 
-# Local backup
-local_backup_dir: "{{ lookup('env', 'HOME') }}/lnbits-backups"
-backup_script_path: "{{ lookup('env', 'HOME') }}/.local/bin/lnbits_backup.sh"

ansible/services/lnbits/setup_backup_lnbits_to_lapy.yml

@@ -1,104 +0,0 @@
-- name: Configure local backup for LNBits from remote
-  hosts: control
-  gather_facts: no
-  vars_files:
-    - ../../infra_vars.yml
-    - ./lnbits_vars.yml
-  vars:
-    remote_data_path: "{{ lnbits_data_dir }}"
-    remote_lnbits_dir: "{{ lnbits_dir }}/lnbits"
-    gpg_recipient: "{{ hostvars['localhost']['gpg_recipient'] | default('') }}"
-    gpg_key_id: "{{ hostvars['localhost']['gpg_key_id'] | default('') }}"
-
-  tasks:
-    - name: Debug remote backup vars
-      debug:
-        msg:
-          - "remote_host={{ remote_host }}"
-          - "remote_user={{ remote_user }}"
-          - "remote_data_path='{{ remote_data_path }}'"
-          - "local_backup_dir={{ local_backup_dir }}"
-          - "gpg_recipient={{ gpg_recipient }}"
-          - "gpg_key_id={{ gpg_key_id }}"
-
-    - name: Ensure local backup directory exists
-      file:
-        path: "{{ local_backup_dir }}"
-        state: directory
-        mode: '0755'
-
-    - name: Ensure ~/.local/bin exists
-      file:
-        path: "{{ lookup('env', 'HOME') }}/.local/bin"
-        state: directory
-        mode: '0755'
-
-    - name: Create backup script
-      copy:
-        dest: "{{ backup_script_path }}"
-        mode: '0750'
-        content: |
-          #!/bin/bash
-          set -euo pipefail
-
-          TIMESTAMP=$(date +'%Y-%m-%d')
-          ENCRYPTED_BACKUP="{{ local_backup_dir }}/lnbits-backup-$TIMESTAMP.tar.gz.gpg"
-
-          {% if remote_key_file %}
-          SSH_CMD="ssh -i {{ remote_key_file }} -p {{ remote_port }}"
-          {% else %}
-          SSH_CMD="ssh -p {{ remote_port }}"
-          {% endif %}
-
-          # Stop LNBits service before backup
-          echo "Stopping LNBits service..."
-          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo systemctl stop lnbits.service"
-
-          # Create encrypted backup on the fly
-          # First, create a tar archive of the data directory and pipe it through gpg
-          echo "Creating backup..."
-          $SSH_CMD {{ remote_user }}@{{ remote_host }} "cd {{ remote_data_path }} && tar -czf - ." | \
-          gpg --batch --yes --encrypt --recipient "{{ gpg_recipient }}" --output "$ENCRYPTED_BACKUP"
-
-          # Also backup the .env file separately (smaller, might need quick access)
-          $SSH_CMD {{ remote_user }}@{{ remote_host }} "cat {{ remote_lnbits_dir }}/.env" | \
-          gpg --batch --yes --encrypt --recipient "{{ gpg_recipient }}" --output "{{ local_backup_dir }}/lnbits-env-$TIMESTAMP.gpg"
-
-          # Start LNBits service after backup
-          echo "Starting LNBits service..."
-          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo systemctl start lnbits.service"
-
-          # Rotate old backups (keep 14 days)
-          # Calculate cutoff date (14 days ago) and delete backups older than that
-          CUTOFF_DATE=$(date -d '14 days ago' +'%Y-%m-%d')
-          for backup_file in "{{ local_backup_dir }}"/lnbits-backup-*.tar.gz.gpg; do
-            if [ -f "$backup_file" ]; then
-              # Extract date from filename: lnbits-backup-YYYY-MM-DD.tar.gz.gpg
-              file_date=$(basename "$backup_file" | sed -n 's/lnbits-backup-\([0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}\)\.tar\.gz\.gpg/\1/p')
-              if [ -n "$file_date" ] && [ "$file_date" != "$TIMESTAMP" ] && [ "$file_date" \< "$CUTOFF_DATE" ]; then
-                rm -f "$backup_file"
-              fi
-            fi
-          done
-          for env_file in "{{ local_backup_dir }}"/lnbits-env-*.gpg; do
-            if [ -f "$env_file" ]; then
-              # Extract date from filename: lnbits-env-YYYY-MM-DD.gpg
-              file_date=$(basename "$env_file" | sed -n 's/lnbits-env-\([0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}\)\.gpg/\1/p')
-              if [ -n "$file_date" ] && [ "$file_date" != "$TIMESTAMP" ] && [ "$file_date" \< "$CUTOFF_DATE" ]; then
-                rm -f "$env_file"
-              fi
-            fi
-          done
-
-          echo "Backup completed successfully"
-
-    - name: Ensure cronjob for backup exists
-      cron:
-        name: "LNBits backup"
-        user: "{{ lookup('env', 'USER') }}"
-        job: "{{ backup_script_path }}"
-        minute: 5
-        hour: "9,12,15,18"
-
-    - name: Run the backup script to make the first backup
-      command: "{{ backup_script_path }}"

ansible/services/memos/memos_vars.yml

@@ -15,12 +15,4 @@ memos_tailscale_ip: "100.64.0.4"
 # (caddy_sites_dir and subdomain in services_config.yml)
 
 # Remote access (for backup from lapy via Tailscale)
-backup_host: "{{ memos_tailscale_hostname }}"
-backup_user: "counterweight"
-backup_key_file: "~/.ssh/counterganzua"
-backup_port: 22
-
-# Local backup
-local_backup_dir: "{{ lookup('env', 'HOME') }}/memos-backups"
-backup_script_path: "{{ lookup('env', 'HOME') }}/.local/bin/memos_backup.sh"
 

ansible/services/memos/setup_backup_memos_to_lapy.yml

@@ -1,106 +0,0 @@
-- name: Configure local backup for Memos from memos-box
-  hosts: control
-  gather_facts: no
-  vars_files:
-    - ../../infra_vars.yml
-    - ./memos_vars.yml
-  vars:
-    backup_data_path: "{{ memos_data_dir }}"
-
-  tasks:
-    - name: Debug remote backup vars
-      debug:
-        msg:
-          - "backup_host={{ backup_host }}"
-          - "backup_user={{ backup_user }}"
-          - "backup_data_path='{{ backup_data_path }}'"
-          - "local_backup_dir={{ local_backup_dir }}"
-
-    - name: Ensure local backup directory exists
-      file:
-        path: "{{ local_backup_dir }}"
-        state: directory
-        mode: '0755'
-
-    - name: Ensure ~/.local/bin exists
-      file:
-        path: "{{ lookup('env', 'HOME') }}/.local/bin"
-        state: directory
-        mode: '0755'
-
-    - name: Create backup script
-      copy:
-        dest: "{{ backup_script_path }}"
-        mode: '0750'
-        content: |
-          #!/bin/bash
-          set -euo pipefail
-
-          TIMESTAMP=$(date +'%Y-%m-%d')
-          BACKUP_DIR="{{ local_backup_dir }}/$TIMESTAMP"
-          mkdir -p "$BACKUP_DIR"
-
-          {% if backup_key_file %}
-          SSH_CMD="ssh -i {{ backup_key_file }} -p {{ backup_port }}"
-          {% else %}
-          SSH_CMD="ssh -p {{ backup_port }}"
-          {% endif %}
-
-          rsync -az -e "$SSH_CMD" --rsync-path="sudo rsync" --delete {{ backup_user }}@{{ backup_host }}:{{ backup_data_path }}/ "$BACKUP_DIR/"
-
-          # Rotate old backups (keep 14 days)
-          # Calculate cutoff date (14 days ago) and delete backups older than that
-          CUTOFF_DATE=$(date -d '14 days ago' +'%Y-%m-%d')
-          for dir in "{{ local_backup_dir }}"/20*; do
-            if [ -d "$dir" ]; then
-              dir_date=$(basename "$dir")
-              if [ "$dir_date" != "$TIMESTAMP" ] && [ "$dir_date" \< "$CUTOFF_DATE" ]; then
-                rm -rf "$dir"
-              fi
-            fi
-          done
-
-    - name: Ensure cronjob for backup exists
-      cron:
-        name: "Memos backup"
-        user: "{{ lookup('env', 'USER') }}"
-        job: "{{ backup_script_path }}"
-        minute: 15
-        hour: "9,12,15,18"
-
-    - name: Run the backup script to make the first backup
-      command: "{{ backup_script_path }}"
-
-    - name: Verify backup was created
-      block:
-        - name: Get today's date
-          command: date +'%Y-%m-%d'
-          register: today_date
-          changed_when: false
-
-        - name: Check backup directory exists and contains files
-          stat:
-            path: "{{ local_backup_dir }}/{{ today_date.stdout }}"
-          register: backup_dir_stat
-
-        - name: Verify backup directory exists
-          assert:
-            that:
-              - backup_dir_stat.stat.exists
-              - backup_dir_stat.stat.isdir
-            fail_msg: "Backup directory {{ local_backup_dir }}/{{ today_date.stdout }} was not created"
-            success_msg: "Backup directory {{ local_backup_dir }}/{{ today_date.stdout }} exists"
-
-        - name: Check if backup directory contains files
-          find:
-            paths: "{{ local_backup_dir }}/{{ today_date.stdout }}"
-            recurse: yes
-          register: backup_files
-
-        - name: Verify backup directory is not empty
-          assert:
-            that:
-              - backup_files.files | length > 0
-            fail_msg: "Backup directory {{ local_backup_dir }}/{{ today_date.stdout }} exists but is empty"
-            success_msg: "Backup directory contains {{ backup_files.files | length }} file(s)"
-

ansible/services/phoenixd/phoenixd_vars.yml

@@ -47,6 +47,3 @@ remote_user: "{{ hostvars.get(remote_host_name, {}).get('ansible_user', 'counter
 remote_key_file: "{{ hostvars.get(remote_host_name, {}).get('ansible_ssh_private_key_file', '') }}"
 remote_port: "{{ hostvars.get(remote_host_name, {}).get('ansible_port', 22) }}"
 
-# Local backup
-local_backup_dir: "{{ lookup('env', 'HOME') }}/phoenixd-backups"
-backup_script_path: "{{ lookup('env', 'HOME') }}/.local/bin/phoenixd_backup.sh"

ansible/services/phoenixd/setup_backup_phoenixd_to_lapy.yml

@@ -1,136 +0,0 @@
----
-# Backs up the phoenixd seed and config from vipy to Lapy, gpg encrypted.
-#
-# Only seed.dat and phoenix.conf are backed up, on purpose:
-#   - seed.dat is what actually recovers the funds. phoenixd keeps its channel
-#     state with the ACINQ peer, so a wallet is restored from the seed alone.
-#   - restoring a *stale* channel database to a running Lightning node is
-#     dangerous (it can trigger a force close and a penalty), so we do not keep
-#     copies of phoenix.db around to be tempted by.
-#   - phoenix.conf holds the http api password, which is what LNBits and any
-#     other local consumer authenticate with.
-#
-# Because both files are static, phoenixd does not need to be stopped.
-
-- name: Configure local backup for phoenixd from remote
-  hosts: control
-  gather_facts: no
-  vars_files:
-    - ../../infra_vars.yml
-    - ./phoenixd_vars.yml
-  vars:
-    remote_data_path: "{{ phoenixd_data_dir }}"
-    gpg_recipient: "{{ hostvars['localhost']['gpg_recipient'] | default('') }}"
-    gpg_key_id: "{{ hostvars['localhost']['gpg_key_id'] | default('') }}"
-
-  tasks:
-    - name: Debug phoenixd backup vars
-      debug:
-        msg:
-          - "remote_host={{ remote_host }}"
-          - "remote_user={{ remote_user }}"
-          - "remote_data_path='{{ remote_data_path }}'"
-          - "local_backup_dir={{ local_backup_dir }}"
-          - "gpg_recipient={{ gpg_recipient }}"
-          - "gpg_key_id={{ gpg_key_id }}"
-
-    - name: Ensure local backup directory exists
-      ansible.builtin.file:
-        path: "{{ local_backup_dir }}"
-        state: directory
-        mode: "0700"
-
-    - name: Ensure ~/.local/bin exists
-      ansible.builtin.file:
-        path: "{{ lookup('env', 'HOME') }}/.local/bin"
-        state: directory
-        mode: "0755"
-
-    - name: Create phoenixd backup script
-      ansible.builtin.copy:
-        dest: "{{ backup_script_path }}"
-        mode: "0750"
-        content: |
-          #!/bin/bash
-          set -euo pipefail
-
-          if [ -z "{{ gpg_recipient }}" ]; then
-            echo "GPG recipient is not configured. Aborting."
-            exit 1
-          fi
-
-          TIMESTAMP=$(date +'%Y-%m-%d')
-          ENCRYPTED_BACKUP="{{ local_backup_dir }}/phoenixd-backup-$TIMESTAMP.tar.gz.gpg"
-
-          {% if remote_key_file %}
-          SSH_CMD="ssh -i {{ remote_key_file }} -p {{ remote_port }}"
-          {% else %}
-          SSH_CMD="ssh -p {{ remote_port }}"
-          {% endif %}
-
-          # seed.dat + phoenix.conf only, see the header of the playbook.
-          echo "Creating encrypted backup archive..."
-          $SSH_CMD {{ remote_user }}@{{ remote_host }} \
-            "sudo tar -czf - -C {{ remote_data_path }} seed.dat phoenix.conf" | \
-          gpg --batch --yes --encrypt --recipient "{{ gpg_recipient }}" --output "$ENCRYPTED_BACKUP"
-
-          chmod 600 "$ENCRYPTED_BACKUP"
-
-          # Rotate old backups (keep 14 days)
-          CUTOFF_DATE=$(date -d '14 days ago' +'%Y-%m-%d')
-          for backup_file in "{{ local_backup_dir }}"/phoenixd-backup-*.tar.gz.gpg; do
-            if [ -f "$backup_file" ]; then
-              # Extract date from filename: phoenixd-backup-YYYY-MM-DD.tar.gz.gpg
-              file_date=$(basename "$backup_file" | sed -n 's/phoenixd-backup-\([0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}\)\.tar\.gz\.gpg/\1/p')
-              if [ -n "$file_date" ] && [ "$file_date" != "$TIMESTAMP" ] && [ "$file_date" \< "$CUTOFF_DATE" ]; then
-                rm -f "$backup_file"
-              fi
-            fi
-          done
-
-          echo "Backup completed successfully"
-
-    - name: Ensure cronjob for phoenixd backup exists
-      ansible.builtin.cron:
-        name: "phoenixd backup"
-        user: "{{ lookup('env', 'USER') }}"
-        job: "{{ backup_script_path }}"
-        minute: 15
-        hour: "9"
-
-    - name: Run phoenixd backup script to create initial backup
-      ansible.builtin.command: "{{ backup_script_path }}"
-
-    - name: Verify backup was created
-      block:
-        - name: Get today's date
-          command: date +'%Y-%m-%d'
-          register: today_date
-          changed_when: false
-
-        - name: Check if backup file exists
-          stat:
-            path: "{{ local_backup_dir }}/phoenixd-backup-{{ today_date.stdout }}.tar.gz.gpg"
-          register: backup_file_stat
-
-        - name: Verify backup file exists
-          assert:
-            that:
-              - backup_file_stat.stat.exists
-              - backup_file_stat.stat.isreg
-            fail_msg: "Backup file {{ local_backup_dir }}/phoenixd-backup-{{ today_date.stdout }}.tar.gz.gpg was not created"
-            success_msg: "Backup file {{ local_backup_dir }}/phoenixd-backup-{{ today_date.stdout }}.tar.gz.gpg exists"
-
-        - name: Verify backup file is not empty
-          assert:
-            that:
-              - backup_file_stat.stat.size > 0
-            fail_msg: "Backup file {{ local_backup_dir }}/phoenixd-backup-{{ today_date.stdout }}.tar.gz.gpg exists but is empty"
-            success_msg: "Backup file size is {{ backup_file_stat.stat.size }} bytes"
-
-    - name: Remind about the offline seed copy
-      debug:
-        msg: |
-          These encrypted backups are only as safe as your GPG key.
-          Also write the 12 words down offline once:
-            ssh {{ remote_user }}@{{ remote_host }} "sudo cat {{ remote_data_path }}/seed.dat"

ansible/services/vaultwarden/setup_backup_vaultwarden_to_lapy.yml

@@ -1,105 +0,0 @@
-- name: Configure local backup for Vaultwarden from remote
-  hosts: control
-  gather_facts: no
-  vars_files:
-    - ../../infra_vars.yml
-    - ./vaultwarden_vars.yml
-  vars:
-    remote_data_path: "{{ vaultwarden_data_dir }}"
-
-  tasks:
-    - name: Debug remote backup vars
-      debug:
-        msg:
-          - "remote_host={{ remote_host }}"
-          - "remote_user={{ remote_user }}"
-          - "remote_data_path='{{ remote_data_path }}'"
-          - "local_backup_dir={{ local_backup_dir }}"
-
-    - name: Ensure local backup directory exists
-      file:
-        path: "{{ local_backup_dir }}"
-        state: directory
-        mode: '0755'
-
-    - name: Ensure ~/.local/bin exists
-      file:
-        path: "{{ lookup('env', 'HOME') }}/.local/bin"
-        state: directory
-        mode: '0755'
-
-    - name: Create backup script
-      copy:
-        dest: "{{ backup_script_path }}"
-        mode: '0750'
-        content: |
-          #!/bin/bash
-          set -euo pipefail
-
-          TIMESTAMP=$(date +'%Y-%m-%d')
-          BACKUP_DIR="{{ local_backup_dir }}/$TIMESTAMP"
-          mkdir -p "$BACKUP_DIR"
-
-          {% if remote_key_file %}
-          SSH_CMD="ssh -i {{ remote_key_file }} -p {{ remote_port }}"
-          {% else %}
-          SSH_CMD="ssh -p {{ remote_port }}"
-          {% endif %}
-
-          rsync -az -e "$SSH_CMD" --delete {{ remote_user }}@{{ remote_host }}:{{ remote_data_path }}/ "$BACKUP_DIR/"
-
-          # Rotate old backups (keep 14 days)
-          # Calculate cutoff date (14 days ago) and delete backups older than that
-          CUTOFF_DATE=$(date -d '14 days ago' +'%Y-%m-%d')
-          for dir in "{{ local_backup_dir }}"/20*; do
-            if [ -d "$dir" ]; then
-              dir_date=$(basename "$dir")
-              if [ "$dir_date" != "$TIMESTAMP" ] && [ "$dir_date" \< "$CUTOFF_DATE" ]; then
-                rm -rf "$dir"
-              fi
-            fi
-          done
-
-    - name: Ensure cronjob for backup exists
-      cron:
-        name: "Vaultwarden backup"
-        user: "{{ lookup('env', 'USER') }}"
-        job: "{{ backup_script_path }}"
-        minute: 5
-        hour: "9,12,15,18"
-
-    - name: Run the backup script to make the first backup
-      command: "{{ backup_script_path }}"
-
-    - name: Verify backup was created
-      block:
-        - name: Get today's date
-          command: date +'%Y-%m-%d'
-          register: today_date
-          changed_when: false
-
-        - name: Check backup directory exists and contains files
-          stat:
-            path: "{{ local_backup_dir }}/{{ today_date.stdout }}"
-          register: backup_dir_stat
-
-        - name: Verify backup directory exists
-          assert:
-            that:
-              - backup_dir_stat.stat.exists
-              - backup_dir_stat.stat.isdir
-            fail_msg: "Backup directory {{ local_backup_dir }}/{{ today_date.stdout }} was not created"
-            success_msg: "Backup directory {{ local_backup_dir }}/{{ today_date.stdout }} exists"
-
-        - name: Check if backup directory contains files
-          find:
-            paths: "{{ local_backup_dir }}/{{ today_date.stdout }}"
-            recurse: yes
-          register: backup_files
-
-        - name: Verify backup directory is not empty
-          assert:
-            that:
-              - backup_files.files | length > 0
-            fail_msg: "Backup directory {{ local_backup_dir }}/{{ today_date.stdout }} exists but is empty"
-            success_msg: "Backup directory contains {{ backup_files.files | length }} file(s)"

ansible/services/vaultwarden/vaultwarden_vars.yml

@@ -12,6 +12,3 @@ remote_user: "{{ hostvars.get(remote_host_name, {}).get('ansible_user', 'counter
 remote_key_file: "{{ hostvars.get(remote_host_name, {}).get('ansible_ssh_private_key_file', '') }}"
 remote_port: "{{ hostvars.get(remote_host_name, {}).get('ansible_port', 22) }}"
 
-# Local backup
-local_backup_dir: "{{ lookup('env', 'HOME') }}/vaultwarden-backups"
-backup_script_path: "{{ lookup('env', 'HOME') }}/.local/bin/vaultwarden_backup.sh"