stuff

ansible/services/forgejo/forgejo_vars.yml

@@ -15,3 +15,7 @@ forgejo_user: "git"
 remote_host: "{{ groups['vipy'][0] }}"
 remote_user: "{{ hostvars[remote_host]['ansible_user'] }}"
 remote_key_file: "{{ hostvars[remote_host]['ansible_ssh_private_key_file'] | default('') }}"
+
+# Local backup
+local_backup_dir: "{{ lookup('env', 'HOME') }}/forgejo-backups"
+backup_script_path: "{{ lookup('env', 'HOME') }}/.local/bin/forgejo_backup.sh"

ansible/services/forgejo/setup_backup_forgejo_to_lapy.yml

@@ -0,0 +1,86 @@
+---
+- name: Configure local backup for Forgejo from remote
+  hosts: lapy
+  gather_facts: no
+  vars_files:
+    - ../../infra_vars.yml
+    - ./forgejo_vars.yml
+  vars:
+    remote_data_path: "{{ forgejo_data_dir }}"
+    remote_config_path: "{{ forgejo_config_dir }}"
+    forgejo_service_name: "forgejo"
+    gpg_recipient: "{{ hostvars['localhost']['gpg_recipient'] | default('') }}"
+    gpg_key_id: "{{ hostvars['localhost']['gpg_key_id'] | default('') }}"
+
+  tasks:
+    - name: Debug Forgejo backup vars
+      debug:
+        msg:
+          - "remote_host={{ remote_host }}"
+          - "remote_user={{ remote_user }}"
+          - "remote_data_path='{{ remote_data_path }}'"
+          - "remote_config_path='{{ remote_config_path }}'"
+          - "local_backup_dir={{ local_backup_dir }}"
+          - "gpg_recipient={{ gpg_recipient }}"
+          - "gpg_key_id={{ gpg_key_id }}"
+
+    - name: Ensure local backup directory exists
+      ansible.builtin.file:
+        path: "{{ local_backup_dir }}"
+        state: directory
+        mode: "0755"
+
+    - name: Ensure ~/.local/bin exists
+      ansible.builtin.file:
+        path: "{{ lookup('env', 'HOME') }}/.local/bin"
+        state: directory
+        mode: "0755"
+
+    - name: Create Forgejo backup script
+      ansible.builtin.copy:
+        dest: "{{ backup_script_path }}"
+        mode: "0750"
+        content: |
+          #!/bin/bash
+          set -euo pipefail
+
+          if [ -z "{{ gpg_recipient }}" ]; then
+            echo "GPG recipient is not configured. Aborting."
+            exit 1
+          fi
+
+          TIMESTAMP=$(date +'%Y-%m-%d')
+          ENCRYPTED_BACKUP="{{ local_backup_dir }}/forgejo-backup-$TIMESTAMP.tar.gz.gpg"
+
+          {% if remote_key_file %}
+          SSH_CMD="ssh -i {{ remote_key_file }} -p {{ hostvars[remote_host]['ansible_port'] | default(22) }}"
+          {% else %}
+          SSH_CMD="ssh -p {{ hostvars[remote_host]['ansible_port'] | default(22) }}"
+          {% endif %}
+
+          echo "Stopping Forgejo service..."
+          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo systemctl stop {{ forgejo_service_name }}"
+
+          echo "Creating encrypted backup archive..."
+          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo tar -czf - {{ remote_data_path }} {{ remote_config_path }}" | \
+          gpg --batch --yes --encrypt --recipient "{{ gpg_recipient }}" --output "$ENCRYPTED_BACKUP"
+
+          echo "Starting Forgejo service..."
+          $SSH_CMD {{ remote_user }}@{{ remote_host }} "sudo systemctl start {{ forgejo_service_name }}"
+
+          echo "Rotating old backups..."
+          find "{{ local_backup_dir }}" -name "forgejo-backup-*.tar.gz.gpg" -mtime +13 -delete
+
+          echo "Backup completed successfully"
+
+    - name: Ensure cronjob for Forgejo backup exists
+      ansible.builtin.cron:
+        name: "Forgejo backup"
+        user: "{{ lookup('env', 'USER') }}"
+        job: "{{ backup_script_path }}"
+        minute: 5
+        hour: "9,12,15,18"
+
+    - name: Run Forgejo backup script to create initial backup
+      ansible.builtin.command: "{{ backup_script_path }}"
+