---
# Memos backup: dumps locally on memos-box, encrypted with age.
# Replaces the lapy pull, which had been writing EMPTY directories since
# 2025-12-27 — its script hardcoded 192.168.1.130, which DHCP later reassigned
# to a different machine that has no rsync.
- name: Configure the Memos backup on its own host
  hosts: memos
  become: yes
  vars_files:
    - ./memos_vars.yml

  tasks:
    - name: Ensure Memos dumps itself, encrypted, on a timer
      ansible.builtin.include_role:
        name: backup_source
      vars:
        backup_source_name: memos
        backup_source_description: "Memos"
        backup_source_dump_command: "tar -czf - -C / var/lib/memos"
        # sqlite in WAL mode: stopping checkpoints the WAL, so the artefact is a
        # consistent database rather than a torn mid-write copy. The old rsync
        # job did not stop it.
        backup_source_stop_service: memos
        backup_source_retention_days: 7
        backup_source_on_calendar: "*-*-* 02:00:00"
        # Reported to Gatus as backup-dump_memos. The token is this HOST's token,
        # shared with its other checks - see infra/400_host_monitoring.yml.
        backup_source_push_url: "https://{{ subdomains.gatus }}.{{ root_domain }}/api/v1/endpoints/backup-dump_memos/external"
        backup_source_push_token: "{{ gatus_push_tokens[inventory_hostname] }}"