136 lines
5.2 KiB
YAML
136 lines
5.2 KiB
YAML
---
|
|
# Backs up the phoenixd seed and config from vipy to Lapy, gpg encrypted.
|
|
#
|
|
# Only seed.dat and phoenix.conf are backed up, on purpose:
|
|
# - seed.dat is what actually recovers the funds. phoenixd keeps its channel
|
|
# state with the ACINQ peer, so a wallet is restored from the seed alone.
|
|
# - restoring a *stale* channel database to a running Lightning node is
|
|
# dangerous (it can trigger a force close and a penalty), so we do not keep
|
|
# copies of phoenix.db around to be tempted by.
|
|
# - phoenix.conf holds the http api password, which is what LNBits and any
|
|
# other local consumer authenticate with.
|
|
#
|
|
# Because both files are static, phoenixd does not need to be stopped.
|
|
|
|
- name: Configure local backup for phoenixd from remote
|
|
hosts: control
|
|
gather_facts: no
|
|
vars_files:
|
|
- ../../infra_vars.yml
|
|
- ./phoenixd_vars.yml
|
|
vars:
|
|
remote_data_path: "{{ phoenixd_data_dir }}"
|
|
gpg_recipient: "{{ hostvars['localhost']['gpg_recipient'] | default('') }}"
|
|
gpg_key_id: "{{ hostvars['localhost']['gpg_key_id'] | default('') }}"
|
|
|
|
tasks:
|
|
- name: Debug phoenixd backup vars
|
|
debug:
|
|
msg:
|
|
- "remote_host={{ remote_host }}"
|
|
- "remote_user={{ remote_user }}"
|
|
- "remote_data_path='{{ remote_data_path }}'"
|
|
- "local_backup_dir={{ local_backup_dir }}"
|
|
- "gpg_recipient={{ gpg_recipient }}"
|
|
- "gpg_key_id={{ gpg_key_id }}"
|
|
|
|
- name: Ensure local backup directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ local_backup_dir }}"
|
|
state: directory
|
|
mode: "0700"
|
|
|
|
- name: Ensure ~/.local/bin exists
|
|
ansible.builtin.file:
|
|
path: "{{ lookup('env', 'HOME') }}/.local/bin"
|
|
state: directory
|
|
mode: "0755"
|
|
|
|
- name: Create phoenixd backup script
|
|
ansible.builtin.copy:
|
|
dest: "{{ backup_script_path }}"
|
|
mode: "0750"
|
|
content: |
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
|
|
if [ -z "{{ gpg_recipient }}" ]; then
|
|
echo "GPG recipient is not configured. Aborting."
|
|
exit 1
|
|
fi
|
|
|
|
TIMESTAMP=$(date +'%Y-%m-%d')
|
|
ENCRYPTED_BACKUP="{{ local_backup_dir }}/phoenixd-backup-$TIMESTAMP.tar.gz.gpg"
|
|
|
|
{% if remote_key_file %}
|
|
SSH_CMD="ssh -i {{ remote_key_file }} -p {{ remote_port }}"
|
|
{% else %}
|
|
SSH_CMD="ssh -p {{ remote_port }}"
|
|
{% endif %}
|
|
|
|
# seed.dat + phoenix.conf only, see the header of the playbook.
|
|
echo "Creating encrypted backup archive..."
|
|
$SSH_CMD {{ remote_user }}@{{ remote_host }} \
|
|
"sudo tar -czf - -C {{ remote_data_path }} seed.dat phoenix.conf" | \
|
|
gpg --batch --yes --encrypt --recipient "{{ gpg_recipient }}" --output "$ENCRYPTED_BACKUP"
|
|
|
|
chmod 600 "$ENCRYPTED_BACKUP"
|
|
|
|
# Rotate old backups (keep 14 days)
|
|
CUTOFF_DATE=$(date -d '14 days ago' +'%Y-%m-%d')
|
|
for backup_file in "{{ local_backup_dir }}"/phoenixd-backup-*.tar.gz.gpg; do
|
|
if [ -f "$backup_file" ]; then
|
|
# Extract date from filename: phoenixd-backup-YYYY-MM-DD.tar.gz.gpg
|
|
file_date=$(basename "$backup_file" | sed -n 's/phoenixd-backup-\([0-9]\{4\}-[0-9]\{2\}-[0-9]\{2\}\)\.tar\.gz\.gpg/\1/p')
|
|
if [ -n "$file_date" ] && [ "$file_date" != "$TIMESTAMP" ] && [ "$file_date" \< "$CUTOFF_DATE" ]; then
|
|
rm -f "$backup_file"
|
|
fi
|
|
fi
|
|
done
|
|
|
|
echo "Backup completed successfully"
|
|
|
|
- name: Ensure cronjob for phoenixd backup exists
|
|
ansible.builtin.cron:
|
|
name: "phoenixd backup"
|
|
user: "{{ lookup('env', 'USER') }}"
|
|
job: "{{ backup_script_path }}"
|
|
minute: 15
|
|
hour: "9"
|
|
|
|
- name: Run phoenixd backup script to create initial backup
|
|
ansible.builtin.command: "{{ backup_script_path }}"
|
|
|
|
- name: Verify backup was created
|
|
block:
|
|
- name: Get today's date
|
|
command: date +'%Y-%m-%d'
|
|
register: today_date
|
|
changed_when: false
|
|
|
|
- name: Check if backup file exists
|
|
stat:
|
|
path: "{{ local_backup_dir }}/phoenixd-backup-{{ today_date.stdout }}.tar.gz.gpg"
|
|
register: backup_file_stat
|
|
|
|
- name: Verify backup file exists
|
|
assert:
|
|
that:
|
|
- backup_file_stat.stat.exists
|
|
- backup_file_stat.stat.isreg
|
|
fail_msg: "Backup file {{ local_backup_dir }}/phoenixd-backup-{{ today_date.stdout }}.tar.gz.gpg was not created"
|
|
success_msg: "Backup file {{ local_backup_dir }}/phoenixd-backup-{{ today_date.stdout }}.tar.gz.gpg exists"
|
|
|
|
- name: Verify backup file is not empty
|
|
assert:
|
|
that:
|
|
- backup_file_stat.stat.size > 0
|
|
fail_msg: "Backup file {{ local_backup_dir }}/phoenixd-backup-{{ today_date.stdout }}.tar.gz.gpg exists but is empty"
|
|
success_msg: "Backup file size is {{ backup_file_stat.stat.size }} bytes"
|
|
|
|
- name: Remind about the offline seed copy
|
|
debug:
|
|
msg: |
|
|
These encrypted backups are only as safe as your GPG key.
|
|
Also write the 12 words down offline once:
|
|
ssh {{ remote_user }}@{{ remote_host }} "sudo cat {{ remote_data_path }}/seed.dat"
|