25 lines
1.1 KiB
YAML
25 lines
1.1 KiB
YAML
---
|
|
# Vaultwarden backup: dumps locally on vipy, encrypted with age.
|
|
# Previously rsynced to lapy in the CLEAR; the artefact now never exists
|
|
# unencrypted, on disk or on the wire.
|
|
- name: Configure the Vaultwarden backup on the edge host
|
|
hosts: edge
|
|
become: yes
|
|
vars_files:
|
|
- ../../group_vars/all/main.yml
|
|
- ./vaultwarden_vars.yml
|
|
|
|
tasks:
|
|
- name: Ensure Vaultwarden dumps itself, encrypted, on a timer
|
|
ansible.builtin.include_role:
|
|
name: backup_source
|
|
vars:
|
|
backup_source_name: vaultwarden
|
|
backup_source_description: "Vaultwarden"
|
|
backup_source_dump_command: "tar -czf - -C / opt/vaultwarden/data"
|
|
# Not systemd — a docker compose stack — so stop/start explicitly.
|
|
# sqlite in WAL mode, hence stopping at all.
|
|
backup_source_stop_command: "docker compose -f /opt/vaultwarden/docker-compose.yml stop"
|
|
backup_source_start_command: "docker compose -f /opt/vaultwarden/docker-compose.yml start"
|
|
backup_source_retention_days: 7
|
|
backup_source_on_calendar: "*-*-* 02:10:00"
|