personal_infra/ansible/roles/backup_source/tasks/main.yml

---
- name: Assert backup_source parameters are sane
  ansible.builtin.assert:
    that:
      - backup_source_name | length > 0
      - backup_source_description | length > 0
      - backup_source_dump_command | length > 0
      - backup_source_recipient | length > 0
      - backup_source_recipient is match('^age1[0-9a-z]{58}$')
      - not (backup_source_stop_command | length > 0 and backup_source_start_command | length == 0)
    fail_msg: >-
      backup_source: '{{ backup_source_name | default("<unnamed>") }}' needs a name,
      description, dump command and a valid age recipient (age1... 62 chars).
      backup_source_stop_command must be paired with backup_source_start_command.
    quiet: true

# Declared here rather than assumed. Stage 1 installed it by hand; this is what
# makes a rebuilt host get it too.
# Cache refresh is best-effort on purpose. An unrelated third-party repo with a
# bad signing key (spacey had two: an expired Caddy subkey and a SHA1 nodesource
# key) makes `apt-get update` return warnings, which the apt module treats as a
# hard failure — and that must not stop backups being configured. Installing the
# package is NOT best-effort: if age is genuinely unavailable, the next task fails.
- name: Refresh the apt cache (best effort)
  ansible.builtin.apt:
    update_cache: yes
    cache_valid_time: 3600
  failed_when: false
  changed_when: false

- name: Ensure age is installed
  ansible.builtin.apt:
    name:
      - age
      # curl is needed only when backup_source_push_url is set, but installing it
      # unconditionally keeps the task idempotent and it is present on every
      # Debian host here anyway.
      - curl
    state: present

# The pull account: unprivileged, no sudo, exists only so small-backups-box can
# read the dump directory. Trust points one way — the box can read backups, and
# can do nothing else on this host.
- name: "Ensure the {{ backup_source_pull_user }} account exists"
  ansible.builtin.user:
    name: "{{ backup_source_pull_user }}"
    system: yes
    shell: /bin/sh          # rsync-over-ssh needs a shell; nologin breaks it
    home: "/var/lib/{{ backup_source_pull_user }}"
    create_home: yes
    password: '!'           # no password login, ever
  when: backup_source_pull_user | length > 0

- name: "Authorise the backup box's key for {{ backup_source_pull_user }}"
  ansible.posix.authorized_key:
    user: "{{ backup_source_pull_user }}"
    key: "{{ backup_source_pull_key }}"
    key_options: "restrict"   # no pty, no forwarding, no user rc
    exclusive: yes
    state: present
  when: backup_source_pull_user | length > 0

# The shared container above the per-service directories. It must be traversable
# or the pull account cannot reach its own directory. The script's `mkdir -p`
# runs under `umask 077` and would otherwise create this 0700.
- name: "Ensure {{ backup_source_dir | dirname }} is traversable"
  ansible.builtin.file:
    path: "{{ backup_source_dir | dirname }}"
    state: directory
    owner: root
    group: root
    mode: '0755'

- name: "Ensure {{ backup_source_dir }} exists"
  ansible.builtin.file:
    path: "{{ backup_source_dir }}"
    state: directory
    owner: root
    group: "{{ backup_source_pull_user | default('root', true) }}"
    mode: '0750'

- name: "Install the {{ backup_source_name }} backup script"
  ansible.builtin.template:
    src: backup.sh.j2
    dest: "/usr/local/bin/{{ backup_source_name }}-backup.sh"
    owner: root
    group: root
    mode: '0750'
    validate: "bash -n %s"

# The .service carries the push token in an Environment= line, so it is 0600.
# The .timer holds nothing secret and stays world-readable.
- name: "Install the {{ backup_source_name }}-backup systemd units"
  ansible.builtin.template:
    src: "backup.{{ item.unit }}.j2"
    dest: "/etc/systemd/system/{{ backup_source_name }}-backup.{{ item.unit }}"
    owner: root
    group: root
    mode: "{{ item.mode }}"
  loop:
    - {unit: service, mode: "0600"}
    - {unit: timer,   mode: "0644"}
  notify: Reload systemd for backup units

- name: "Enable the {{ backup_source_name }}-backup timer"
  ansible.builtin.systemd:
    name: "{{ backup_source_name }}-backup.timer"
    enabled: yes
    state: started
    daemon_reload: yes