Daniel Allaire
8a9da0c31a
Chaque role proprietaire (AC, bases, annuaire, Nextcloud, rspamd/DKIM, courriel, forge, web) remet son etat au moment ou il le creerait neuf, depuis le dernier instantane anterieur a la naissance de la machine. La sauvegarde refuse de deposer tant qu'un etat d'avant attend. Outil de noeud setops-restaurer ; cibles sauvegarder-maintenant, restauration-etat, restauration-renoncer ; test_restauration. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
68 lines
1.8 KiB
YAML
68 lines
1.8 KiB
YAML
---
|
|
# ACCES AU DEPOT DE CE NOEUD — partage par la sauvegarde (`main.yml`) et par la
|
|
# restauration (`restaurer.yml`, incluse par les roles proprietaires de l'etat).
|
|
#
|
|
# Une seule copie de ces taches : deux facons de poser une cle finiraient par diverger,
|
|
# et on ne le decouvrirait que le jour ou l'on restaure.
|
|
- name: Installer restic
|
|
ansible.builtin.apt:
|
|
name: "{{ client_backup_paquets }}"
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Créer le répertoire des secrets Set-OPS
|
|
ansible.builtin.file:
|
|
path: /etc/setops
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
|
|
- name: Déposer la clé SSH privée de sauvegarde
|
|
ansible.builtin.copy:
|
|
content: "{{ client_backup_ssh_privkey }}"
|
|
dest: "{{ client_backup_ssh_key }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Déposer le mot de passe restic
|
|
ansible.builtin.copy:
|
|
content: "{{ client_backup_password }}\n"
|
|
dest: /etc/setops/restic.pass
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Assurer /root/.ssh
|
|
ansible.builtin.file:
|
|
path: /root/.ssh
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
|
|
- name: Configurer l'accès SSH à la cible de sauvegarde
|
|
ansible.builtin.blockinfile:
|
|
path: /root/.ssh/config
|
|
create: true
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
marker: "# {mark} SETOPS BACKUP {{ client_backup_cible }}"
|
|
block: |
|
|
Host {{ client_backup_cible }}
|
|
User {{ client_backup_utilisateur_distant }}
|
|
IdentityFile {{ client_backup_ssh_key }}
|
|
IdentitiesOnly yes
|
|
StrictHostKeyChecking accept-new
|
|
|
|
- name: Déployer l'outil de restauration (setops-restaurer)
|
|
ansible.builtin.template:
|
|
src: restaurer.sh.j2
|
|
dest: /usr/local/sbin/setops-restaurer
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|