Daniel Allaire
7476a54f22
Choix : sauvegarder la donnée d'état (non régénérable), pas les VM (reconstructibles par le code). restic (chiffré, dédupliqué, rétention). serveur_backup = cible SFTP (backup-01). client_backup = intégration par nœud : restic + jobs déclaratifs + timer systemd + rétention, secrets voûte. Prouvé de bout en bout sur le Tier 0 : infra-pki-01 → /etc/step-ca sauvegardé hors-nœud vers backup-01, restauration byte-identique des clés CA. Reste : jobs Tier 1 (pg_dump/slapcat/vmail/forgejo) + offsite (3-2-1). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
97 lines
2.5 KiB
YAML
97 lines
2.5 KiB
YAML
---
|
|
- name: Exiger les secrets de sauvegarde (Vault)
|
|
ansible.builtin.assert:
|
|
that:
|
|
- client_backup_password | length > 0
|
|
- client_backup_ssh_privkey | length > 0
|
|
fail_msg: "vault_restic_password et vault_backup_ssh_privkey requis."
|
|
|
|
- name: Installer restic
|
|
ansible.builtin.apt:
|
|
name: "{{ client_backup_paquets }}"
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Créer le répertoire des secrets Set-OPS
|
|
ansible.builtin.file:
|
|
path: /etc/setops
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
|
|
- name: Déposer la clé SSH privée de sauvegarde
|
|
ansible.builtin.copy:
|
|
content: "{{ client_backup_ssh_privkey }}"
|
|
dest: "{{ client_backup_ssh_key }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Déposer le mot de passe restic
|
|
ansible.builtin.copy:
|
|
content: "{{ client_backup_password }}\n"
|
|
dest: /etc/setops/restic.pass
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
no_log: true
|
|
|
|
- name: Assurer /root/.ssh
|
|
ansible.builtin.file:
|
|
path: /root/.ssh
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
|
|
- name: Configurer l'accès SSH à la cible de sauvegarde
|
|
ansible.builtin.blockinfile:
|
|
path: /root/.ssh/config
|
|
create: true
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
marker: "# {mark} SETOPS BACKUP {{ client_backup_cible }}"
|
|
block: |
|
|
Host {{ client_backup_cible }}
|
|
User {{ client_backup_utilisateur_distant }}
|
|
IdentityFile {{ client_backup_ssh_key }}
|
|
IdentitiesOnly yes
|
|
StrictHostKeyChecking accept-new
|
|
|
|
- name: Assurer le répertoire de préparation des dumps
|
|
ansible.builtin.file:
|
|
path: "{{ client_backup_staging }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
|
|
- name: Déployer le script de sauvegarde
|
|
ansible.builtin.template:
|
|
src: sauvegarder.sh.j2
|
|
dest: /usr/local/sbin/setops-sauvegarder.sh
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
|
|
- name: Déployer l'unité et le timer systemd
|
|
ansible.builtin.template:
|
|
src: "{{ item.s }}"
|
|
dest: "/etc/systemd/system/{{ item.d }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop:
|
|
- { s: setops-sauvegarde.service.j2, d: setops-sauvegarde.service }
|
|
- { s: setops-sauvegarde.timer.j2, d: setops-sauvegarde.timer }
|
|
|
|
- name: Activer le timer de sauvegarde
|
|
when: not ansible_check_mode
|
|
ansible.builtin.systemd:
|
|
name: setops-sauvegarde.timer
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|