ansible: daily replica of the hel1 buckets into fsn1

restic writes both regions itself, but the ad-hoc backups under
asxpio-ops/, the Terraform state and the k8s state only ever went to
hel1. Sync each hel1 bucket into its fsn1 twin every morning from
asxpio-services, with rclone pinned like everything else.

restic/ is excluded, so the independent fsn1 restic repositories are
never touched. A run that would delete more than 1000 objects stops and
mails, so a mistake on the hel1 side cannot empty the replica the next
morning. The first dry run copied 23 objects and deleted none.

Assisted-by: Claude:opus-5-5

ansible/roles/s3_replicate/tasks/main.yaml

@@ -0,0 +1,38 @@
+---
+- name: Create the config directory
+  ansible.builtin.file:
+    path: /etc/s3-replicate
+    state: directory
+    mode: "0700"
+
+- name: Write credentials
+  ansible.builtin.template:
+    src: env.j2
+    dest: /etc/s3-replicate/env
+    mode: "0600"
+  diff: false
+
+- name: Install the script
+  ansible.builtin.template:
+    src: s3-replicate.j2
+    dest: /usr/local/sbin/s3-replicate
+    mode: "0700"
+
+- name: Install the systemd units
+  ansible.builtin.template:
+    src: "{{ item }}.j2"
+    dest: "/etc/systemd/system/{{ item }}"
+    mode: "0644"
+  loop: [s3-replicate.service, s3-replicate.timer]
+  notify: Reload systemd
+
+- name: Flush handlers
+  ansible.builtin.meta: flush_handlers
+
+- name: Enable the daily timer
+  ansible.builtin.systemd:
+    name: s3-replicate.timer
+    enabled: true
+    state: started
+  # On a first dry run the unit is not installed yet
+  ignore_errors: "{{ ansible_check_mode }}"