asxpi/iac
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

ansible: nightly restic backups to both object storage regions

Browse source 
Hetzner's server backups cost 20% of each server's price and only
restore whole disks. Back up what matters with restic instead, into the
backup buckets we already pay for: one repository per host in hel1
(asxpio-backups-main) and one in fsn1 (asxpio-backups-repl), written
independently so either region alone is a full copy.

Postgres goes in as a dump, Forgejo's and vhpbot's SQLite databases
through the online backup API, Garage with a fresh metadata snapshot,
ejabberd through its own backup command. Keeps 7 daily, 4 weekly and
6 monthly snapshots, prunes on Sundays, and mails the journal when a
run fails.

restic is the pinned upstream release, so its version is tracked in
the repo like everything else. The vault gains the restic password
and the Xray config for the role that follows.

Assisted-by: Claude:opus-5-5
This commit is contained in:
Sergei Poljanski 2026-11-12 20:53:44 +04:00
commit 59b5b4468a
13 changed files with 450 additions and 105 deletions
Download patch file Download diff file Expand all files Collapse all files

36
ansible/roles/restic_backup/defaults/main.yaml Normal file
View file

@ -0,0 +1,36 @@
---
# Nightly restic backup of the host to Hetzner Object Storage, one
# repository per region, written independently: losing one region or one
# repository leaves the other complete.
# renovate: datasource=github-releases depName=restic/restic
restic_version: "0.19.1"
restic_password: "{{ vault_restic_password }}"
restic_s3_access_key: "{{ s3_access_key }}"
restic_s3_secret_key: "{{ s3_secret_key }}"
restic_repositories:
hel1: "s3:https://hel1.your-objectstorage.com/{{ s3_bucket_backups_main }}/restic/{{ inventory_hostname }}"
fsn1: "s3:https://fsn1.your-objectstorage.com/{{ s3_bucket_backups_repl }}/restic/{{ inventory_hostname }}"
# Dumps and snapshots taken by the hooks land here and are backed up too
restic_stage_dir: /var/backups/restic-stage
restic_paths: [/etc, /opt]
restic_excludes: []
# Shell lines run in order before the backup, with $STAGE set. A failing
# hook marks the run as failed but the backup still runs.
restic_pre_hooks: []
restic_keep: "--keep-daily 7 --keep-weekly 4 --keep-monthly 6"
restic_schedule: "*-*-* 03:30:00"
# Prune (rewrites pack files, so costs S3 requests) once a week only
restic_prune_weekday: Sun
# Failure mail, through Forgejo's SMTP account
restic_alert_smtp_host: smtp.fastmail.com
restic_alert_smtp_port: 587
restic_alert_smtp_user: "{{ vault_forgejo_smtp_user }}"
restic_alert_smtp_password: "{{ vault_forgejo_smtp_password }}"
restic_alert_recipient: "{{ vault_crawler_recipient }}"