1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
- name: Backup
  hosts: lotus-land-story
  vars:
    primary_repository: sftp:restic@legacy-of-lunatic-kingdom:/mnt/data/restic
  tasks:

    - name: Install Restic
      ansible.builtin.package:
        name: restic
        state: present

    - name: Update Restic
      ansible.builtin.command: restic self-update

    - name: Generate SSH key
      community.crypto.openssh_keypair:
        path: ~/.ssh/id_ed25519
        type: ed25519

    # The backup script sftp's to this host as restic@, which fails closed on
    # an unknown host key. Ansible's own connections don't populate known_hosts.
    - name: Read legacy-of-lunatic-kingdom host key
      ansible.builtin.slurp:
        src: /etc/ssh/ssh_host_ed25519_key.pub
      delegate_to: legacy-of-lunatic-kingdom
      register: lolk_host_key

    - name: Trust legacy-of-lunatic-kingdom host key
      ansible.builtin.known_hosts:
        name: legacy-of-lunatic-kingdom
        key: "legacy-of-lunatic-kingdom {{ lolk_host_key.content | b64decode }}"

    - name: Set up daily backup
      ansible.builtin.template:
        src: templates/backup.sh
        dest: /etc/cron.daily/backup
        mode: '0700'

# vim: ft=yaml.ansible