mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Fable 5
598b7c3a9a
New svc-bkp-secrets-2-local role: a differential rsync --link-dest snapshot of the host-generated secret material that lives in no docker volume, NFS export or operator inventory - infinito secrets + tokens, the self-signed CA, the Let's Encrypt account/certs, the ACME DNS credentials - plus the node identity (ssh host keys + machine-id). files/recover.py restores each present subtree to its fixed system path and gates the node-identity restore behind --restore-node-identity. Wires the systemd unit + nightly schedule (06_daemons, 07_schedule). Unit tests cover the domain/target map and the main() subtree-selection + node-identity gating. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
9 lines
539 B
Django/Jinja
9 lines
539 B
Django/Jinja
[Unit]
|
|
Description=Differential backup of host secrets, CA, ACME + node identity to the local backup directory
|
|
OnFailure={{ SYS_SERVICE_ON_FAILURE_COMPOSE }} {{ SYS_SERVICE_CLEANUP_BACKUPS_FAILED }}
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStartPre={{ BIN_LOCK }} {{ SYS_SERVICE_GROUP_MANIPULATION | join(' ') }} --ignore {{ SYS_SERVICE_BACKUP_SECRETS_2_LOCAL }} --timeout "{{ SYS_TIMEOUT_BACKUP_SERVICES }}"
|
|
ExecStart={{ system_service_script_exec }} {{ DIR_BACKUPS }} {{ BKP_SECRETS_2_LOCAL_REPO_NAME }} {{ BKP_SECRETS_2_LOCAL_SOURCES | join(' ') }}
|