computer-playbook/roles/svc-bkp-secrets-2-local/vars/main.yml at fix/dev-python/python-upper-bound - computer-playbook - Infinito.Nexus Code Hub

kevinveenbirkenbach/computer-playbook

0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-08 11:46:35 +00:00

Files

T

kevinveenbirkenbachandClaude Fable 5 598b7c3a9a feat(svc-bkp-secrets-2-local): host secret material backup role

New svc-bkp-secrets-2-local role: a differential rsync --link-dest snapshot
of the host-generated secret material that lives in no docker volume, NFS
export or operator inventory - infinito secrets + tokens, the self-signed
CA, the Let's Encrypt account/certs, the ACME DNS credentials - plus the
node identity (ssh host keys + machine-id). files/recover.py restores each
present subtree to its fixed system path and gates the node-identity
restore behind --restore-node-identity. Wires the systemd unit + nightly
schedule (06_daemons, 07_schedule). Unit tests cover the domain/target map
and the main() subtree-selection + node-identity gating.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-12 03:15:52 +02:00

12 lines

319 B

YAML

Raw Permalink Blame History

 ---
 application_id: svc-bkp-secrets-2-local
 system_service_id: "{{ application_id }}"
 BKP_SECRETS_2_LOCAL_REPO_NAME: backup-secrets-to-local
 BKP_SECRETS_2_LOCAL_SOURCES:
   - "secrets={{ DIR_SECRETS }}"
   - "ca={{ CA_ROOT.base_dir }}"
   - "acme={{ LETSENCRYPT_BASE_PATH }}"
   - "certbot={{ CERTBOT_CREDENTIALS_DIR }}"