ansible-borgbackup/tasks/borg-client.yml

115 lines
4.3 KiB
YAML
Raw Normal View History

2017-09-07 18:35:01 +00:00
---
- name: client | generate ssh key for this machine
2017-11-12 14:02:50 +00:00
shell: if [ -f {{ borgbackup_ssh_key }} ]; then rm -f {{ borgbackup_ssh_key }}; fi && ssh-keygen -q -t rsa -b 4096 -f {{ borgbackup_ssh_key }} -N "" creates="{{ borgbackup_ssh_key }}.pub"
2017-09-07 18:35:01 +00:00
- name: client | fetch ssh-key
2017-11-12 14:02:50 +00:00
shell: "cat {{ borgbackup_ssh_key }}.pub"
2017-09-07 18:35:01 +00:00
register: sshkey
changed_when: False
- name: client | write passphrase
lineinfile:
dest: "/root/.borg.passphrase"
state: "present"
2017-10-01 11:05:59 +00:00
line: 'export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"'
2017-09-07 18:35:01 +00:00
create: "yes"
2017-11-12 14:02:50 +00:00
- name: client | disable strict key checking for backup servers
blockinfile:
dest: /root/.ssh/config
create: yes
marker: "### {mark} ANSIBLE MANAGED BLOCK {{ item.fqdn }} ###"
content: |
Host {{ item.fqdn }}
StrictHostKeyChecking no
IdentityFile {{ borgbackup_ssh_key }}
2017-11-12 14:02:50 +00:00
{% if item.port is defined %}
Port {{ item.port }}
{% endif %}
with_items: "{{ borgbackup_servers }}"
2017-09-07 18:35:01 +00:00
- name: client | put sshpubkey on the normal backupserver
authorized_key:
user: "{{ item.user }}"
key: "{{ sshkey.stdout }}"
2017-10-01 17:24:50 +00:00
key_options: 'command="cd {{ item.home }}{{ item.pool }}/{{ inventory_hostname }};borg serve {% if borgbackup_appendonly %}--append-only {% endif %}--restrict-to-path {{ item.home }}/{{ item.pool }}/{{ inventory_hostname }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
2017-09-07 18:35:01 +00:00
delegate_to: "{{ item.fqdn }}"
when: item.type == 'normal'
2017-10-01 17:51:38 +00:00
with_items: "{{ borgbackup_servers }}"
2017-09-07 18:35:01 +00:00
2018-01-11 22:21:43 +00:00
# rsync.net and hetzner have no python, so we can only use raw to manage ssh keys - workaround with local tmp file
- name: client | get authorized_keys file
raw: scp {{ item.user }}@{{ item.fqdn }}:.ssh/authorized_keys /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys
2017-09-07 18:35:01 +00:00
delegate_to: localhost
become: no
2018-01-11 22:21:43 +00:00
when: item.type in ['rsync.net','hetzner']
2017-10-01 17:51:38 +00:00
with_items: "{{ borgbackup_servers }}"
2017-09-07 18:35:01 +00:00
changed_when: false
- name: client | modify local rsync.net/hetzner authorized_keys
2017-09-07 18:35:01 +00:00
authorized_key:
user: "{{ ansible_user_id }}"
key: "{{ sshkey.stdout }}"
2017-10-08 19:05:25 +00:00
key_options: 'command="cd {{ item.pool }}/{{ inventory_hostname }};/usr/local/bin/borg1 serve {% if borgbackup_appendonly %}--append-only {% endif %} --restrict-to-path {{ item.pool }}/{{ inventory_hostname }}",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding,no-user-rc'
2018-01-11 22:21:43 +00:00
path: "/tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys"
2017-09-07 18:35:01 +00:00
manage_dir: no
delegate_to: localhost
become: no
when: item.type in ['rsync.net','hetzner']
2018-01-11 22:21:43 +00:00
with_items: "{{ borgbackup_servers }}"
register: authkeys
- name: client | upload local authorized_keys to rsync.net / hetzner
raw: scp /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys {{ item.user }}@{{ item.fqdn }}:.ssh/authorized_keys
2017-09-07 18:35:01 +00:00
delegate_to: localhost
become: no
2018-01-11 22:21:43 +00:00
when: item.type in ['rsync.net','hetzner'] and authkeys.changed
2017-10-01 17:51:38 +00:00
with_items: "{{ borgbackup_servers }}"
2017-09-07 18:35:01 +00:00
- name: client | remove tmp authorized_keys files
file:
2018-01-11 22:21:43 +00:00
path: /tmp/authkeys-{{ item.type }}-{{ item.fqdn }}-authkeys
2017-09-07 18:35:01 +00:00
state: absent
delegate_to: localhost
become: no
2017-10-01 17:51:38 +00:00
with_items: "{{ borgbackup_servers }}"
2017-09-07 18:35:01 +00:00
when: authkeys.changed
changed_when: false
- name: client | check for mysql
stat: path=/var/lib/automysqlbackup
register: automysql
- name: client | put wrapper script
template:
src: "borg-backup.sh.j2"
dest: "/usr/local/bin/borg-backup"
owner: "{{ borgbackup_owner }}"
group: "{{ borgbackup_group }}"
2017-09-07 18:35:01 +00:00
mode: "0744"
- name: client | create backup-directory on backup server
shell: /usr/local/bin/borg-backup init
register: backup_init
changed_when: "'Remember your passphrase' in backup_init.stderr"
- name: client | create backup cronjob
cron:
cron_file: "borg-backup"
2017-10-01 18:01:19 +00:00
user: "{{ borgbackup_cron_user }}"
2017-09-07 18:35:01 +00:00
name: "borg-backup"
2017-10-01 18:01:19 +00:00
minute: "{{ borgbackup_cron_minute }}"
hour: "{{ borgbackup_cron_hour }}"
day: "{{ borgbackup_cron_day }}"
2017-09-07 18:35:01 +00:00
job: "/usr/local/bin/borg-backup backup"
- name: client | disable automysqlbackup cronjob, it's in our pre-backup-tasks
lineinfile:
dest: "/etc/cron.daily/automysqlbackup"
regexp: "^/usr/sbin/automysqlbackup$"
line: "#/usr/sbin/automysqlbackup"
state: "present"
backrefs: "yes"
create: "no"
when: automysql.stat.isdir is defined and automysql.stat.isdir == True