diff --git a/ansible/inventories/group_vars/all/borg.yaml b/ansible/inventories/group_vars/all/borg.yaml index 94b8f8f..0ad1544 100644 --- a/ansible/inventories/group_vars/all/borg.yaml +++ b/ansible/inventories/group_vars/all/borg.yaml @@ -1,4 +1,2 @@ --- -borg_user: borg -borg_backup_server: backs.hassallab.it -borg_repo_base_path: "ssh://{{ borg_user }}@{{ borg_backup_server }}/./" \ No newline at end of file +borg_backup_server: backs.hassallab.it \ No newline at end of file diff --git a/ansible/inventories/group_vars/all/vault.yaml b/ansible/inventories/group_vars/all/vault.yaml index baa29e8..2d85c6e 100644 --- a/ansible/inventories/group_vars/all/vault.yaml +++ b/ansible/inventories/group_vars/all/vault.yaml @@ -1,33 +1,35 @@ $ANSIBLE_VAULT;1.1;AES256 -63663638383238373238386231396435393236303735313430633639326436636237396363356636 -3335633566393761386331363065363230313134396562370a663439363937316338656361663563 -63366332333231666235613830663031663432613066376461316137336166646464323938373163 -6436373935383464360a363536383139616636613033653035356464643432303838663130373938 -66336361363038393365653562323431633439336534373664356638313535316333633839366330 -36383661363766386232616533323765386137656139373137623630356562386562653762336465 -63363163643639616235353436613664636434393734393565316161633664323131396638346165 -65616263643335396566393630636233306637313264366338636636666663373537613663663736 -31613739643130353532306366626264363630623933313561366534393630613534643139353466 -37373963333531666139356335393563623739323165356362616536656231663466366562333839 -39393761396265303032343664353634383132323039373135376636633234656666323433633934 -39613665643730373931383233643932373861396137306334353839663031633762663034396233 -62616339613431333330666639356332376539616338626635653635386464366436643036383363 -38663632346265303330666639613130396130626362643865316537323931633465326666636139 -37383565326661656566313738636236663137636361616461616536393338363333663634373861 -35643361663735316339663561643032343335666361383932316332393661643739393631343530 -63366166386135653762343136643462336161653433653032363539336630636133623435313337 -34333466396336633662653731343535383334303738366533653763326434366561393762386166 -31303163396432343463666236336136653065633132613234643430646631356632306562653034 -36643763313137626333313836383866323431343230326366663136643736383435326533613362 -66613864656230303561626661613632363761316334306530323137616365396439623966623664 -31386339313136366631616432623430363231646462653866313264333138383666313638396438 -62386639346235663463633365386362326239666261303438656339306662623464633962353833 -66323865613465353434666431663833363431356235376530636365313264626364633231633937 -66356563656138663733653935643231613437316137383930353738363561666131393838346464 -36646366303434323162363736343362623461343561363862313730316361383631313837366638 -66353738396661323536383532323639303961313862663330636161643635636231393536383466 -61366435663330633863343165636630373237356563636261636562613863633831643432323436 -63396461643639396363653031666262386230346533346136633166636438336233333234313839 -34373439363963633262663733663335353535343137366436336562336161373231346266393336 -38303065323030653233323831303566336233336162323563336330366539303836663462346434 -62643331643931383364 +61383036613265336537636538366661373461373031323533396231616237346464653964333735 +6665333762393635633538633630383739653531363937610a396632333065623965393635363632 +32313761663832383534326438383462333939346438326134346565393133323136356233363162 +3736343264313731380a613434663438393732633237373637653937356333633131656564653835 +61636462663936646138343639376133336430316664643366383133626634646630336630343133 +35636466346332366338353836303735363765393533343665333637363161616665336136666639 +39643132346237393962376561306432616630306335313464613561336639333863303337306139 +33383362666130646630373338626161613034613664343631383263353634626663656637316133 +39386565636265313039373833623336336464313462643962336164666533636566316630383133 +38633134346261343630313838303037313538363465363764646561653262663631633832643435 +30613232623865316233366435383539373262373730656564366634646633333666373437666365 +66353536313137363839663264653833306533386230313761303565323237616239363630623361 +66366462663261626432623634386263333631383732343562656362393366646533336637656235 +63653066356161653363616231386338653632303765366636353035323336356165326431383163 +32343863333762343236313232353066623330313563303738626234353030646235643937393330 +62663834356366363164633835663034393734643264373936633764646535366161356137346239 +39653533663132343036373637346332646534653637353930383261633232633735653430666462 +39613561643835616634653465363732656136393335633736363137656663326330386231323262 +31373661333231643937393961653030386437343866356466313931663961393933366233303737 +63646232646339393664616630336163373239326566613233666238313031343232653132623665 +62313835373437396335396534346637356632353764623635356237643037613131323236663462 +36366639656438303964626636346232323936653866383566386662396238643336373430393635 +61383435313162366636616265663465396165396234303238636362373036653834303963363638 +62336265356264653935633762633764313036346131633463633966373436623838396238366662 +37633939333037316237303233393361613538363739326162633233636232393939643233626462 +31343534393534353664646164343261363531386134306263313135386333356562363939323961 +65653035343330393939353462376565643234633738366163653532616135316365303236353138 +39303039333661643963356666336662663037326239663866333561386663326534666466633633 +36333536633331336266653433316363666632393033393330333739383831623539656661313433 +63333835353835653664623736393532663366623637653466336530393565323535343665303733 +63383562396266613266616330666231346231323865343133373435653239623835326633363666 +63353539356430386638313739653532303635616531643263376535656433346533353962383565 +31623236613533623334653235303533353437626162353331383734663539333037383161633636 +6161393763656532356535396238376162353165366365316337 diff --git a/ansible/inventories/group_vars/borg/auth_users.yaml b/ansible/inventories/group_vars/borg/auth_users.yaml index 1e1e04a..3f18a4d 100644 --- a/ansible/inventories/group_vars/borg/auth_users.yaml +++ b/ansible/inventories/group_vars/borg/auth_users.yaml @@ -1,3 +1,4 @@ -# auth_users: -# - host: johndoe.clnt.local -# key: "{{ lookup('file', '/path/to/keys/johndoe.clnt.local.pub') }}" +configure_borg_server: true +borg_auth_users: + - host: fabotest + key: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ== fabio@pc-fabio" \ No newline at end of file diff --git a/ansible/inventories/host_vars/hserve1.yaml b/ansible/inventories/host_vars/hserve1.yaml index 96c9642..fd5764a 100644 --- a/ansible/inventories/host_vars/hserve1.yaml +++ b/ansible/inventories/host_vars/hserve1.yaml @@ -3,4 +3,16 @@ pangolin_site_id: 7drc3dz2bg5gbq5 newt_secret: "{{ test_nginx_newt_secret }}" -forgejo_db_password : "{{ forgejo_db_crypted_password }}" \ No newline at end of file +forgejo_db_password : "{{ forgejo_db_crypted_password }}" + +configure_borg_client: true +borg_repos: + - name: web + borg_passphrase: "{{ hserve1_backup_web_crypted_password }}" + paths_to_backup: + - "/home/{{ ansible_user }}/web" + - name: test + borg_passphrase: "dummy_secret" + paths_to_backup: + - "/home/{{ ansible_user }}" + - "/proc/version" \ No newline at end of file diff --git a/ansible/playbooks/borg_server.yaml b/ansible/playbooks/borg_server.yaml index ffdd33b..a261dcf 100644 --- a/ansible/playbooks/borg_server.yaml +++ b/ansible/playbooks/borg_server.yaml @@ -1,28 +1,30 @@ --- -- hosts: backup01.srv.local - vars: - user: backup - group: backup - home: /home/backup - pool: "{{ home }}/repos" - auth_users: - - host: johndoe.clnt.local - key: "{{ lookup('file', '/path/to/keys/johndoe.clnt.local.pub') }}" - - host: web01.clnt.local - key: "{{ lookup('file', '/path/to/keys/web01.clnt.local.pub') }}" - - host: app01.clnt.local - key: "{{ lookup('file', '/path/to/keys/app01.clnt.local.pub') }}" +- name: Evaluate borg client nodes + hosts: all + gather_facts: false tasks: - - package: name=borg state=present - - group: name="{{ group }}" state=present - - user: name="{{ user }}" shell=/bin/bash home="{{ home }}" createhome=yes group="{{ group }}" groups= state=present - - file: path="{{ home }}" owner="{{ user }}" group="{{ group }}" mode=0700 state=directory - - file: path="{{ home }}/.ssh" owner="{{ user }}" group="{{ group }}" mode=0700 state=directory - - file: path="{{ pool }}" owner="{{ user }}" group="{{ group }}" mode=0700 state=directory - - authorized_key: user="{{ user }}" - key="{{ item.key }}" - key_options='command="cd {{ pool }}/{{ item.host }};borg serve --restrict-to-path {{ pool }}/{{ item.host }}",restrict' - with_items: "{{ auth_users }}" - - file: path="{{ home }}/.ssh/authorized_keys" owner="{{ user }}" group="{{ group }}" mode=0600 state=file - - file: path="{{ pool }}/{{ item.host }}" owner="{{ user }}" group="{{ group }}" mode=0700 state=directory - with_items: "{{ auth_users }}" + - name: Gather configured clients + ansible.builtin.group_by: + key: "borg_clients_{{ configure_borg_client | default('False') }}" + # Creates: borg_clients_True and borg_clients_False + + +- name: Configure borg backups system + hosts: borg_clients_True:borg + debugger: on_failed + tasks: + - name: Configure clients + include_role: + name: borg + apply: + become: true + become_exe: "{{ become_exe_value }}" + when: "{{ configure_borg_client | default(false) }} " + + - name: Configure server + include_role: + name: borg + apply: + become: true + become_exe: "{{ become_exe_value }}" + when: "{{ configure_borg_server | default(false) }} " \ No newline at end of file diff --git a/ansible/playbooks/roles/borg/defaults/main.yaml b/ansible/playbooks/roles/borg/defaults/main.yaml index 6e160ce..f3c36b4 100644 --- a/ansible/playbooks/roles/borg/defaults/main.yaml +++ b/ansible/playbooks/roles/borg/defaults/main.yaml @@ -1,10 +1,8 @@ --- borg_user: borg borg_group: borg -borg_home: /home/borg +borg_home: "/home/{{ borg_user }}" borg_pool: "{{ borg_home }}/repos" borg_pool_dest : /usr/backups/borg_repos -auth_users: - - host: hserve1 - # Chiave di esempio per test - key: "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArNhKFcJ6T08sn7kTTLf+rO9HEvgOvqfhv5HQ2sRf2tFYfjfCb0zHKnMkgW+sy5gMU10Lyx1r7juXCvqRC955uIM97m1B1Xc6sVqASVKuGPhCKfhxEaMAyBcWFdE+HYbCOPYVN+JMrcwWfbblwiZTtK1OCqaEUvDDI7cFeU68noXwggEp46T48eqMUdi541D9Y+BVx9HYAo6OCQz0+6eXwxJL+tpRcAAXIMMWv362CYHoOgIU45R7xVSMLY1k/HLrcEAblwxEaSpduCH5cWUXZE/56IyxpvP44BxZkVhNdqJLmg4hxBQWhoMNYiTZxbLay3W2TwBCM111cAtUx4M/jQ==" \ No newline at end of file +borg_repo_base: "ssh://{{ borg_user }}@{{ borg_backup_server }}/./" +borg_auth_users: [] \ No newline at end of file diff --git a/ansible/playbooks/roles/borg/tasks/configure_borg_client.yaml b/ansible/playbooks/roles/borg/tasks/configure_borg_client.yaml index e69de29..f41749b 100644 --- a/ansible/playbooks/roles/borg/tasks/configure_borg_client.yaml +++ b/ansible/playbooks/roles/borg/tasks/configure_borg_client.yaml @@ -0,0 +1,44 @@ +--- +- name: Define backup script + ansible.builtin.template: + dest: "/home/{{borg_user}}/backup_script.sh" + src: templates/backup_script.sh.j2 + owner: root + mode: "0701" + +- name: Define backup service + ansible.builtin.template: + dest: /etc/systemd/system/borg_backup.service + src: templates/borg_backup.service.j2 + owner: root + mode: "0700" + + +- name: Define backup timer + ansible.builtin.copy: + content: | + [Unit] + Description=Daily Backup Timer + + [Timer] + OnCalendar=*-*-* 02:00:00 + Persistent=true + RandomizedDelaySec=300 + + [Install] + WantedBy=timers.target + dest: /etc/systemd/system/borg_backup.timer + +- name: Reload systemd + ansible.builtin.systemd_service: + daemon_reload: true + +# Add entry in borg_auth_users for server configuration +# borg_auth_users: +# - host: fabotest +# # Chiave di esempio per test +# key: "ssh-rsa ****" + +- name: Register public key for server configuration + set_fact: + borg_auth_users: "{{ borg_auth_users + [{'host': inventory_hostname, 'key':borg_user_definition.ssh_public_key}] }}" diff --git a/ansible/playbooks/roles/borg/tasks/configure_borg_server.yaml b/ansible/playbooks/roles/borg/tasks/configure_borg_server.yaml index 06ee884..a571410 100644 --- a/ansible/playbooks/roles/borg/tasks/configure_borg_server.yaml +++ b/ansible/playbooks/roles/borg/tasks/configure_borg_server.yaml @@ -1,46 +1,52 @@ --- -- name: Set borg user group - group: - name: "{{ borg_group }}" - state: present - -- name: Set borg user - user: - name: "{{ borg_user }}" - shell: /bin/bash - home: "{{ borg_home }}" - createhome: yes - group: "{{ borg_group }}" - state: present - -- name: Set home directory - file: - path: "{{ borg_home }}" - owner: "{{ borg_user }}" - group: "{{ borg_group }}" - mode: "0700" +- name: Set ssh directory + file: + path: "{{ borg_home }}/.ssh" + owner: "{{ borg_user }}" + group: "{{ borg_group }}" + mode: "0700" state: directory -- name: Set ssh directory - file: - path: "{{ borg_home }}/.ssh" - owner: "{{ borg_user }}" - group: "{{ borg_group }}" - mode: "0700" +- name: Create pool directory + file: + path: "{{ borg_pool_dest}}" + owner: "{{ borg_user }}" + group: "{{ borg_group }}" + mode: "0700" state: directory - name: Set pool directory link file: - src: "{{ borg_pool }}" - dest: "{{ borg_pool_dest }}" - state: link + src: "{{ borg_pool_dest }}" + dest: "{{ borg_pool }}" + state: link - -- name: Add authorized keys - authorized_key: - user: "{{ borg_user }}" - key: "{{ item.key }}" - key_options: "command=cd {{ borg_pool }}/{{ item.host }};borg serve --restrict-to-path {{ borg_pool }}/{{ item.host }},restrict" + +- name: Gathering clients configurations + set_fact: + borg_auth_users: "{{ borg_auth_users + hostvars[item]['borg_auth_users']}}" + loop: "{{ groups['borg_clients_True'] }}" + +- name: Creating pool sub directories + file: + path: "{{ borg_pool }}/{{ item.host }}" + owner: "{{ borg_user }}" + group: "{{ borg_group }}" + mode: "0700" + state: directory with_items: "{{ borg_auth_users }}" +- name: Defining authorized_key + authorized_key: + user: "{{ borg_user }}" + key: "{{ item.key }}" + key_options: "command=\"cd {{ borg_pool }}/{{ item.host }};borg serve --restrict-to-path {{ borg_pool }}/{{ item.host }}\",restrict" + with_items: "{{ borg_auth_users }}" +- name: Setting authorized keys file + file: + path: "{{ borg_home }}/.ssh/authorized_keys" + owner: "{{ borg_user }}" + group: "{{ borg_group }}" + mode: "0600" + state: file diff --git a/ansible/playbooks/roles/borg/tasks/main.yaml b/ansible/playbooks/roles/borg/tasks/main.yaml index e493ba7..2a6eaef 100644 --- a/ansible/playbooks/roles/borg/tasks/main.yaml +++ b/ansible/playbooks/roles/borg/tasks/main.yaml @@ -1,8 +1,9 @@ --- -include_tasks: prepare_borg.yaml -include_tasks: configure_borg_server.yaml - when: - - configure_borg_server -include_tasks: configure_borg_client.yaml - when: - - configure_borg_client \ No newline at end of file +- name: Prepare borg + include_tasks: prepare_borg.yaml +- name: Configure server + include_tasks: configure_borg_server.yaml + when: "{{ configure_borg_server | default(false) }}" +- name: Configure client + include_tasks: configure_borg_client.yaml + when: "{{ configure_borg_client | default(false) }} " diff --git a/ansible/playbooks/roles/borg/tasks/prepare_borg.yaml b/ansible/playbooks/roles/borg/tasks/prepare_borg.yaml index 89a8adb..4981712 100644 --- a/ansible/playbooks/roles/borg/tasks/prepare_borg.yaml +++ b/ansible/playbooks/roles/borg/tasks/prepare_borg.yaml @@ -1,6 +1,21 @@ --- -- name: Install borg and requirements -- package: - name: borg +- name: Install borg and requirements + ansible.builtin.package: + name: borgbackup state: present +- name: Set borg user group + group: + name: "{{ borg_group }}" + state: present + +- name: Set borg user + user: + name: "{{ borg_user }}" + shell: /bin/bash + home: "{{ borg_home }}" + create_home: true + group: "{{ borg_group }}" + state: present + generate_ssh_key: "{{ configure_borg_client | default(false) }}" + register: borg_user_definition \ No newline at end of file