data.coop/ansible
8
3
Fork 7
Code Issues 49 Pull requests 9 Projects 1 Releases Wiki Activity

Use Fedder's TrueNAS for Restic backups #153

Merged
samsapti merged 8 commits from restic_fedder into main 2023-03-05 22:01:54 +00:00
Conversation 1 Commits 8 Files changed 5 +12 -6
2 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit 00f03ec5a8 - Show all commits

1
roles/docker/defaults/main.yml
View file

@ -53,7 +53,6 @@ services:
domain: "rynkeby.skovgaard.tel"
volume_folder: "{{ volume_root_folder }}/restic"
repository: "/mnt/SpinningRust/data.coop-backup/restic"
ssh_pubkey: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN1lNLshXytq+mx2LPzm8Neh/nrVqCR3iDXPONzBag9s restic@fedder
version: "1.6.0"
samsapti marked this conversation as resolved Outdated
reynir commented 2023-02-09 08:13:04 +00:00
Outdated
Review
Copy link

Can we derive the pubkey from the privkey in secrets? We have to update the key in two places now.

Can we derive the pubkey from the privkey in secrets? We have to update the key in two places now.
samsapti commented 2023-02-11 17:55:59 +00:00
Outdated
Review
Copy link

We probably could, I'll make the change.

We probably could, I'll make the change.
disabled_in_vagrant: true

17
roles/docker/tasks/services/restic_backup.yml
View file

@ -2,7 +2,7 @@
---
- name: Create SSH directory
file:
name: "{{ services.restic.volume_folder }}/ssh"
path: "{{ services.restic.volume_folder }}/ssh"
samsapti marked this conversation as resolved Outdated
reynir commented 2023-02-09 08:16:20 +00:00
Outdated
Review
Copy link

Shouldn't it be .ssh? Is {{ services.restic.volume_folder }} the $HOME dir of root?

Shouldn't it be `.ssh`? Is `{{ services.restic.volume_folder }}` the `$HOME` dir of root?
samsapti commented 2023-02-11 17:40:43 +00:00
Outdated
Review
Copy link

No, it evaluates to /docker-volumes/restic/ssh. It doesn't need to be in root's $HOME, and I also think it's better to place it in Restic's folder, since this is the only service that uses it. It also doesn't need to be hidden, since we can bind mount it to a different name inside the container (also this makes it visible with a simple ls).

No, it evaluates to `/docker-volumes/restic/ssh`. It doesn't need to be in root's `$HOME`, and I also think it's better to place it in Restic's folder, since this is the only service that uses it. It also doesn't need to be hidden, since we can bind mount it to a different name inside the container (also this makes it visible with a simple `ls`).
owner: root
samsapti marked this conversation as resolved
reynir commented 2023-02-09 08:14:02 +00:00
Review
Copy link

It's probably correct seeing what most containers do, but we could confirm it's running as root.

It's probably correct seeing what most containers do, but we could confirm it's running as root.
samsapti commented 2023-02-11 17:41:57 +00:00
Review
Copy link

It's also possible with this location, since mode: '0700' denies read permission for everyone else.

It's also possible with this location, since `mode: '0700'` denies read permission for everyone else.
group: root
mode: '0700'
@ -16,13 +16,20 @@
mode: '0600'
content: "{{ restic_secrets.ssh_privkey }}"
- name: Copy public SSH key
copy:
dest: "{{ services.restic.volume_folder }}/ssh/id_ed25519.pub"
- name: Derive public SSH key
shell: >
ssh-keygen -f {{ services.restic.volume_folder }}/ssh/id_ed25519 -y
> {{ services.restic.volume_folder }}/ssh/id_ed25519.pub
args:
creates: "{{ services.restic.volume_folder }}/ssh/id_ed25519.pub"
- name: Set file permissions on public SSH key
file:
path: "{{ services.restic.volume_folder }}/ssh/id_ed25519.pub"
owner: root
group: root
mode: '0644'
content: "{{ services.restic.ssh_pubkey }}"
state: touch
- name: Setup restic backup
docker_compose: