backup

1---
2# Pinned restic client, installed from the upstream release and verified
3# against its published checksum. The distro package (if any) is left alone;
4# every task here calls backup_restic_bin explicitly.
5
6- name: Map the CPU architecture to the restic release name
7  ansible.builtin.set_fact:
8    _restic_arch: "{{ {'x86_64': 'amd64', 'aarch64': 'arm64'}[ansible_architecture] }}"
9
10- name: Check the installed restic version
11  ansible.builtin.command: "{{ backup_restic_bin }} version"
12  register: _restic_installed
13  changed_when: false
14  failed_when: false
15  check_mode: false
16
17- name: Install restic {{ backup_restic_version }}
18  when: ("restic " ~ backup_restic_version ~ " ") not in (_restic_installed.stdout | default(''))
19  block:
20    - name: Download restic {{ backup_restic_version }}
21      ansible.builtin.get_url:
22        url: "https://github.com/restic/restic/releases/download/v{{ backup_restic_version }}/restic_{{ backup_restic_version }}_linux_{{ _restic_arch }}.bz2"
23        dest: "/tmp/restic_{{ backup_restic_version }}_{{ _restic_arch }}.bz2"
24        checksum: "sha256:{{ backup_restic_checksums[_restic_arch] }}"
25        mode: '0600'
26
27    - name: Unpack restic
28      ansible.builtin.shell: >-
29        bunzip2 -c /tmp/restic_{{ backup_restic_version }}_{{ _restic_arch }}.bz2
30        > {{ backup_restic_bin }}.new && chmod 0755 {{ backup_restic_bin }}.new
31        && mv {{ backup_restic_bin }}.new {{ backup_restic_bin }}
32      changed_when: true
33
34    - name: Remove the download
35      ansible.builtin.file:
36        path: "/tmp/restic_{{ backup_restic_version }}_{{ _restic_arch }}.bz2"
37        state: absent
38
39- name: Check that the repository is reachable
40  ansible.builtin.command: "{{ backup_restic_bin }} cat config"
41  environment:
42    RESTIC_REPOSITORY: "{{ restic_repo }}"
43    RESTIC_PASSWORD: "{{ restic_password }}"
44  register: _restic_cat
45  changed_when: false
46  failed_when: false
47  check_mode: false
48  no_log: true
49
50# Only ever initialises a repository that does not exist. Any other error
51# (wrong password, server down) fails here instead of creating a second repo.
52- name: Initialize the repository if it does not exist yet
53  ansible.builtin.command: "{{ backup_restic_bin }} init"
54  environment:
55    RESTIC_REPOSITORY: "{{ restic_repo }}"
56    RESTIC_PASSWORD: "{{ restic_password }}"
57  when:
58    - _restic_cat.rc != 0
59    - "'does not exist' in (_restic_cat.stderr | default(''))"
60  no_log: true
61
62- name: Fail if the repository is not usable
63  ansible.builtin.fail:
64    msg: "restic repository not usable (rc={{ _restic_cat.rc }}): {{ _restic_cat.stderr | default('') | regex_replace('rest:[^ ]*', 'rest:<repo>') }}"
65  when:
66    - _restic_cat.rc != 0
67    - "'does not exist' not in (_restic_cat.stderr | default(''))"
68