server_automation

1---
2# ============================================================================
3# Backup Playbook - restic, every backup client, one run
4# ============================================================================
5#
6# What is backed up (configured in group_vars/all/backup.yml + host_vars):
7#   - every /docker/<service> on the hosts in [backup_clients], minus skips,
8#     with caches/models excluded. Running containers are stopped for their
9#     own backup and exactly those are started again afterwards.
10#   - data paths outside /docker (storage: git repos, photos, Nextcloud, ...)
11#   - Home Assistant (full backup) and the OPNsense config (homeassistant)
12#
13# Then, once, on the repository host: forget + prune with the retention
14# policy, an integrity check reading a share of the data, an optional
15# off-site copy, and a report to Home Assistant (sensor.homelab_backup_*).
16#
17# The run FAILS if any item failed, a client was unreachable, or the
18# repository check failed - after the report has been published.
19#
20# USAGE:
21#   Full backup (scheduled weekly in Semaphore):
22#     ansible-playbook backup.yml
23#   Only some services (maintenance + report still run):
24#     ansible-playbook backup.yml -e backup_services=mealie,tandoor --limit runner,storage
25#   Restore one service from its latest snapshot on that host:
26#     ansible-playbook backup.yml -e backup_mode=restore -e backup_services=mealie --limit runner
27#
28# ============================================================================
29
30- name: Back up all clients
31  hosts: backup_clients
32  become: true
33  gather_facts: true
34  # An unreachable client must not abort the run: it is reported as missed
35  # by the maintenance stage, which then fails the run.
36  ignore_unreachable: true
37
38  tasks:
39    - name: Run the backup role
40      ansible.builtin.include_role:
41        name: backup
42
43- name: Repository maintenance and report
44  hosts: "{{ backup_repository_host | default('storage') }}"
45  become: true
46  gather_facts: true
47
48  tasks:
49    - name: Forget, prune, check, report
50      ansible.builtin.include_role:
51        name: backup
52        tasks_from: maintenance
53      vars:
54        # Full run: every client is expected, so an unreachable one counts as
55        # missed. With --limit (host names), only the named clients are.
56        backup_client_hosts: >-
57          {{ groups['backup_clients'] if ansible_limit is not defined
58             else groups['backup_clients'] | select('in', ansible_limit.split(',')) | list }}
59      when: backup_mode | default('backup') == 'backup'
60