diff options
| author | Ahmed Abdelhalim <[email protected]> | 2026-07-26 04:37:33 +0200 |
|---|---|---|
| committer | Ahmed Abdelhalim <[email protected]> | 2026-07-26 04:37:33 +0200 |
| commit | eff183dc63d470e969f7a64e8ff68c00bdf87d54 (patch) | |
| tree | 04e7e449bc5cc635d6c10458bd546a3580945d9a /roles | |
| parent | 0fa75ea8e374b39ac80d3a5e4bed51bb392ba752 (diff) | |
Decouple restore and backup directories to avoid permission issues
Restore now uses /var/cache/git-restore (root-owned),
backup keeps /var/cache/git-backup (backup-owned)
Co-Authored-By: Claude.ai
Diffstat (limited to 'roles')
| -rw-r--r-- | roles/backup/tasks/main.yml | 12 | ||||
| -rw-r--r-- | roles/backup/templates/restore.sh.j2 | 2 |
2 files changed, 13 insertions, 1 deletions
diff --git a/roles/backup/tasks/main.yml b/roles/backup/tasks/main.yml index d51d3562..e21b8aaa 100644 --- a/roles/backup/tasks/main.yml +++ b/roles/backup/tasks/main.yml @@ -50,6 +50,18 @@ ansible.builtin.include_tasks: "openrc.yml" when: ansible_facts['service_mgr'] == "openrc" +- name: "Create restic restore cache directory" + become: true + ansible.builtin.file: + path: "/var/cache/{{ backup_name }}-restore" + state: "directory" + owner: "root" + group: "root" + mode: "0700" + tags: + - "never" + - "restore" + - name: "Deploy restore script" become: true ansible.builtin.template: diff --git a/roles/backup/templates/restore.sh.j2 b/roles/backup/templates/restore.sh.j2 index 35428693..44334138 100644 --- a/roles/backup/templates/restore.sh.j2 +++ b/roles/backup/templates/restore.sh.j2 @@ -20,7 +20,7 @@ export AWS_SECRET_ACCESS_KEY="${BACKUP_SECRET_ACCESS_KEY}" # --target /, as a guardrail against unbounded deletion, so scope it to # exactly the paths this job backs up. restic restore "{{ backup_restore_id }}" \ - --cache-dir "/var/cache/{{ backup_name }}-backup" \ + --cache-dir "/var/cache/{{ backup_name }}-restore" \ --target "{{ restore_target }}" \ --delete \ --include {{ backup_paths | map('quote') | join(' --include ') }} |