3 files changed, 115 insertions, 0 deletions
diff --git a/roles/backup/tasks/main.yml b/roles/backup/tasks/main.yml
new file mode 100644
index 00000000..3859a0b2
--- /dev/null
+++ b/roles/backup/tasks/main.yml
@@ -0,0 +1,51 @@
+---
+- name: "Create backup group"
+  become: true
+  ansible.builtin.group:
+    name: "{{ backup_group }}"
+    system: true
+
+- name: "Create backup user"
+  become: true
+  ansible.builtin.user:
+    name: "{{ backup_user }}"
+    group: "{{ backup_group }}"
+    system: true
+    shell: "/sbin/nologin"
+    create_home: false
+
+- name: "Create restic cache directory"
+  become: true
+  ansible.builtin.file:
+    path: "/var/cache/{{ backup_name }}-backup"
+    state: "directory"
+    owner: "{{ backup_user }}"
+    group: "{{ backup_group }}"
+    mode: "0700"
+
+- name: "Create credential store directory"
+  become: true
+  ansible.builtin.file:
+    path: "/etc/credstore"
+    state: "directory"
+    owner: "root"
+    group: "root"
+    mode: "0700"
+
+- name: "Deploy backup credentials"
+  become: true
+  ansible.builtin.template:
+    src: "backup.env.j2"
+    dest: "/etc/credstore/{{ backup_name }}-backup.env"
+    owner: "root"
+    group: "root"
+    mode: "0600"
+  no_log: true
+
+- name: "Schedule backup via systemd"
+  ansible.builtin.include_tasks: "systemd.yml"
+  when: ansible_facts['service_mgr'] == "systemd"
+
+- name: "Schedule backup via cron"
+  ansible.builtin.include_tasks: "openrc.yml"
+  when: ansible_facts['service_mgr'] == "openrc"
diff --git a/roles/backup/tasks/openrc.yml b/roles/backup/tasks/openrc.yml
new file mode 100644
index 00000000..12ea9686
--- /dev/null
+++ b/roles/backup/tasks/openrc.yml
@@ -0,0 +1,27 @@
+---
+- name: "Deploy backup script"
+  become: true
+  ansible.builtin.template:
+    src: "backup-openrc.sh.j2"
+    dest: "/usr/local/bin/{{ backup_name }}-backup"
+    owner: "root"
+    group: "root"
+    mode: "0755"
+
+- name: "Deploy backup crontab entry"
+  become: true
+  ansible.builtin.blockinfile:
+    path: "/etc/crontabs/root"
+    marker: "# {mark} ANSIBLE BACKUP {{ backup_name }} CRON"
+    block: "{{ backup_cron_schedule }} /usr/local/bin/{{ backup_name }}-backup"
+    create: true
+    owner: "root"
+    group: "root"
+    mode: "0600"
+
+- name: "Enable and start crond"
+  become: true
+  ansible.builtin.service:
+    name: "crond"
+    enabled: true
+    state: "started"
diff --git a/roles/backup/tasks/systemd.yml b/roles/backup/tasks/systemd.yml
new file mode 100644
index 00000000..bfa85f56
--- /dev/null
+++ b/roles/backup/tasks/systemd.yml
@@ -0,0 +1,37 @@
+---
+- name: "Deploy backup script"
+  become: true
+  ansible.builtin.template:
+    src: "backup-systemd.sh.j2"
+    dest: "/usr/local/bin/{{ backup_name }}-backup"
+    owner: "root"
+    group: "root"
+    mode: "0755"
+
+- name: "Deploy backup systemd service"
+  become: true
+  ansible.builtin.template:
+    src: "backup.service.j2"
+    dest: "/etc/systemd/system/{{ backup_name }}-backup.service"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  notify: "Reload systemd"
+
+- name: "Deploy backup systemd timer"
+  become: true
+  ansible.builtin.template:
+    src: "backup.timer.j2"
+    dest: "/etc/systemd/system/{{ backup_name }}-backup.timer"
+    owner: "root"
+    group: "root"
+    mode: "0644"
+  notify: "Reload systemd"
+
+- name: "Enable and start backup timer"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "{{ backup_name }}-backup.timer"
+    enabled: true
+    state: "started"
+    daemon_reload: true