5 files changed, 72 insertions, 0 deletions
diff --git a/roles/backup/templates/backup-openrc.sh.j2 b/roles/backup/templates/backup-openrc.sh.j2
new file mode 100644
index 00000000..85dc8d1e
--- /dev/null
+++ b/roles/backup/templates/backup-openrc.sh.j2
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# shellcheck source=/dev/null
+source "/etc/credstore/{{ backup_name }}-backup.env"
+
+export RESTIC_REPOSITORY="${BACKUP_REPO}"
+export RESTIC_PASSWORD="${BACKUP_PASSWORD}"
+export AWS_ACCESS_KEY_ID="${BACKUP_ACCESS_KEY_ID}"
+export AWS_SECRET_ACCESS_KEY="${BACKUP_SECRET_ACCESS_KEY}"
+export CACHE_DIR="/var/cache/{{ backup_name }}-backup"
+
+# -p (--preserve-environment) -s (--shell): busybox su has no long-form flags
+exec su -p -s /bin/sh {{ backup_user }} <<'BACKUP_SU_EOF'
+restic --cache-dir "$CACHE_DIR" snapshots &>/dev/null || restic --cache-dir "$CACHE_DIR" init
+
+restic --cache-dir "$CACHE_DIR" backup {{ backup_paths | map('quote') | join(' ') }}
+
+restic --cache-dir "$CACHE_DIR" forget \
+  --keep-daily {{ backup_retention_daily }} \
+  --keep-weekly {{ backup_retention_weekly }} \
+  --keep-monthly {{ backup_retention_monthly }} \
+  --prune
+BACKUP_SU_EOF
diff --git a/roles/backup/templates/backup-systemd.sh.j2 b/roles/backup/templates/backup-systemd.sh.j2
new file mode 100644
index 00000000..24be22ea
--- /dev/null
+++ b/roles/backup/templates/backup-systemd.sh.j2
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# shellcheck source=/dev/null
+source "${CREDENTIALS_DIRECTORY}/{{ backup_name }}-backup.env"
+
+export RESTIC_REPOSITORY="${BACKUP_REPO}"
+export RESTIC_PASSWORD="${BACKUP_PASSWORD}"
+export AWS_ACCESS_KEY_ID="${BACKUP_ACCESS_KEY_ID}"
+export AWS_SECRET_ACCESS_KEY="${BACKUP_SECRET_ACCESS_KEY}"
+
+CACHE_DIR="/var/cache/{{ backup_name }}-backup"
+
+restic --cache-dir "$CACHE_DIR" snapshots &>/dev/null || restic --cache-dir "$CACHE_DIR" init
+
+restic --cache-dir "$CACHE_DIR" backup {{ backup_paths | map('quote') | join(' ') }}
+
+restic --cache-dir "$CACHE_DIR" forget \
+  --keep-daily {{ backup_retention_daily }} \
+  --keep-weekly {{ backup_retention_weekly }} \
+  --keep-monthly {{ backup_retention_monthly }} \
+  --prune
diff --git a/roles/backup/templates/backup.env.j2 b/roles/backup/templates/backup.env.j2
new file mode 100644
index 00000000..8557501e
--- /dev/null
+++ b/roles/backup/templates/backup.env.j2
@@ -0,0 +1,4 @@
+BACKUP_REPO="{{ backup_repo }}/{{ backup_name }}"
+BACKUP_PASSWORD="{{ backup_password }}"
+BACKUP_ACCESS_KEY_ID="{{ backup_access_key_id }}"
+BACKUP_SECRET_ACCESS_KEY="{{ backup_secret_access_key }}"
diff --git a/roles/backup/templates/backup.service.j2 b/roles/backup/templates/backup.service.j2
new file mode 100644
index 00000000..f35940b8
--- /dev/null
+++ b/roles/backup/templates/backup.service.j2
@@ -0,0 +1,13 @@
+[Unit]
+Description=Backup {{ backup_name }}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/{{ backup_name }}-backup
+User={{ backup_user }}
+Group={{ backup_group }}
+StandardOutput=journal
+StandardError=journal
+LoadCredential={{ backup_name }}-backup.env:/etc/credstore/{{ backup_name }}-backup.env
diff --git a/roles/backup/templates/backup.timer.j2 b/roles/backup/templates/backup.timer.j2
new file mode 100644
index 00000000..74e5276d
--- /dev/null
+++ b/roles/backup/templates/backup.timer.j2
@@ -0,0 +1,9 @@
+[Unit]
+Description=Backup {{ backup_name }} timer
+
+[Timer]
+OnCalendar={{ backup_systemd_schedule }}
+Persistent=true
+
+[Install]
+WantedBy=timers.target