From ded892e34378c3675717384decebbf87e3f70039 Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Mon, 22 Jun 2026 16:55:49 +0200
Subject: Add garage to rpi to use as s3-compatible backend for backups

---
 roles/garage/tasks/main.yml | 106 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 106 insertions(+)
 create mode 100644 roles/garage/tasks/main.yml

(limited to 'roles/garage/tasks')

diff --git a/roles/garage/tasks/main.yml b/roles/garage/tasks/main.yml
new file mode 100644
index 00000000..5ab27b49
--- /dev/null
+++ b/roles/garage/tasks/main.yml
@@ -0,0 +1,106 @@
+---
+- name: "Install garage binary"
+  become: true
+  vars:
+    garage_arch: "{{ ansible_facts['architecture'] }}-unknown-linux-musl"
+    garage_url: "https://garagehq.deuxfleurs.fr/_releases/v{{ garage_version }}/{{ garage_arch }}/garage"
+  block:
+    - name: "Check if garage is installed"
+      ansible.builtin.stat:
+        path: "/usr/local/bin/garage"
+      register: garage_binary_check
+
+    - name: "Download garage binary"
+      when: not garage_binary_check.stat.exists
+      ansible.builtin.get_url:
+        url: "{{ garage_url }}"
+        dest: "/usr/local/bin/garage"
+        mode: "0755"
+        owner: "root"
+        group: "root"
+
+- name: "Configure garage"
+  become: true
+  block:
+    - name: "Create garage group"
+      ansible.builtin.group:
+        name: "garage"
+        system: true
+
+    - name: "Create garage user"
+      ansible.builtin.user:
+        name: "garage"
+        group: "garage"
+        system: true
+        shell: "/usr/sbin/nologin"
+        create_home: false
+
+    - name: "Create garage config directory"
+      ansible.builtin.file:
+        path: "/etc/garage"
+        state: "directory"
+        owner: "root"
+        group: "garage"
+        mode: "0750"
+
+    - name: "Create garage data directory"
+      ansible.builtin.file:
+        path: "{{ garage_data_dir }}"
+        state: "directory"
+        owner: "garage"
+        group: "garage"
+        mode: "0750"
+
+    - name: "Create garage meta directory"
+      ansible.builtin.file:
+        path: "{{ garage_meta_dir }}"
+        state: "directory"
+        owner: "garage"
+        group: "garage"
+        mode: "0750"
+
+    - name: "Create garage configuration file"
+      ansible.builtin.template:
+        src: "garage.toml.j2"
+        dest: "/etc/garage/garage.toml"
+        owner: "root"
+        group: "garage"
+        mode: "0640"
+      no_log: true
+      notify: "Restart garage"
+
+    - name: "Create garage systemd service"
+      ansible.builtin.template:
+        src: "garage.service.j2"
+        dest: "/etc/systemd/system/garage.service"
+        owner: "root"
+        group: "root"
+        mode: "0644"
+      notify: "Restart garage"
+
+    - name: "Start and enable garage"
+      ansible.builtin.systemd_service:
+        name: "garage"
+        state: "started"
+        enabled: true
+        daemon_reload: true
+
+- name: "Provision garage bucket and key"
+  become: true
+  block:
+    - name: "Deploy provision script"
+      ansible.builtin.template:
+        src: "garage-provision.sh.j2"
+        dest: "/etc/garage/provision.sh"
+        owner: "root"
+        group: "garage"
+        mode: "0750"
+      no_log: true
+
+    # Script is idempotent via internal state checks but always reports changed
+    - name: "Run provision script"
+      ansible.builtin.command:
+        cmd: "/etc/garage/provision.sh"
+      changed_when: true
+      tags:
+        - molecule-idempotence-notest
-- 
cgit v1.2.3