0ade1c740f
Implements the two decoupled backup streams from docs/06 as an idempotent
Ansible role wired into the host playbook:
- Files: sanoid takes/prunes ZFS snapshots per policy (sanoid_datasets) on
its packaged timer; syncoid replicates offsite (heleos-zfs-offsite),
enabled only when zfs_offsite_target is set.
- DB: heleos-db-backup (nightly systemd timer) walks the deployments dir and
dumps each DB-backed site via `docker exec mariadb-dump` into
db-backups/<customer>/<site>/{daily,weekly,monthly} with rotation
(automysqlbackup-style, adapted for the containerized DB; MYSQL_PWD keeps
the password out of the process list). heleos-db-offsite rsyncs offsite
when db_offsite_target is set.
Streams and schedules are configured in group_vars/all.yml; offsite is
opt-in via the two target vars. Updates doc 06 (implementation note), the
ansible README, and CLAUDE.md status. YAML + templates validated by render.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| ansible | ||
| stacks | ||
| README.md | ||
platform-infra
Host baseline and platform services as code.
ansible/ — Phase 1 host baseline ✅
Idempotent Ubuntu 24.04 host config. See ansible/README.md for how to run it.
Roles: base (packages, timezone, unattended-upgrades) → zfs (pool on a
dedicated disk + platform datasets) → docker (Engine + Compose, data-root on
ZFS, zfs storage driver) → firewall (nftables inbound + container SMTP egress
block) → ssh_hardening (key-first SSH, sftponly group).
Planned (later phases)
- Phase 2 base compose projects: Traefik, shared MariaDB, Forgejo + registry, Prometheus/Grafana/Loki, Uptime-Kuma.
- Phase 5 Ansible: automysqlbackup, ZFS snapshot/
sendjobs.