0ade1c740f
Implements the two decoupled backup streams from docs/06 as an idempotent
Ansible role wired into the host playbook:
- Files: sanoid takes/prunes ZFS snapshots per policy (sanoid_datasets) on
its packaged timer; syncoid replicates offsite (heleos-zfs-offsite),
enabled only when zfs_offsite_target is set.
- DB: heleos-db-backup (nightly systemd timer) walks the deployments dir and
dumps each DB-backed site via `docker exec mariadb-dump` into
db-backups/<customer>/<site>/{daily,weekly,monthly} with rotation
(automysqlbackup-style, adapted for the containerized DB; MYSQL_PWD keeps
the password out of the process list). heleos-db-offsite rsyncs offsite
when db_offsite_target is set.
Streams and schedules are configured in group_vars/all.yml; offsite is
opt-in via the two target vars. Updates doc 06 (implementation note), the
ansible README, and CLAUDE.md status. YAML + templates validated by render.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
24 lines
590 B
YAML
24 lines
590 B
YAML
---
|
|
# heleos platform — host baseline (Phase 1)
|
|
# Usage:
|
|
# ansible-galaxy collection install -r requirements.yml
|
|
# ansible-playbook site.yml
|
|
#
|
|
# Roles run in dependency order: base packages → ZFS pool/datasets → Docker
|
|
# (data-root on ZFS) → firewall → SSH hardening.
|
|
- name: heleos host baseline
|
|
hosts: hosting
|
|
become: true
|
|
roles:
|
|
- role: base
|
|
tags: [base]
|
|
- role: zfs
|
|
tags: [zfs]
|
|
- role: docker
|
|
tags: [docker]
|
|
- role: firewall
|
|
tags: [firewall]
|
|
- role: ssh_hardening
|
|
tags: [ssh]
|
|
- role: backup
|
|
tags: [backup]
|