71 lines
2.1 KiB
YAML
71 lines
2.1 KiB
YAML
---
|
|
# Automated Raft snapshots via a systemd timer + a scoped periodic token.
|
|
|
|
- name: Write the snapshot policy (read raft snapshots only)
|
|
ansible.builtin.command: "bao policy write snapshot -"
|
|
args:
|
|
stdin: "{{ lookup('template', 'snapshot-policy.hcl.j2') }}"
|
|
environment: "{{ openbao_cli_env }}"
|
|
register: snap_pol
|
|
changed_when: snap_pol.rc == 0
|
|
no_log: "{{ openbao_no_log }}"
|
|
# Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
|
|
when: not openbao_config_managed_by_terraform | bool
|
|
|
|
- name: Check whether the snapshot token already exists
|
|
ansible.builtin.stat:
|
|
path: /etc/openbao/snapshot.token
|
|
register: snap_tok_stat
|
|
|
|
- name: Create or explicitly rotate the periodic snapshot token
|
|
ansible.builtin.command: "bao token create -policy=snapshot -period=768h -orphan -field=token"
|
|
environment: "{{ openbao_cli_env }}"
|
|
register: snap_tok_new
|
|
when: (not snap_tok_stat.stat.exists) or (openbao_snapshot_rotate_token | bool)
|
|
changed_when: snap_tok_new.rc == 0
|
|
no_log: true
|
|
|
|
- name: Store the snapshot token (root-only)
|
|
ansible.builtin.copy:
|
|
content: "{{ snap_tok_new.stdout }}"
|
|
dest: /etc/openbao/snapshot.token
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
when: (not snap_tok_stat.stat.exists) or (openbao_snapshot_rotate_token | bool)
|
|
no_log: true
|
|
|
|
- name: Ensure the snapshot output directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ openbao_snapshot_dir }}"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0700"
|
|
|
|
- name: Install the snapshot script
|
|
ansible.builtin.template:
|
|
src: bao-snapshot.sh.j2
|
|
dest: /usr/local/bin/bao-snapshot.sh
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Install the snapshot systemd service + timer
|
|
ansible.builtin.template:
|
|
src: "{{ item }}.j2"
|
|
dest: "/etc/systemd/system/{{ item }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
loop:
|
|
- openbao-snapshot.service
|
|
- openbao-snapshot.timer
|
|
|
|
- name: Enable and start the snapshot timer
|
|
ansible.builtin.systemd:
|
|
name: openbao-snapshot.timer
|
|
state: started
|
|
enabled: true
|
|
daemon_reload: true
|