44 lines
1.5 KiB
YAML
44 lines
1.5 KiB
YAML
---
|
|
# Automated Raft snapshots via a systemd timer + a scoped periodic token.
|
|
|
|
- name: Write the snapshot policy (read raft snapshots only)
|
|
ansible.builtin.command: "bao policy write snapshot -"
|
|
args:
|
|
stdin: "{{ lookup('template', 'snapshot-policy.hcl.j2') }}"
|
|
environment: "{{ openbao_cli_env }}"
|
|
register: snap_pol
|
|
changed_when: snap_pol.rc == 0
|
|
no_log: "{{ openbao_no_log }}"
|
|
# Terraform owns this (../terraform). See openbao_config_managed_by_terraform.
|
|
when: not openbao_config_managed_by_terraform | bool
|
|
|
|
- name: Check whether the snapshot token already exists
|
|
ansible.builtin.stat:
|
|
path: /etc/openbao/snapshot.token
|
|
register: snap_tok_stat
|
|
|
|
- name: Create or explicitly rotate the periodic snapshot token
|
|
ansible.builtin.command: "bao token create -policy=snapshot -period=768h -orphan -field=token"
|
|
environment: "{{ openbao_cli_env }}"
|
|
register: snap_tok_new
|
|
when: (not snap_tok_stat.stat.exists) or (openbao_snapshot_rotate_token | bool)
|
|
changed_when: snap_tok_new.rc == 0
|
|
no_log: true
|
|
|
|
- name: Store the snapshot token (root-only)
|
|
ansible.builtin.copy:
|
|
content: "{{ snap_tok_new.stdout }}"
|
|
dest: /etc/openbao/snapshot.token
|
|
owner: root
|
|
group: root
|
|
mode: "0600"
|
|
when: (not snap_tok_stat.stat.exists) or (openbao_snapshot_rotate_token | bool)
|
|
no_log: true
|
|
|
|
- name: 安装独立的主机与快照指标 exporter
|
|
ansible.builtin.include_role:
|
|
name: openbao_monitoring
|
|
|
|
- name: 部署快照脚本和定时器
|
|
ansible.builtin.import_tasks: snapshot-runtime.yml
|