meta: update collection version to 0.1.0, add community.docker as dependency

README.md

@@ -13,6 +13,9 @@ and configuring basic system utilities like gnupg, ssh etc
 
 - [`gnupg`](roles/gnupg/README.md): configures gnupg on the target system
 
+- [`lego`](roles/lego/README.md): runs [lego (LetsEncrypt Go]](https://github.com/go-acme/lego),
+  a ACME client written in go, using systemd (timers). Multi-instance capable.
+
 - [`mariadb`](roles/mariadb/README.md): runs [MariaDB Server](https://mariadb.org/), one of the world's most popular open source relational database
 
 - [`minio`](roles/minio/README.md): Deploy [min.io](https://min.io), an
@@ -24,6 +27,9 @@ and configuring basic system utilities like gnupg, ssh etc
 - [`restic`](roles/restic/README.md): Manage backups using restic
   and persist them to a configurable backend.
 
+- [`powerdns_tsig_key`](roles/powerdns_tsig_key/README.md): Simple ansible role
+  for generating TSIG keys in PowerDNS.
+
 ## License
 
 [CNPLv7+](LICENSE.md): Cooperative Nonviolent Public License

galaxy.yml

@@ -1,10 +1,12 @@
 namespace: finallycoffee
 name: base
-version: 0.0.2
+version: 0.1.0
 readme: README.md
 authors:
 - transcaffeine <transcaffeine@finally.coffee>
 description: Roles for base services which are common dependencies other services like databases
+dependencies:
+  "community.docker": "^1.10.0"
 license_file: LICENSE.md
 build_ignore:
 - '*.tar.gz'

roles/dns/README.md

@@ -0,0 +1,33 @@
+# `finallycoffee.base.dns` ansible role
+
+Simple role for wrapping around the
+[`famedly.dns.update`](https://github.com/famedly/ansible-collection-dns/blob/main/plugins/modules/update.py)
+ansible module.
+
+## Usage
+
+### Example playbook
+```yaml
+- target: "{{ target_hosts }}"
+  roles:
+    - role: finallycoffee.base.dns
+      vars:
+        dns_server: "dns.example.org"
+        dns_zone: "zone.example.org"
+        dns_records: "{{ dns_records }}"
+        dns_record_state: exact
+        dns_tsig_name: "mykeyname"
+        dns_tsig_algo: "hmac-sha256"
+        dns_tsig_key: "mykeycontent"
+  vars:
+    dns_records:
+      - type: A
+        name: gitea
+        content: "127.0.0.1"
+      - type: AAAA
+        name: gitea
+        content: "fe80::1"
+      - type: CNAME
+        name: "_acme_challenge.gitea"
+        content: "delegated-cname.challenge.example.org"
+```

roles/powerdns_tsig_key/README.md

@@ -0,0 +1,25 @@
+# `finallycoffee.base.powerdns_tsig_key`
+
+Simple ansible role for ensuring a TSIG key is present in a given PowerDNS-
+instance.
+
+## Usage
+
+The usage example below assumes `powerdns` is running in a container named `powerdns` (as supplied to `powerdns_tsig_key_container_name`.
+
+```yaml
+- hosts: "{{ target_hosts }}"
+  become: true
+  roles:
+    - role: finallycoffee.base.powerdns_tsig_key
+      vars:
+        powerdns_tsig_key_name: "nameofmykey"
+        powerdns_tsig_key_path: "/var/lib/myapp/tsig.key"
+        powernds_tsig_key_algo: "hmac-sha512"
+        powerdns_tsig_key_path_owner: "myappuser"
+        powerdns_tsig_key_path_group: "myappgroup"
+        powerdns_tsig_key_container_name: 'powerdns'
+```
+
+> [!INFO]
+> Support for non-docker deployments is pending.

roles/restic/defaults/main.yml

@@ -10,18 +10,41 @@ restic_backup_stdin_command: ~
 restic_backup_stdin_command_filename: ~
 
 restic_policy_keep_all_within: 1d
-restic_policy_keep_hourly: 6
-restic_policy_keep_daily: 2
-restic_policy_keep_weekly: 7
-restic_policy_keep_monthly: 4
+restic_policy_keep_hourly: 12
+restic_policy_keep_daily: 7
+restic_policy_keep_weekly: 6
+restic_policy_keep_monthly: 6
+restic_policy_keep_yearly: 5
 restic_policy_backup_frequency: hourly
 
+restic_base_environment:
+  RESTIC_JOBNAME: "{{ restic_job_name | default('unknown') }}"
+  RESTIC_FORGET_KEEP_WITHIN: "{{ restic_policy_keep_all_within }}"
+  RESTIC_FORGET_KEEP_HOURLY: "{{ restic_policy_keep_hourly }}"
+  RESTIC_FORGET_KEEP_DAILY: "{{ restic_policy_keep_daily }}"
+  RESTIC_FORGET_KEEP_WEEKLY: "{{ restic_policy_keep_weekly }}"
+  RESTIC_FORGET_KEEP_MONTHLY: "{{ restic_policy_keep_monthly }}"
+  RESTIC_FORGET_KEEP_YEARLY: "{{ restic_policy_keep_yearly }}"
+
+restic_s3_environment:
+  AWS_ACCESS_KEY_ID: "{{ restic_s3_key_id }}"
+  AWS_SECRET_ACCESS_KEY: "{{ restic_s3_access_key }}"
+
+restic_complete_environment: >-
+  {{
+    restic_base_environment
+    | combine((restic_s3_environment
+      if (restic_s3_key_id and restic_s3_access_key) else {}) | default({}))
+    | combine(restic_environment | default({}))
+  }}
+
 restic_policy:
   keep_within: "{{ restic_policy_keep_all_within }}"
   hourly: "{{ restic_policy_keep_hourly }}"
   daily: "{{ restic_policy_keep_daily }}"
   weekly: "{{ restic_policy_keep_weekly }}"
   monthly: "{{ restic_policy_keep_monthly }}"
+  yearly: "{{ restic_policy_keep_yearly }}"
   frequency: "{{ restic_policy_backup_frequency }}"
 
 restic_user: root

roles/restic/templates/restic.service.j2

@@ -9,26 +9,43 @@ SyslogIdentifier={{ restic_systemd_syslog_identifier }}
 
 Environment=RESTIC_REPOSITORY={{ restic_repo_url }}
 Environment=RESTIC_PASSWORD={{ restic_repo_password }}
-{% if restic_s3_key_id and restic_s3_access_key %}
-Environment=AWS_ACCESS_KEY_ID={{ restic_s3_key_id }}
-Environment=AWS_SECRET_ACCESS_KEY={{ restic_s3_access_key }}
+{% for kv in restic_complete_environment | dict2items %}
+Environment={{ kv.key }}={{ kv.value }}
+{% endfor %}
+
+{% if restic_init | default(true) %}
+ExecStartPre=-/bin/sh -c '/usr/bin/restic snapshots || /usr/bin/restic init'
 {% endif %}
 {% if restic_unlock_before_backup | default(false) %}
-ExecStartPre=-/bin/sh -c '/usr/bin/restic unlock'
+ExecStartPre=-/bin/sh -c 'sleep 3 && /usr/bin/restic unlock'
 {% endif %}
-
-ExecStartPre=-/bin/sh -c '/usr/bin/restic snapshots || /usr/bin/restic init'
 {% if restic_backup_pre_hook | default(false) %}
-ExecStart=-{{ restic_backup_pre_hook }}
+ExecStartPre=-{{ restic_backup_pre_hook }}
 {% endif %}
 {% if restic_backup_stdin_command %}
-ExecStart=/bin/sh -c '{{ restic_backup_stdin_command }} | /usr/bin/restic backup --verbose --stdin --stdin-filename {{ restic_backup_stdin_command_filename }}'
+ExecStart=/bin/sh -c '{{ restic_backup_stdin_command }} | /usr/bin/restic backup \
+	--retry-lock {{ restic_retry_lock | default('5m') }} \
+	--verbose --stdin \
+	--stdin-filename {{ restic_backup_stdin_command_filename }}'
 {% else %}
-ExecStart=/usr/bin/restic --verbose backup {{ restic_backup_paths | join(' ') }}
+ExecStart=/opt/restic-backup-directories.sh {{ restic_backup_paths | join(' ') }}
+{% endif %}
+{% if restic_forget_prune | default(true) %}
+ExecStartPost=/usr/bin/restic forget --prune \
+	--retry-lock {{ restic_retry_lock | default('5m') }} \
+	--keep-within={{ restic_policy.keep_within }} \
+	--keep-hourly={{ restic_policy.hourly }} \
+	--keep-daily={{ restic_policy.daily }} \
+	--keep-weekly={{ restic_policy.weekly }} \
+	--keep-monthly={{ restic_policy.monthly }} \
+	--keep-yearly={{ restic_policy.yearly }}
+{% endif %}
+{% if restic_list_snapshots | default(true) %}
+ExecStartPost=-/usr/bin/restic snapshots --retry-lock {{ restic_retry_lock | default('5m') }}
 {% endif %}
-ExecStartPost=/usr/bin/restic forget --prune --keep-within={{ restic_policy.keep_within }} --keep-hourly={{ restic_policy.hourly }} --keep-daily={{ restic_policy.daily }} --keep-weekly={{ restic_policy.weekly }} --keep-monthly={{ restic_policy.monthly }}
-ExecStartPost=-/usr/bin/restic snapshots
 {% if restic_backup_post_hook | default(false) %}
 ExecStartPost=-{{ restic_backup_post_hook }}
 {% endif %}
-ExecStartPost=/usr/bin/restic check
+{% if restic_check | default(true) %}
+ExecStartPost=/usr/bin/restic check --retry-lock {{ restic_retry_lock | default('5m') }}
+{% endif %}