feat: adds borg, timers and systemd service support

config/ansible/tasks/servers/borg-backup.yml

@@ -0,0 +1,93 @@
+---
+- name: Borg Backup Installation and Configuration
+  block:
+    - name: Check if Borg is already installed
+      ansible.builtin.command: which borg
+      register: borg_check
+      ignore_errors: true
+      changed_when: false
+
+    - name: Ensure Borg is installed
+      ansible.builtin.package:
+        name: borg
+        state: present
+      become: true
+      when: borg_check.rc != 0
+
+    - name: Set Borg backup facts
+      ansible.builtin.set_fact:
+        borg_passphrase: "{{ lookup('community.general.onepassword', 'Borg Backup', vault='Dotfiles', field='password') }}"
+        borg_config_dir: "{{ ansible_env.HOME }}/.config/borg"
+        borg_backup_dir: "/mnt/services"
+        borg_repo_dir: "/mnt/object_storage/borg-repo"
+
+    - name: Create Borg directories
+      ansible.builtin.file:
+        path: "{{ borg_dir }}"
+        state: directory
+        mode: "0755"
+      loop:
+        - "{{ borg_config_dir }}"
+        - "/mnt/object_storage"
+      loop_control:
+        loop_var: borg_dir
+      become: true
+
+    - name: Check if Borg repository exists
+      ansible.builtin.stat:
+        path: "{{ borg_repo_dir }}/config"
+      register: borg_repo_check
+      become: true
+
+    - name: Initialize Borg repository
+      ansible.builtin.command: >
+        borg init --encryption=repokey {{ borg_repo_dir }}
+      environment:
+        BORG_PASSPHRASE: "{{ borg_passphrase }}"
+      become: true
+      when: not borg_repo_check.stat.exists
+
+    - name: Create Borg backup script
+      ansible.builtin.template:
+        src: templates/borg-backup.sh.j2
+        dest: "{{ borg_config_dir }}/backup.sh"
+        mode: "0755"
+      become: true
+
+    - name: Create Borg systemd service
+      ansible.builtin.template:
+        src: templates/borg-backup.service.j2
+        dest: /etc/systemd/system/borg-backup.service
+        mode: "0644"
+      become: true
+      register: borg_service
+
+    - name: Create Borg systemd timer
+      ansible.builtin.template:
+        src: templates/borg-backup.timer.j2
+        dest: /etc/systemd/system/borg-backup.timer
+        mode: "0644"
+      become: true
+      register: borg_timer
+
+    - name: Reload systemd daemon
+      ansible.builtin.systemd:
+        daemon_reload: true
+      become: true
+      when: borg_service.changed or borg_timer.changed
+
+    - name: Enable and start Borg backup timer
+      ansible.builtin.systemd:
+        name: borg-backup.timer
+        enabled: true
+        state: started
+      become: true
+
+    - name: Display Borg backup status
+      ansible.builtin.debug:
+        msg: "Borg backup is configured and will run daily at 2 AM. Logs available at /var/log/borg-backup.log"
+
+  tags:
+    - borg-backup
+    - borg
+    - backup

config/ansible/tasks/servers/dynamic-dns.yml

@@ -1,47 +1,29 @@
 ---
 - name: Dynamic DNS setup
   block:
-    - name: Create environment file for dynamic DNS
+    - name: Create systemd environment file for dynamic DNS
       ansible.builtin.template:
-        src: "{{ playbook_dir }}/templates/dynamic-dns.env.j2"
-        dest: "{{ ansible_user_dir }}/.local/bin/dynamic-dns.env"
+        src: "{{ playbook_dir }}/templates/dynamic-dns-systemd.env.j2"
+        dest: "/etc/dynamic-dns-systemd.env"
         mode: "0600"
+        owner: root
+        group: root
+      become: true
 
     - name: Create dynamic DNS wrapper script
       ansible.builtin.copy:
-        dest: "{{ ansible_user_dir }}/.local/bin/dynamic-dns-update.sh"
+        dest: "/usr/local/bin/dynamic-dns-update.sh"
         mode: "0755"
         content: |
           #!/bin/bash
 
-          # Load environment variables
-          source {{ ansible_user_dir }}/.local/bin/dynamic-dns.env
-
-          # Change to the directory containing the binary
-          cd {{ ansible_user_dir }}/.local/bin
-
           # Run dynamic DNS update (binary compiled by utils.yml)
-          dynamic-dns-cf -record "vleeuwen.me,mvl.sh,mennovanleeuwen.nl" 2>&1 | logger -t dynamic-dns
-
-    - name: Setup cron job for dynamic DNS updates (fallback)
-      ansible.builtin.cron:
-        name: "Dynamic DNS Update"
-        minute: "*/15"
-        job: "{{ ansible_user_dir }}/.local/bin/dynamic-dns-update.sh"
-        user: "{{ ansible_user }}"
-        state: present
-      ignore_errors: true
-      tags: [cron]
-
-    - name: Create systemd user directory
-      ansible.builtin.file:
-        path: "{{ ansible_user_dir }}/.config/systemd/user"
-        state: directory
-        mode: "0755"
+          {{ ansible_user_dir }}/.local/bin/dynamic-dns-cf -record "vleeuwen.me,mvl.sh,mennovanleeuwen.nl" 2>&1 | logger -t dynamic-dns
+      become: true
 
     - name: Create dynamic DNS systemd timer
       ansible.builtin.copy:
-        dest: "{{ ansible_user_dir }}/.config/systemd/user/dynamic-dns.timer"
+        dest: "/etc/systemd/system/dynamic-dns.timer"
         mode: "0644"
         content: |
           [Unit]
@@ -54,10 +36,12 @@
 
           [Install]
           WantedBy=timers.target
+      become: true
+      register: ddns_timer
 
     - name: Create dynamic DNS systemd service
       ansible.builtin.copy:
-        dest: "{{ ansible_user_dir }}/.config/systemd/user/dynamic-dns.service"
+        dest: "/etc/systemd/system/dynamic-dns.service"
         mode: "0644"
         content: |
           [Unit]
@@ -67,31 +51,36 @@
 
           [Service]
           Type=oneshot
-          ExecStart={{ ansible_user_dir }}/.local/bin/dynamic-dns-update.sh
-          EnvironmentFile={{ ansible_user_dir }}/.local/bin/dynamic-dns.env
+          ExecStart=/usr/local/bin/dynamic-dns-update.sh
+          EnvironmentFile=/etc/dynamic-dns-systemd.env
+          User={{ ansible_user }}
+          Group={{ ansible_user }}
 
           [Install]
-          WantedBy=default.target
+          WantedBy=multi-user.target
+      become: true
+      register: ddns_service
 
-    - name: Reload systemd user daemon
+    - name: Reload systemd daemon
       ansible.builtin.systemd:
         daemon_reload: true
-        scope: user
+      become: true
+      when: ddns_timer.changed or ddns_service.changed
 
     - name: Enable and start dynamic DNS timer
       ansible.builtin.systemd:
         name: dynamic-dns.timer
         enabled: true
         state: started
-        scope: user
+      become: true
 
     - name: Display setup completion message
       ansible.builtin.debug:
         msg: |
           Dynamic DNS setup complete!
-          - Systemd timer: systemctl --user status dynamic-dns.timer
-          - Check logs: journalctl --user -u dynamic-dns.service -f
-          - Manual run: ~/.local/bin/dynamic-dns-update.sh
+          - Systemd timer: sudo systemctl status dynamic-dns.timer
+          - Check logs: sudo journalctl -u dynamic-dns.service -f
+          - Manual run: sudo /usr/local/bin/dynamic-dns-update.sh
           - Domains: vleeuwen.me, mvl.sh, mennovanleeuwen.nl
 
   when: inventory_hostname == 'mennos-cachyos-desktop'

config/ansible/tasks/servers/server.yml

@@ -30,6 +30,11 @@
       tags:
         - dynamic-dns
 
+    - name: Include Borg Backup tasks
+      ansible.builtin.include_tasks: borg-backup.yml
+      tags:
+        - borg-backup
+
     - name: System performance optimizations
       ansible.posix.sysctl:
         name: "{{ item.name }}"

config/ansible/templates/borg-backup.service.j2

@@ -0,0 +1,31 @@
+[Unit]
+Description=Borg Backup Service
+After=network.target
+
+[Service]
+Type=oneshot
+User=root
+Group=root
+ExecStart={{ borg_config_dir }}/backup.sh
+StandardOutput=journal
+StandardError=journal
+Environment="BORG_PASSPHRASE={{ borg_passphrase }}"
+Environment="BORG_REPO={{ borg_repo_dir }}"
+Environment="BORG_CACHE_DIR={{ borg_config_dir }}/cache"
+Environment="BORG_CONFIG_DIR={{ borg_config_dir }}/config"
+Environment="BORG_SECURITY_DIR={{ borg_config_dir }}/security"
+Environment="BORG_KEYS_DIR={{ borg_config_dir }}/keys"
+
+# Security settings
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectSystem=strict
+ReadWritePaths=/mnt/services /mnt/object_storage /var/log {{ borg_config_dir }}
+ProtectHome=read-only
+ProtectControlGroups=true
+RestrictRealtime=true
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+
+[Install]
+WantedBy=multi-user.target

config/ansible/templates/borg-backup.sh.j2

@@ -0,0 +1,96 @@
+#!/bin/bash
+
+# Borg backup script for /mnt/services
+# This script creates incremental backups of the services directory
+
+# Set environment variables
+export BORG_REPO="{{ borg_repo_dir }}"
+export BORG_PASSPHRASE="{{ borg_passphrase }}"
+export BORG_CACHE_DIR="{{ borg_config_dir }}/cache"
+export BORG_CONFIG_DIR="{{ borg_config_dir }}/config"
+export BORG_SECURITY_DIR="{{ borg_config_dir }}/security"
+export BORG_KEYS_DIR="{{ borg_config_dir }}/keys"
+
+# Backup name with timestamp
+BACKUP_NAME="services-$(date +%Y%m%d-%H%M%S)"
+
+# Log function
+log() {
+    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a /var/log/borg-backup.log
+}
+
+# Ensure all Borg directories exist
+mkdir -p "$BORG_CACHE_DIR"
+mkdir -p "$BORG_CONFIG_DIR"
+mkdir -p "$BORG_SECURITY_DIR"
+mkdir -p "$BORG_KEYS_DIR"
+
+# Start backup
+log "Starting Borg backup: $BACKUP_NAME"
+
+# Create backup
+borg create \
+    --verbose \
+    --filter AME \
+    --list \
+    --stats \
+    --show-rc \
+    --compression lz4 \
+    --exclude-caches \
+    --exclude '*.tmp' \
+    --exclude '*.temp' \
+    --exclude '*.log' \
+    --exclude '*/.cache' \
+    --exclude '*/cache' \
+    --exclude '*/logs' \
+    --exclude '*/tmp' \
+    --exclude '*/node_modules' \
+    --exclude '*/__pycache__' \
+    "::$BACKUP_NAME" \
+    {{ borg_backup_dir }}
+
+backup_exit=$?
+
+log "Backup finished with exit code: $backup_exit"
+
+# Prune old backups (keep last 7 daily, 4 weekly, 6 monthly)
+log "Pruning old backups"
+
+# Check if there are any archives to prune first
+archive_count=$(borg list --short --prefix 'services-' 2>/dev/null | wc -l)
+
+if [ "$archive_count" -gt 1 ]; then
+    borg prune \
+        --list \
+        --prefix 'services-' \
+        --show-rc \
+        --keep-daily 7 \
+        --keep-weekly 4 \
+        --keep-monthly 6
+    prune_exit=$?
+else
+    log "Only one or no archives found, skipping prune"
+    prune_exit=0
+fi
+
+log "Prune finished with exit code: $prune_exit"
+
+# Compact repository
+log "Compacting repository"
+borg compact
+
+compact_exit=$?
+
+log "Compact finished with exit code: $compact_exit"
+
+# Global exit status
+global_exit=$(( backup_exit > prune_exit ? backup_exit : prune_exit ))
+global_exit=$(( compact_exit > global_exit ? compact_exit : global_exit ))
+
+if [ $global_exit -eq 0 ]; then
+    log "Backup completed successfully"
+else
+    log "Backup completed with warnings or errors (exit code: $global_exit)"
+fi
+
+exit $global_exit

config/ansible/templates/borg-backup.timer.j2

@@ -0,0 +1,12 @@
+[Unit]
+Description=Run Borg Backup Daily
+Requires=borg-backup.service
+
+[Timer]
+# Run daily at 2 AM
+OnCalendar=daily
+Persistent=true
+RandomizedDelaySec=1800
+
+[Install]
+WantedBy=timers.target

config/ansible/templates/dynamic-dns-systemd.env.j2

@@ -0,0 +1,12 @@
+# Dynamic DNS Environment Configuration for SystemD
+# This file contains sensitive credentials and should be kept secure
+# Credentials are automatically retrieved from OnePassword
+
+# CloudFlare API Token (required)
+# Retrieved from OnePassword: CloudFlare API Token
+CLOUDFLARE_API_TOKEN={{ lookup('community.general.onepassword', 'CloudFlare API Token', vault='Dotfiles', field='password') }}
+
+# Telegram Bot Credentials (for notifications when IP changes)
+# Retrieved from OnePassword: Telegram DynDNS Bot
+TELEGRAM_BOT_TOKEN={{ lookup('community.general.onepassword', 'Telegram DynDNS Bot', vault='Dotfiles', field='password') }}
+TELEGRAM_CHAT_ID={{ lookup('community.general.onepassword', 'Telegram DynDNS Bot', vault='Dotfiles', field='chat_id') }}

config/ansible/templates/dynamic-dns.env.j2

@@ -1,12 +0,0 @@
-# Dynamic DNS Environment Configuration
-# This file contains sensitive credentials and should be kept secure
-# Credentials are automatically retrieved from OnePassword
-
-# CloudFlare API Token (required)
-# Retrieved from OnePassword: CloudFlare API Token
-export CLOUDFLARE_API_TOKEN="{{ lookup('community.general.onepassword', 'CloudFlare API Token', vault='Dotfiles', field='password') }}"
-
-# Telegram Bot Credentials (for notifications when IP changes)
-# Retrieved from OnePassword: Telegram DynDNS Bot
-export TELEGRAM_BOT_TOKEN="{{ lookup('community.general.onepassword', 'Telegram DynDNS Bot', vault='Dotfiles', field='password') }}"
-export TELEGRAM_CHAT_ID="{{ lookup('community.general.onepassword', 'Telegram DynDNS Bot', vault='Dotfiles', field='chat_id') }}"