backup-automation/kestra/workflows/rclone-backup-server.yaml

---
# Ansible Playbook: Backup-Server Konfiguration (Borg + Rclone)
# Läuft auf dem zentralen Backup-Server unter Proxmox

- name: Configure Borg Backup Server with Rclone S3 Sync
  hosts: backup_server
  become: yes

  vars:
    backup_user: "backup"
    backup_group: "backup"
    backup_home: "/home/backup"
    backup_repos_dir: "/backup/repos"
    rclone_config_dir: "/home/backup/.config/rclone"
    hetzner_s3_bucket: "mbo-backups"
    hetzner_s3_region: "fsn1"
    # Secrets sollten via Ansible Vault oder Umgebungsvariablen gesetzt werden
    # hetzner_s3_access_key: "{{ vault_hetzner_s3_access_key }}"
    # hetzner_s3_secret_key: "{{ vault_hetzner_s3_secret_key }}"

  tasks:
    # ======================
    # 1. User Setup
    # ======================
    - name: Create backup user
      user:
        name: "{{ backup_user }}"
        home: "{{ backup_home }}"
        shell: /bin/bash
        state: present

    - name: Create backup directories
      file:
        path: "{{ item }}"
        state: directory
        owner: "{{ backup_user }}"
        group: "{{ backup_group }}"
        mode: "0700"
      loop:
        - "{{ backup_repos_dir }}"
        - "{{ backup_home }}/.ssh"
        - "{{ rclone_config_dir }}"

    # ======================
    # 2. SSH Setup
    # ======================
    - name: Create SSH authorized_keys for backup user
      file:
        path: "{{ backup_home }}/.ssh/authorized_keys"
        state: touch
        owner: "{{ backup_user }}"
        group: "{{ backup_group }}"
        mode: "0600"

    - name: Add SSH key restrictions for backup user
      copy:
        content: |
          # Borg Backup Clients - restrict commands
          restrict,command="/usr/bin/borg serve --restrict-to-paths {{ backup_repos_dir }}" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDemKoq...          
        dest: "{{ backup_home }}/.ssh/authorized_keys"
        owner: "{{ backup_user }}"
        group: "{{ backup_group }}"
        mode: "0600"
      register: ssh_auth_updated
      # TODO: Tatsächliche SSH-Keys hier einfügen

    # ======================
    # 3. Borg Server Setup
    # ======================
    - name: Install Borg Server
      apt:
        name:
          - borgbackup
          - openssh-server
          - rclone
          - curl
        state: present

    - name: Create borg serve wrapper script
      copy:
        content: |
          #!/bin/bash
          # Wrapper für restricted SSH/borg serve
          exec /usr/bin/borg serve --restrict-to-paths {{ backup_repos_dir }} "$@"          
        dest: "/usr/local/bin/borg-serve-wrapper"
        mode: "0755"
        owner: root
        group: root

    # ======================
    # 4. Rclone Configuration
    # ======================
    - name: Install rclone
      apt:
        name: rclone
        state: present

    - name: Create rclone config for Hetzner S3
      template:
        src: "rclone.conf.j2"
        dest: "{{ rclone_config_dir }}/rclone.conf"
        owner: "{{ backup_user }}"
        group: "{{ backup_group }}"
        mode: "0600"

    - name: Test rclone S3 connection
      become_user: "{{ backup_user }}"
      command: "/usr/bin/rclone ls hetzner:/{{ hetzner_s3_bucket }}"
      register: rclone_test
      changed_when: false
      ignore_errors: yes

    - name: Display rclone test result
      debug:
        msg: "Rclone S3 connection: {{ 'SUCCESS' if rclone_test.rc == 0 else 'FAILED' }}"

    # ======================
    # 5. Systemd Service für Rclone Sync
    # ======================
    - name: Create rclone sync service
      template:
        src: "rclone-sync.service.j2"
        dest: "/etc/systemd/system/mbo-rclone-sync.service"
        mode: "0644"

    - name: Create rclone sync timer
      template:
        src: "rclone-sync.timer.j2"
        dest: "/etc/systemd/system/mbo-rclone-sync.timer"
        mode: "0644"

    - name: Reload systemd
      systemd:
        daemon_reload: yes

    - name: Enable rclone sync timer
      systemd:
        name: mbo-rclone-sync.timer
        enabled: yes
        state: started

    # ======================
    # 6. Monitoring & Logging
    # ======================
    - name: Create log directory
      file:
        path: "/var/log/mbo-backup"
        state: directory
        owner: "{{ backup_user }}"
        group: "{{ backup_group }}"
        mode: "0755"

    - name: Create logrotate config
      copy:
        content: |
          /var/log/mbo-backup/*.log {
            daily
            rotate 14
            compress
            delaycompress
            notifempty
            create 0640 {{ backup_user }} {{ backup_group }}
            sharedscripts
          }          
        dest: "/etc/logrotate.d/mbo-backup"
        mode: "0644"

    # ======================
    # 7. Verify Installation
    # ======================
    - name: Check Borg version
      command: /usr/bin/borg --version
      register: borg_version
      changed_when: false

    - name: Check Rclone version
      command: /usr/bin/rclone --version
      register: rclone_version
      changed_when: false

    - name: Display installation summary
      debug:
        msg: |
          ✓ Backup Server Configured
          ✓ {{ borg_version.stdout }}
          ✓ {{ rclone_version.stdout }}
          ✓ Backup repos dir: {{ backup_repos_dir }}
          ✓ Rclone S3 sync: enabled
          ✓ Next sync: systemctl list-timers mbo-rclone-sync.timer          

  handlers:
    - name: Reload SSH
      systemd:
        name: ssh
        state: reloaded