ansible-taler-exchange

commit b39d8deaf83889b6fa9a8c930663faff2cbf13ab
parent a824483ec336f604fd9366eec27d38618dc7d565
Author: Florian Dold <dold@taler.net>
Date:   Fri, 31 Jul 2026 15:40:04 +0200

make borg setup and backups repeatable

borg init is not idempotent, so re-running setup-pixel-borg.sh aborted
the play; guard it with the repository config file.

The known_hosts step was guarded by "creates: /root/.ssh/known_hosts", so
on a host that already had a known_hosts file the backup server's key was
never added and the nightly job failed on host key verification. Check
with ssh-keygen -F instead.

In the backup script, gzip now overwrites a snapshot left behind by an
interrupted run, and prune and compact are skipped when borg create
failed.

Diffstat:
M
roles/borg-start/tasks/main.yml
 | 
11
+++++++++--
M
roles/borg-start/templates/root/bin/borg-backup.sh
 | 
10
++++++++--
M
roles/pixel_borg/tasks/main.yml
 | 
1
+

3 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/roles/borg-start/tasks/main.yml b/roles/borg-start/tasks/main.yml
@@ -28,10 +28,17 @@
     group: root
     mode: "0600"
 
+- name: Check whether we already know the host key of the borg server
+  ansible.builtin.command:
+    cmd: ssh-keygen -F {{ BORG_HOST }} -f /root/.ssh/known_hosts
+  register: known_host
+  changed_when: false
+  failed_when: false
+
 - name: Add host key for borg server
   ansible.builtin.shell:
-    cmd: ssh-keyscan {{ BORG_HOST }} >> .ssh/known_hosts
-    creates: /root/.ssh/known_hosts
+    cmd: ssh-keyscan {{ BORG_HOST }} >> /root/.ssh/known_hosts
+  when: known_host.rc != 0
 
 - name: Fail if we do not have an SSH key for the backup server
   fail:
diff --git a/roles/borg-start/templates/root/bin/borg-backup.sh b/roles/borg-start/templates/root/bin/borg-backup.sh
@@ -19,10 +19,12 @@ if [[ $db_exit -ne 0 ]]; then
     exit 1
 fi
 
-# Note: I actually benchmarked (!) this on *out* SQL data.
+# Note: I actually benchmarked (!) this on *our* SQL data.
 # zstd was fastest, but gzip was smallest
 # (tested: gzip, bzip, zstd, lzip, xz)
-gzip postgres-backup.sql || exit 1
+# -f so that a snapshot left behind by an interrupted run does not
+# block every future backup.
+gzip -f postgres-backup.sql || exit 1
 
 echo "Database snapshot created:"
 ls -al postgres-backup.sql.gz
@@ -56,6 +58,10 @@ info "Removing database dump"
 
 rm postgres-backup.sql.gz
 
+if [[ $backup_exit -gt 1 ]]; then
+    info "Backup failed, exit status $backup_exit; not pruning"
+    exit $backup_exit
+fi
 
 info "Pruning repository"
 
diff --git a/roles/pixel_borg/tasks/main.yml b/roles/pixel_borg/tasks/main.yml
@@ -41,6 +41,7 @@
   ansible.builtin.command:
     cmd: borg init --encryption=repokey pixel-backup
     chdir: /home/borg
+    creates: /home/borg/pixel-backup/config
   environment:
     BORG_PASSPHRASE: "{{ PIXEL_BORG_KEY }}"
   become: true