infra/ansible/roles/backup_audit/tasks/main.yml

---
- name: Install audit dependencies
  ansible.builtin.apt:
    name:
      - jq
      - sqlite3
    state: present
    update_cache: true

- name: Ensure audit directories exist
  ansible.builtin.file:
    path: "{{ item }}"
    state: directory
    owner: root
    group: root
    mode: "0755"
  loop:
    - /etc/homelab-backup-audit
    - /var/lib/homelab-backup-audit
    - "{{ backup_audit_metrics_dir }}"

- name: Install PBS audit script
  ansible.builtin.template:
    src: audit-pbs.sh.j2
    dest: /usr/local/sbin/homelab-backup-audit-pbs
    owner: root
    group: root
    mode: "0755"
  when: backup_audit_type | default('') == 'pbs'

- name: Install restic audit script
  ansible.builtin.template:
    src: audit-restic.sh.j2
    dest: /usr/local/sbin/homelab-backup-audit-restic
    owner: root
    group: root
    mode: "0755"
  when: backup_audit_type | default('') == 'restic'

- name: Install restic audit env files
  ansible.builtin.copy:
    dest: "/etc/homelab-backup-audit/{{ item.name }}.env"
    owner: root
    group: root
    mode: "0600"
    content: |
      HOMELAB_AUDIT_PROFILE={{ item.name }}
      HOMELAB_AUDIT_MAX_AGE_HOURS={{ item.max_age_hours | default(36) }}
      HOMELAB_AUDIT_SQLITE_NAME={{ item.sqlite_name | default('') }}
      HOMELAB_AUDIT_EXPECTED_NAME={{ item.expected_name | default('') }}
  loop: "{{ backup_audit_restic_profiles }}"
  when: backup_audit_type | default('') == 'restic'
  no_log: true

- name: Install PBS audit systemd service
  ansible.builtin.copy:
    dest: /etc/systemd/system/homelab-backup-audit-pbs.service
    owner: root
    group: root
    mode: "0644"
    content: |
      [Unit]
      Description=HomeLab PBS backup audit
      Wants=network-online.target
      After=network-online.target

      [Service]
      Type=oneshot
      ExecStart=/usr/local/sbin/homelab-backup-audit-pbs
  when: backup_audit_type | default('') == 'pbs'

- name: Install restic audit systemd services
  ansible.builtin.copy:
    dest: "/etc/systemd/system/homelab-backup-audit-{{ item.name }}.service"
    owner: root
    group: root
    mode: "0644"
    content: |
      [Unit]
      Description=HomeLab restic offsite backup audit ({{ item.name }})
      Wants=network-online.target
      After=network-online.target

      [Service]
      Type=oneshot
      ExecStart=/usr/bin/flock -w 1800 /var/lock/homelab-restic-{{ item.name }}.lock /usr/local/sbin/homelab-backup-audit-restic {{ item.name }}
  loop: "{{ backup_audit_restic_profiles }}"
  when: backup_audit_type | default('') == 'restic'

- name: Install PBS audit systemd timer
  ansible.builtin.copy:
    dest: /etc/systemd/system/homelab-backup-audit-pbs.timer
    owner: root
    group: root
    mode: "0644"
    content: |
      [Unit]
      Description=Run HomeLab PBS backup audit

      [Timer]
      OnCalendar={{ backup_audit_timer_oncalendar }}
      Persistent=true
      RandomizedDelaySec={{ backup_audit_timer_randomized_delay }}

      [Install]
      WantedBy=timers.target
  when: backup_audit_type | default('') == 'pbs'

- name: Install restic audit systemd timers
  ansible.builtin.copy:
    dest: "/etc/systemd/system/homelab-backup-audit-{{ item.name }}.timer"
    owner: root
    group: root
    mode: "0644"
    content: |
      [Unit]
      Description=Run HomeLab restic backup audit ({{ item.name }})

      [Timer]
      OnCalendar={{ backup_audit_timer_oncalendar }}
      Persistent=true
      RandomizedDelaySec={{ backup_audit_timer_randomized_delay }}

      [Install]
      WantedBy=timers.target
  loop: "{{ backup_audit_restic_profiles }}"
  when: backup_audit_type | default('') == 'restic'

- name: Reload systemd
  ansible.builtin.systemd:
    daemon_reload: true

- name: Enable PBS audit timer
  ansible.builtin.systemd:
    name: homelab-backup-audit-pbs.timer
    enabled: true
    state: started
  when: backup_audit_type | default('') == 'pbs'

- name: Enable restic audit timers
  ansible.builtin.systemd:
    name: "homelab-backup-audit-{{ item.name }}.timer"
    enabled: true
    state: started
  loop: "{{ backup_audit_restic_profiles }}"
  when: backup_audit_type | default('') == 'restic'