second commit

ansible/roles/backup/handlers/main.yml

@@ -0,0 +1,4 @@
+---
+- name: reload systemd
+  ansible.builtin.systemd:
+    daemon_reload: true

ansible/roles/backup/tasks/main.yml

@@ -0,0 +1,47 @@
+---
+- name: Backup-Verzeichnis anlegen
+  ansible.builtin.file:
+    path: "{{ backup_dir }}"
+    state: directory
+    owner: "{{ jumphost_app_user }}"
+    group: "{{ jumphost_app_group }}"
+    mode: "0700"
+
+- name: age installieren (Backup-Verschluesselung)
+  ansible.builtin.apt:
+    name: age
+    state: present
+    update_cache: true
+
+- name: Backup-Skript ausrollen
+  ansible.builtin.template:
+    src: backup.sh.j2
+    dest: "{{ jumphost_home }}/scripts/backup.sh"
+    owner: "{{ jumphost_app_user }}"
+    group: "{{ jumphost_app_group }}"
+    mode: "0750"
+
+- name: systemd-Service fuer Backup ausrollen
+  ansible.builtin.template:
+    src: jumphost-backup.service.j2
+    dest: /etc/systemd/system/jumphost-backup.service
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload systemd
+
+- name: systemd-Timer fuer Backup ausrollen
+  ansible.builtin.template:
+    src: jumphost-backup.timer.j2
+    dest: /etc/systemd/system/jumphost-backup.timer
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload systemd
+
+- name: Backup-Timer aktivieren
+  ansible.builtin.systemd:
+    name: jumphost-backup.timer
+    daemon_reload: true
+    enabled: true
+    state: started

ansible/roles/backup/templates/backup.sh.j2

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Konsistentes, verschluesseltes SQLite-Backup (Konzept 6.8).
+# KEK-Backup erfolgt bewusst GETRENNT (siehe Konzept 6.8) -- dieses Skript
+# sichert ausschliesslich die Datenbank, kein Schluesselmaterial.
+set -euo pipefail
+
+DB_PATH="{{ jumphost_data_dir }}/jumphost.db"
+BACKUP_DIR="{{ backup_dir }}"
+TS="$(date -u +%Y%m%dT%H%M%SZ)"
+OUT_PLAIN="${BACKUP_DIR}/jumphost_${TS}.db"
+OUT_ENC="${OUT_PLAIN}.age"
+
+sqlite3 "$DB_PATH" "VACUUM INTO '${OUT_PLAIN}'"
+age -r "{{ backup_age_public_key | default('AGE_PUBLIC_KEY_PLACEHOLDER') }}" -o "${OUT_ENC}" "${OUT_PLAIN}"
+shred -u "${OUT_PLAIN}"
+
+find "$BACKUP_DIR" -name 'jumphost_*.db.age' -mtime +{{ backup_retention_days }} -delete

ansible/roles/backup/templates/jumphost-backup.service.j2

@@ -0,0 +1,16 @@
+[Unit]
+Description=Jumphost verschluesseltes DB-Backup
+
+[Service]
+Type=oneshot
+User={{ jumphost_app_user }}
+Group={{ jumphost_app_group }}
+ExecStart=/usr/bin/env bash {{ jumphost_home }}/scripts/backup.sh
+
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+ReadWritePaths={{ backup_dir }} {{ jumphost_data_dir }}
+CapabilityBoundingSet=
+UMask=0077

ansible/roles/backup/templates/jumphost-backup.timer.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=Taeglicher Jumphost-Backup-Timer
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=1800
+Persistent=true
+
+[Install]
+WantedBy=timers.target