second commit

ansible/roles/backup/templates/backup.sh.j2

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Konsistentes, verschluesseltes SQLite-Backup (Konzept 6.8).
+# KEK-Backup erfolgt bewusst GETRENNT (siehe Konzept 6.8) -- dieses Skript
+# sichert ausschliesslich die Datenbank, kein Schluesselmaterial.
+set -euo pipefail
+
+DB_PATH="{{ jumphost_data_dir }}/jumphost.db"
+BACKUP_DIR="{{ backup_dir }}"
+TS="$(date -u +%Y%m%dT%H%M%SZ)"
+OUT_PLAIN="${BACKUP_DIR}/jumphost_${TS}.db"
+OUT_ENC="${OUT_PLAIN}.age"
+
+sqlite3 "$DB_PATH" "VACUUM INTO '${OUT_PLAIN}'"
+age -r "{{ backup_age_public_key | default('AGE_PUBLIC_KEY_PLACEHOLDER') }}" -o "${OUT_ENC}" "${OUT_PLAIN}"
+shred -u "${OUT_PLAIN}"
+
+find "$BACKUP_DIR" -name 'jumphost_*.db.age' -mtime +{{ backup_retention_days }} -delete

ansible/roles/backup/templates/jumphost-backup.service.j2

@@ -0,0 +1,16 @@
+[Unit]
+Description=Jumphost verschluesseltes DB-Backup
+
+[Service]
+Type=oneshot
+User={{ jumphost_app_user }}
+Group={{ jumphost_app_group }}
+ExecStart=/usr/bin/env bash {{ jumphost_home }}/scripts/backup.sh
+
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+PrivateTmp=true
+ReadWritePaths={{ backup_dir }} {{ jumphost_data_dir }}
+CapabilityBoundingSet=
+UMask=0077

ansible/roles/backup/templates/jumphost-backup.timer.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=Taeglicher Jumphost-Backup-Timer
+
+[Timer]
+OnCalendar=daily
+RandomizedDelaySec=1800
+Persistent=true
+
+[Install]
+WantedBy=timers.target