second commit

ansible/roles/backup/templates/backup.sh.j2

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# Konsistentes, verschluesseltes SQLite-Backup (Konzept 6.8).
+# KEK-Backup erfolgt bewusst GETRENNT (siehe Konzept 6.8) -- dieses Skript
+# sichert ausschliesslich die Datenbank, kein Schluesselmaterial.
+set -euo pipefail
+
+DB_PATH="{{ jumphost_data_dir }}/jumphost.db"
+BACKUP_DIR="{{ backup_dir }}"
+TS="$(date -u +%Y%m%dT%H%M%SZ)"
+OUT_PLAIN="${BACKUP_DIR}/jumphost_${TS}.db"
+OUT_ENC="${OUT_PLAIN}.age"
+
+sqlite3 "$DB_PATH" "VACUUM INTO '${OUT_PLAIN}'"
+age -r "{{ backup_age_public_key | default('AGE_PUBLIC_KEY_PLACEHOLDER') }}" -o "${OUT_ENC}" "${OUT_PLAIN}"
+shred -u "${OUT_PLAIN}"
+
+find "$BACKUP_DIR" -name 'jumphost_*.db.age' -mtime +{{ backup_retention_days }} -delete