init

ansible/roles/restic/templates/restic-backup.service.j2

@@ -0,0 +1,9 @@
+[Unit]
+Description=Restic backup
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+Environment=HOME=/root
+ExecStart=/usr/local/bin/restic-backup.sh

ansible/roles/restic/templates/restic-backup.sh.j2

@@ -0,0 +1,22 @@
+#!/bin/bash
+set -euo pipefail
+
+STAGING_DIR="{{ staging_dir }}"
+RESTIC_REPO="s3:{{ s3_endpoint }}/{{ s3_bucket }}/{{ host_id }}"
+export RESTIC_PASSWORD="{{ password }}"
+export AWS_ACCESS_KEY_ID="{{ s3_access_key_id }}"
+export AWS_SECRET_ACCESS_KEY="{{ s3_secret_access_key }}"
+
+echo "$(date -Iseconds) Running pre-backup scripts..."
+if [ -d /etc/restic/pre-backup.d ]; then
+    for script in /etc/restic/pre-backup.d/*.sh; do
+        [ -x "$script" ] || continue
+        echo "  Running $script"
+        "$script"
+    done
+fi
+
+echo "$(date -Iseconds) Creating restic snapshot..."
+restic backup --repo "$RESTIC_REPO" "$STAGING_DIR"
+
+echo "$(date -Iseconds) Backup complete."

ansible/roles/restic/templates/restic-backup.timer.j2

@@ -0,0 +1,10 @@
+[Unit]
+Description=Restic backup timer
+
+[Timer]
+OnCalendar={{ backup_schedule }}
+Persistent=true
+RandomizedDelaySec=1h
+
+[Install]
+WantedBy=timers.target