feat: backup and restore

ansible/README.md

@@ -2,25 +2,26 @@
 
 Bootstraps, syncs, and starts/stops the Docker Compose stacks in `../services/`
 on the three servers OpenTofu provisions (see `../infra/`). OpenTofu still owns
-the actual cloud resources (servers, network, firewalls, volumes, DNS);
+the actual cloud resources (servers, network, firewalls, DNS);
 everything downstream of "the server exists" - installing Docker, creating the
 `deploy` user, hardening SSH, copying `services/<host>/`, rendering `.env` /
 the Gitea runner compose file, and running `spinup.sh`/`spindown.sh` - lives
-here instead.
+here instead. Persistent service data lives in named Docker volumes backed up
+to S3, not on a Hetzner volume - see `../readme.md`.
 
 ## Contents
 
 - `inventory/hcloud.yml` - dynamic inventory, queries the Hetzner Cloud API
   directly (not Terraform state) and groups servers by their `role` label
   (`role_dev`, `role_prod`, `role_vpn` - set in `infra/modules/<host>/main.tf`).
-- `group_vars/` - `all.yml` (shared: `deploy_user`, SSH key path, `HCLOUD_TOKEN`
-  lookup), `role_dev.yml` / `role_prod.yml` / `role_vpn.yml` (per-role vars,
-  e.g. `dev_runner_count`).
+- `group_vars/` - `all.yml` (shared: `deploy_user`, SSH key path,
+  `backup_s3_*` S3 backup credentials), `role_dev.yml` / `role_prod.yml` /
+  `role_vpn.yml` (per-role vars, e.g. `dev_runner_count`).
 - `roles/bootstrap/` - Docker install, `deploy` user creation, SSH hardening,
   unattended-upgrades. Replaces `infra/scripts/bootstrap.sh.tftpl`.
-- `roles/deploy/` - copies `services/<host>/` to the server, looks up the
-  host's data volume directly from the Hetzner API and renders `.env`
-  (`DATA_DIR=...`) and, for `dev`, `Runners/docker-compose.yml`.
+- `roles/deploy/` - copies `services/<host>/` to the server and renders `.env`
+  (S3 backup credentials, see `../readme.md`) and, for `dev`,
+  `Runners/docker-compose.yml`.
 - `playbooks/` - `bootstrap.yml`, `deploy.yml`, `spinup.yml`, `spindown.yml`,
   and `site.yml` (all three in order).
 
@@ -30,6 +31,10 @@ here instead.
 cd ansible
 ansible-galaxy collection install -r requirements.yml
 export HCLOUD_TOKEN=your-hetzner-api-token   # never commit this
+export BACKUP_S3_BUCKET=your-bucket-name
+export BACKUP_S3_ACCESS_KEY_ID=your-access-key-id
+export BACKUP_S3_SECRET_ACCESS_KEY=your-secret-access-key
+export BACKUP_S3_ENDPOINT=your-s3-endpoint   # omit for real AWS S3
 ```
 
 `ansible_ssh_private_key_file` (see `group_vars/all.yml`) defaults to