feat: backup and restore

ansible/group_vars/all.yml

@@ -6,9 +6,16 @@ deploy_user: deploy
 ansible_user: "{{ deploy_user }}"
 ansible_ssh_private_key_file: "{{ lookup('env', 'ANSIBLE_SSH_PRIVATE_KEY_FILE') | default('~/.ssh/id_ed25519', true) }}"
 
-# Used by the deploy role to look up each host's data volume directly from the
-# Hetzner API (hcloud_volume_info) rather than from Terraform state/outputs.
-hcloud_token: "{{ lookup('env', 'HCLOUD_TOKEN') }}"
-
 # Repo root's services/ directory, relative to wherever a playbook lives under ansible/playbooks/.
 services_root: "{{ playbook_dir }}/../../services"
+
+# S3-compatible bucket that services/<host>/backup-docker-compose.yml backs up
+# to and restores from - see readme.md. Not provisioned by OpenTofu (the
+# hcloud provider has no Object Storage resource), so these must point at a
+# bucket you've created yourself. AWS_ENDPOINT is only needed for a
+# non-AWS S3-compatible provider (e.g. Hetzner Object Storage); leave it unset
+# to use real AWS S3.
+backup_s3_bucket: "{{ lookup('env', 'BACKUP_S3_BUCKET') }}"
+backup_s3_access_key_id: "{{ lookup('env', 'BACKUP_S3_ACCESS_KEY_ID') }}"
+backup_s3_secret_access_key: "{{ lookup('env', 'BACKUP_S3_SECRET_ACCESS_KEY') }}"
+backup_s3_endpoint: "{{ lookup('env', 'BACKUP_S3_ENDPOINT') }}"