feat: backup and restore

ansible/roles/deploy/tasks/main.yml

@@ -3,6 +3,10 @@
 # used to be generated by OpenTofu (services/<host>/.env and, for dev,
 # Runners/docker-compose.yml) - replaces the null_resource.deploy_services +
 # local_file provisioners previously in infra/modules/<host>/main.tf.
+#
+# Persistent data lives in named Docker volumes now, not on a Hetzner volume -
+# see services/<host>/backup-docker-compose.yml. .env only carries the S3
+# credentials that backup/restore need, rendered for every host.
 
 - name: Ensure services directory exists on the host
   ansible.builtin.file:
@@ -16,28 +20,11 @@
     dest: "/home/{{ deploy_user }}/services/{{ service_group }}/"
     mode: preserve
 
-- name: Look up this host's data volume
-  when: service_group in ['dev', 'prod']
-  delegate_to: localhost
-  become: false
-  hetzner.hcloud.hcloud_volume_info:
-    api_token: "{{ hcloud_token }}"
-    name: "{{ service_group }}-storage"
-  register: _volume_info
-
-# Hetzner's automount tooling always mounts an auto-mounted volume at
-# /mnt/HC_Volume_<volume-id> - deterministic once the volume exists.
-- name: Compute DATA_DIR from the volume's id
-  when: service_group in ['dev', 'prod']
-  ansible.builtin.set_fact:
-    data_dir: "/mnt/HC_Volume_{{ _volume_info.hcloud_volume_info[0].id }}"
-
-- name: Render DATA_DIR into .env (auto-loaded by docker compose)
-  when: service_group in ['dev', 'prod']
+- name: Render S3 backup credentials into .env (auto-loaded by docker compose)
   ansible.builtin.template:
     src: env.j2
     dest: "/home/{{ deploy_user }}/services/{{ service_group }}/.env"
-    mode: "0644"
+    mode: "0600"
 
 - name: Render Gitea Actions runner compose file
   when: service_group == 'dev'
@@ -46,10 +33,11 @@
     dest: "/home/{{ deploy_user }}/services/dev/Runners/docker-compose.yml"
     mode: "0644"
 
-- name: Make spinup/spindown scripts executable
+- name: Make spinup/spindown/restore scripts executable
   ansible.builtin.file:
     path: "/home/{{ deploy_user }}/services/{{ service_group }}/{{ item }}"
     mode: "0755"
   loop:
     - spinup.sh
     - spindown.sh
+    - restore.sh

ansible/roles/deploy/templates/env.j2

@@ -1 +1,5 @@
-DATA_DIR={{ data_dir }}
+AWS_ACCESS_KEY_ID={{ backup_s3_access_key_id }}
+AWS_SECRET_ACCESS_KEY={{ backup_s3_secret_access_key }}
+AWS_S3_BUCKET_NAME={{ backup_s3_bucket }}
+AWS_S3_PATH={{ service_group }}
+AWS_ENDPOINT={{ backup_s3_endpoint }}

ansible/roles/deploy/templates/runners-docker-compose.yml.j2

@@ -7,10 +7,9 @@
 # (not baked in here) - services/dev/spinup.sh generates a fresh token and
 # writes it to Runners/.env immediately before starting these containers.
 #
-# /data lives on dev's volume ({{ data_dir }}) so runner identity survives a
-# server rebuild - baked in directly rather than via .env, since Runners/.env
-# is already reserved for the registration token above and gets overwritten
-# on every deploy.
+# /data is a disposable local cache (runner identity re-registers on every
+# spinup.sh run anyway), so it's a plain named volume - not part of the S3
+# backup/restore stack in services/dev/backup-docker-compose.yml.
 services:
 {% for i in range(1, dev_runner_count + 1) %}
   runner-{{ i }}:
@@ -18,7 +17,7 @@ services:
     container_name: gitea_runner_{{ i }}
     volumes:
       - ./config.yaml:/config.yaml
-      - {{ data_dir }}/gitea_runner_{{ i }}:/data
+      - gitea_runner_{{ i }}_data:/data
       - /var/run/docker.sock:/var/run/docker.sock
     networks:
       - proxy
@@ -33,3 +32,9 @@ services:
 networks:
   proxy:
     external: true
+
+volumes:
+{% for i in range(1, dev_runner_count + 1) %}
+  gitea_runner_{{ i }}_data:
+    name: gitea_runner_{{ i }}_data
+{% endfor %}