feat: backup and restore

ansible/roles/deploy/templates/env.j2

@@ -1 +1,5 @@
-DATA_DIR={{ data_dir }}
+AWS_ACCESS_KEY_ID={{ backup_s3_access_key_id }}
+AWS_SECRET_ACCESS_KEY={{ backup_s3_secret_access_key }}
+AWS_S3_BUCKET_NAME={{ backup_s3_bucket }}
+AWS_S3_PATH={{ service_group }}
+AWS_ENDPOINT={{ backup_s3_endpoint }}

ansible/roles/deploy/templates/runners-docker-compose.yml.j2

@@ -7,10 +7,9 @@
 # (not baked in here) - services/dev/spinup.sh generates a fresh token and
 # writes it to Runners/.env immediately before starting these containers.
 #
-# /data lives on dev's volume ({{ data_dir }}) so runner identity survives a
-# server rebuild - baked in directly rather than via .env, since Runners/.env
-# is already reserved for the registration token above and gets overwritten
-# on every deploy.
+# /data is a disposable local cache (runner identity re-registers on every
+# spinup.sh run anyway), so it's a plain named volume - not part of the S3
+# backup/restore stack in services/dev/backup-docker-compose.yml.
 services:
 {% for i in range(1, dev_runner_count + 1) %}
   runner-{{ i }}:
@@ -18,7 +17,7 @@ services:
     container_name: gitea_runner_{{ i }}
     volumes:
       - ./config.yaml:/config.yaml
-      - {{ data_dir }}/gitea_runner_{{ i }}:/data
+      - gitea_runner_{{ i }}_data:/data
       - /var/run/docker.sock:/var/run/docker.sock
     networks:
       - proxy
@@ -33,3 +32,9 @@ services:
 networks:
   proxy:
     external: true
+
+volumes:
+{% for i in range(1, dev_runner_count + 1) %}
+  gitea_runner_{{ i }}_data:
+    name: gitea_runner_{{ i }}_data
+{% endfor %}