Add role backup-secrets.

playbooks/backup-services.yml

@@ -3,6 +3,7 @@
   roles:
     - include-vars
     - borg-init
+    - backup-secrets
 
 - name: Backup project(s)
   hosts: localhost

roles/backup-secrets/tasks/main.yml

@@ -0,0 +1,22 @@
+- name:
+  become: true
+  block:
+    - name: Create borg backup
+      command:
+        cmd: |
+          borg create
+          --compression=lzma
+          "{{ borg_repodir }}::secrets-{now:%Y-%m-%d_%H-%M-%S}"
+          {{ playbook_dir }}/../secrets.yml
+      environment:
+        BORG_PASSCOMMAND: "cat {{ borg_passphrase_file }}"
+
+    - name: Prune borg repository
+      command:
+        cmd: |
+          borg prune
+          --glob-archives='secrets-*'
+          {{ borg_prune_options }}
+          {{ borg_repodir }}
+      environment:
+        BORG_PASSCOMMAND: "cat {{ borg_passphrase_file }}"