README.md

@@ -1,15 +1,15 @@
 # vps
 
-This repository contains all the files I use to manage my services hosted on [viyurz.fr](https://viyurz.fr).
+This repository contains all the files I use to manage services hosted on [viyurz.fr](https://viyurz.fr).
 
 ## Requirements
 
-### Initial setup
+### Ansible
 
-Run the setup script:
+Install Ansible:
 
-```sh
+```
-./setup.sh
+sudo apt install -y ansible
 ```
 
 ### SSL certificates
@@ -34,10 +34,6 @@ sudo zerossl-bot certonly --nginx -m viyurz@viyurz.fr -d turn.viyurz.fr
 sudo certbot certonly --nginx -d mail.viyurz.fr
 ```
 
-### Secrets
-
-Copy the existing `secrets.yml.example` file to `secrets.yml` and fill the variables.
-
 ### Storagebox
 
 Add credential:
@@ -49,12 +45,22 @@ username=MYUSERNAME
 password=MYPASSWORD
 ```
 
-Copy the file `fstab` and edit it accordingly (username and potentially uids/gids).
+Copy & edit file `fstab`.
+
+## Secrets
+
+Copy the existing `secrets.yml.example` to `secrets.yml`, run `ansible-vault encrypt secrets.yml` to encrypt the file with a password, and finally edit the newly encrypted file with `ansible-vault edit secrets.yml`.
+
+If you want to change the vault password run `ansible-vault rekey secrets.yml`.
 
 ## Backups
 
-Create a cronjob to periodically backup all projects:
+Run the `backup-services.yml` playbook once to setup the passphrase file.
+
+After that, you can create a root cronjob to run this playbook without requiring interactivity:
 
 ```
-0 4 * * * /home/viyurz/vps/manage.py backup ''
+0 4 * * * export ANSIBLE_ROLES_PATH=/home/viyurz/vps/roles/; /usr/bin/ansible-playbook /home/viyurz/vps/playbooks/backup-services.yml -e include_secrets=false -e selected_projects=''
 ```
+
+Here we leave `selected_projects` empty to backup all projects.

manage.py

@@ -53,8 +53,7 @@ def borgCreate(name, path=None, database=None):
     if database is not None:
         print(f"Dumping database {database}.")
 
-        dockerEnv = {"DOCKER_HOST": 'unix:///run/user/1000/docker.sock'}
+        dumpProc = subprocess.run(["docker", "exec", "postgres", "pg_dump", "-c", database], capture_output=True, text=True)
-        dumpProc = subprocess.run(["docker", "exec", "postgres", "pg_dump", "-c", database], capture_output=True, text=True, env=dockerEnv)
         if dumpProc.returncode != 0:
             print(f"Failed to dump database {database}.", file=sys.stderr)
             return 1
@@ -301,37 +300,28 @@ def main():
 
     print("\nUsing socket " + env['socket'] + ".")
 
-
-    action = ''
-    if len(sys.argv) > 1:
-        action = sys.argv[1]
-    else:
     print("\nChoose action:")
     print("[1/S] Setup project")
     print("[2/U] Update project")
     print("[3/B] Backup project")
 
+    action = ''
     while action == '':
         action = input("Action: ")
 
-
     projects = os.listdir("projects")
     print(f"\nProjects list: {projects}")
-    if len(sys.argv) > 2:
+
-        target_projects = sys.argv[2]
-    else:
     target_projects = input("Target compose project(s), space separated, leave empty to target all: ")
 
-    if target_projects.strip() == '':
+    if target_projects == '':
         target_projects = projects
     else:
-        target_projects = re.split(' ?, ?| ', target_projects.strip())
+        target_projects = target_projects.split(' ')
-
     print(f"Target projects: {target_projects}")
 
-
+    match action:
-    match action.casefold():
+        case '1' | 'S':
-        case '1' | 's' | 'setup':
             setNftables()
 
             for project in target_projects:
@@ -342,7 +332,7 @@ def main():
                     print(e, file=sys.stderr)
                     print(f"Failed to setup project {project}.", file=sys.stderr)
 
-        case '2' | 'u' | 'update':
+        case '2' | 'U':
             for project in target_projects:
                 try:
                     print()
@@ -351,7 +341,7 @@ def main():
                     print(e, file=sys.stderr)
                     print(f"Failed to update project {project}.", file=sys.stderr)
 
-        case '3' | 'b' | 'backup':
+        case '3' | 'B':
             print()
             if not os.path.exists(env['borg_repo']):
                 print(f"Creating borg repository {env['borg_repo']}.")