restore.yml (1745B)
1 --- 2 - name: Restore a database backup onto a fresh PostgreSQL host 3 hosts: all 4 gather_facts: false 5 any_errors_fatal: true 6 vars: 7 database_restore_archive: >- 8 {{ lookup('ansible.builtin.env', 'TALER_RESTORE_ARCHIVE') }} 9 database_restore_controller_directory: >- 10 {{ lookup('ansible.builtin.env', 'TALER_RESTORE_CONTROLLER_DIRECTORY') }} 11 database_restore_requested_target: >- 12 {{ lookup('ansible.builtin.env', 'TALER_RESTORE_TARGET') }} 13 pre_tasks: 14 - name: Gather host facts without logging stored local secrets 15 ansible.builtin.setup: 16 no_log: true 17 18 - name: Reject check mode for a restore 19 ansible.builtin.assert: 20 that: not ansible_check_mode 21 fail_msg: Database restore cannot run in check mode. 22 quiet: true 23 24 - name: Require one exact inventory host 25 ansible.builtin.assert: 26 that: 27 - ansible_play_hosts_all | length == 1 28 - inventory_hostname == database_restore_requested_target 29 fail_msg: >- 30 Restore requires one exact inventory hostname, not a host group or 31 pattern. 32 quiet: true 33 34 - name: Validate controller restore inputs 35 ansible.builtin.assert: 36 that: 37 - database_restore_archive | length > 0 38 - database_restore_archive != 'latest' 39 - database_restore_archive != 'LATEST' 40 - database_restore_archive is match('^[A-Za-z0-9][A-Za-z0-9._:+-]*$') 41 - database_restore_controller_directory | length > 0 42 - lookup('ansible.builtin.env', 'BORG_PASSPHRASE') | length > 0 43 fail_msg: Run restore with a passphrase, host, and exact archive. 44 quiet: true 45 46 roles: 47 - role: database 48 - role: database_restore