From 41a8fe3b4df350d1b182f84fce418c642da102dc Mon Sep 17 00:00:00 2001
From: Jake Howard <git@theorangeone.net>
Date: Sun, 27 Jun 2021 10:58:01 +0100
Subject: [PATCH] Use logrotate for backrest logging rather than nuking
 immediately

Just in case something goes wrong with healthchecks
---
 ansible/roles/restic/files/backrest-logrotate | 8 ++++++++
 ansible/roles/restic/files/backrest.sh        | 2 --
 ansible/roles/restic/tasks/main.yml           | 7 +++++++
 3 files changed, 15 insertions(+), 2 deletions(-)
 create mode 100644 ansible/roles/restic/files/backrest-logrotate

diff --git a/ansible/roles/restic/files/backrest-logrotate b/ansible/roles/restic/files/backrest-logrotate
new file mode 100644
index 0000000..b074ee8
--- /dev/null
+++ b/ansible/roles/restic/files/backrest-logrotate
@@ -0,0 +1,8 @@
+/home/restic/log/* {
+  weekly
+  rotate 12
+  missingok
+  compress
+  nodateext
+  notifempty
+}
diff --git a/ansible/roles/restic/files/backrest.sh b/ansible/roles/restic/files/backrest.sh
index 6c9a29f..21e9911 100644
--- a/ansible/roles/restic/files/backrest.sh
+++ b/ansible/roles/restic/files/backrest.sh
@@ -20,7 +20,6 @@ cron_backup() {
     restic --verbose backup {{ restic_backup_locations|join(' ') }} &> | tee -a $RESTIC_LOG_FILE
     exit_code=${PIPESTATUS[0]}
     curl -fsS -m 10 --retry 5 -o /dev/null {{ healthchecks_host }}/{{ restic_healthchecks_id }}/$exit_code --data-binary "@$RESTIC_LOG_FILE"
-    rm $RESTIC_LOG_FILE
     echo "Exit code: $exit_code"
 }
 
@@ -36,7 +35,6 @@ cron_forget() {
     restic forget --prune $FORGET_OPTIONS &> | tee -a $RESTIC_LOG_FILE
     exit_code=${PIPESTATUS[0]}
     curl -fsS -m 10 --retry 5 -o /dev/null {{ healthchecks_host }}/{{ restic_forget_healthchecks_id }}/$exit_code --data-binary "@$RESTIC_LOG_FILE"
-    rm $RESTIC_LOG_FILE
     echo "Exit code: $exit_code"
 }
 {% endif %}
diff --git a/ansible/roles/restic/tasks/main.yml b/ansible/roles/restic/tasks/main.yml
index 3ea3124..ddfac7c 100644
--- a/ansible/roles/restic/tasks/main.yml
+++ b/ansible/roles/restic/tasks/main.yml
@@ -51,3 +51,10 @@
     user: restic
   become: true
   when: restic_forget
+
+- name: backrest fail2ban config
+  template:
+    src: files/backrest-logrotate
+    dest: /etc/logrotate.d/backrest
+    mode: "0600"
+  become: true