Use logrotate for backrest logging rather than nuking immediately

Just in case something goes wrong with healthchecks

ansible/roles/restic/files/backrest-logrotate

@@ -0,0 +1,8 @@
+/home/restic/log/* {
+  weekly
+  rotate 12
+  missingok
+  compress
+  nodateext
+  notifempty
+}

ansible/roles/restic/files/backrest.sh

@@ -20,7 +20,6 @@ cron_backup() {
     restic --verbose backup {{ restic_backup_locations|join(' ') }} &> | tee -a $RESTIC_LOG_FILE
     exit_code=${PIPESTATUS[0]}
     curl -fsS -m 10 --retry 5 -o /dev/null {{ healthchecks_host }}/{{ restic_healthchecks_id }}/$exit_code --data-binary "@$RESTIC_LOG_FILE"
-    rm $RESTIC_LOG_FILE
     echo "Exit code: $exit_code"
 }
 
@@ -36,7 +35,6 @@ cron_forget() {
     restic forget --prune $FORGET_OPTIONS &> | tee -a $RESTIC_LOG_FILE
     exit_code=${PIPESTATUS[0]}
     curl -fsS -m 10 --retry 5 -o /dev/null {{ healthchecks_host }}/{{ restic_forget_healthchecks_id }}/$exit_code --data-binary "@$RESTIC_LOG_FILE"
-    rm $RESTIC_LOG_FILE
     echo "Exit code: $exit_code"
 }
 {% endif %}

ansible/roles/restic/tasks/main.yml

@@ -51,3 +51,10 @@
     user: restic
   become: true
   when: restic_forget
+
+- name: backrest fail2ban config
+  template:
+    src: files/backrest-logrotate
+    dest: /etc/logrotate.d/backrest
+    mode: "0600"
+  become: true