restic rest server configuration

roles/any.software.restic-rest/handlers/main.yml

@@ -0,0 +1,7 @@
+---
+- name: 'restart restic-rest-server'
+  ansible.builtin.service:
+    name: 'restic-rest-server'
+    state: 'restarted'
+
+    daemon_reload: true

roles/any.software.restic-rest/tasks/main.yml

@@ -0,0 +1,58 @@
+- name: Ensure download directory is present
+  ansible.builtin.file:
+    path: "/opt/restic-rest-{{ restic_rest_version }}"
+    state: directory
+    mode: '0755'
+
+- name: Ensure binary is downloaded
+  ansible.builtin.unarchive:
+    src: "https://github.com/restic/rest-server/releases/download/v{{ restic_rest_version }}/rest-server_{{ restic_rest_version }}_linux_amd64.tar.gz"
+    remote_src: true
+    dest: "opt/restic-rest-{{ restic_rest_version }}"
+    creates: "opt/restic-rest-{{ restic_rest_version }}/rest-server_{{ restic_rest_version }}_linux_amd64/rest-server"
+    include:
+      - "rest-server_{{ restic_rest_version }}_linux_amd64/rest-server"
+  register: res
+
+- name: Ensure binary is copied to correct location
+  ansible.builtin.copy:
+    src: "/opt/restic-rest-{{ restic_rest_version }}/rest-server_{{ restic_rest_version }}_linux_amd64/rest-server"
+    remote_src: true
+    dest: '/usr/local/bin/restic-rest-server'
+    owner: 'root'
+    group: 'root'
+    mode: '0755'
+  when: 'res.changed'
+  notify: 'restart restic-rest-server'
+
+- name: Ensure system group exists
+  ansible.builtin.group:
+    name: 'restic'
+    gid: 202
+    system: true
+    state: present
+
+- name: Ensure system user exists
+  ansible.builtin.user:
+    name: 'restic'
+    group: 'restic'
+    uid: 202
+    system: true
+    create_home: false
+
+- name: Ensure data subvolume permissions are correct
+  ansible.builtin.file:
+    path: '{{ restic_rest_data_dir }}'
+    state: directory
+    mode: '0755'
+    owner: 'restic'
+    group: 'restic'
+
+- name: Ensure service file is present
+  ansible.builtin.template:
+    src: 'restic-rest-server.service.j2'
+    dest: '/lib/systemd/system/restic-rest-server.service'
+    owner: 'root'
+    group: 'root'
+    mode: '0644'
+  notify: 'restart restic-rest-server'

roles/any.software.restic-rest/templates/restic-rest-server.service.j2

@@ -0,0 +1,14 @@
+[Unit]
+Description=Restic REST server
+After=network.target network-online.target
+Requires=network-online.target
+
+[Service]
+Type=exec
+User=restic
+Group=restic
+ExecStart=/usr/local/bin/restic-rest-server --path {{ restic_rest_data_dir }} --no-auth --prometheus
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

roles/any.tools.restic/tasks/main.yml

@@ -7,13 +7,14 @@
 
 - name: Ensure compressed binary is downloaded
   ansible.builtin.get_url:
-    url: "https://github.com/restic/restic/releases/download/v{{ restic_version }}/restic_{{ restic_version }}_linux_arm64.bz2"
+    url: "https://github.com/restic/restic/releases/download/v{{ restic_version }}/restic_{{ restic_version }}_linux_amd64.bz2"
     dest: "/opt/restic/{{ restic_version }}/restic-{{ restic_version }}.bz2"
   register: res
 
 - name: Ensure binary is decompressed
   ansible.builtin.shell:
     cmd: "bunzip2 -k /opt/restic/{{ restic_version }}/restic-{{ restic_version }}.bz2"
+    creates: "/opt/restic/{{ restic_version }}/restic-{{ restic_version }}"
   when: 'res.changed'
 
 - name: Ensure binary is copied to correct location

roles/restic/tasks/main.yml

@@ -1,24 +1,24 @@
 ---
 - name: Ensure download directory is present
   ansible.builtin.file:
-    path: "/home/debian/restic-{{ restic_version }}"
+    path: "/opt/restic-{{ restic_version }}"
     state: directory
     mode: '0755'
 
 - name: Ensure compressed binary is downloaded
   ansible.builtin.get_url:
     url: "https://github.com/restic/restic/releases/download/v{{ restic_version }}/restic_{{ restic_version }}_linux_arm64.bz2"
-    dest: "/home/debian/restic-{{ restic_version }}/restic-{{ restic_version }}.bz2"
+    dest: "/opt/restic-{{ restic_version }}/restic-{{ restic_version }}.bz2"
   register: res
 
 - name: Ensure binary is decompressed
   ansible.builtin.shell:
-    cmd: "bunzip2 -k /home/debian/restic-{{ restic_version }}/restic-{{ restic_version }}.bz2"
+    cmd: "bunzip2 -k /opt/restic-{{ restic_version }}/restic-{{ restic_version }}.bz2"
   when: 'res.changed'
 
 - name: Ensure binary is copied to correct location
   ansible.builtin.copy:
-    src: "/home/debian/restic-{{ restic_version }}/restic-{{ restic_version }}"
+    src: "/opt/restic-{{ restic_version }}/restic-{{ restic_version }}"
     remote_src: true
     dest: '/usr/local/bin/restic'
     owner: 'root'