monica: add backup script

roles/monica/files/monica.backup.sh

@@ -0,0 +1,17 @@
+cd /etc/monica
+
+/usr/bin/docker compose exec -T db mysqldump -u monica -pmonica monica |
+    /usr/bin/gzip --rsyncable |
+    /usr/local/bin/restic backup --stdin --stdin-filename monica-mariadb.sql.gz
+
+# Snapshot data directory
+data_dir='/mnt/data1/monica/monica'
+snapshot_dir="${data_dir}.snapshot"
+
+# Read-only snapshot for atomic backup
+btrfs subvolume snapshot -r "$data_dir" "$snapshot_dir" || exit $?
+
+/usr/local/bin/restic backup "$snapshot_dir"
+
+# Always remove snapshot subvolume, even if restic fails
+btrfs subvolume delete "$snapshot_dir"

roles/monica/tasks/main.yml

@@ -43,3 +43,11 @@
     chdir: '/etc/monica'
     cmd: 'docker compose up -d --remove-orphans'
   when: 'res.changed'
+
+- name: Ensure backup script is present
+  ansible.builtin.copy:
+    src: 'monica.backup.sh'
+    dest: '/etc/backups/monica.backup.sh'
+    owner: 'root'
+    group: 'root'
+    mode: '0644'