Integrate restic backup system

roles/lander/files/lander.backup.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+data_dir='/mnt/data1/lander'
+snapshot_dir="${data_dir}.snapshot"
+
+# Read-only snapshot for atomic backup
+btrfs subvolume snapshot -r "$data_dir" "$snapshot_dir" || exit $?
+
+restic backup "$snapshot_dir"
+
+# Always remove snapshot subvolume, even if restic fails
+btrfs subvolume delete "$snapshot_dir"

roles/lander/tasks/main.yml

@@ -23,7 +23,12 @@
     system: true
     create_home: false
 
-- name: Ensure data directory is present
+# Only one BTRFS file system should be mounted, so this will match that one
+- name: Ensure data subvolume is present
+  community.general.btrfs_subvolume:
+    name: '/lander'
+
+- name: Ensure data subvolume permissions are correct
   ansible.builtin.file:
     path: '/mnt/data1/lander'
     state: directory
@@ -48,6 +53,14 @@
     mode: '0644'
   notify: lander-restart
 
+- name: Ensure backup script is present
+  ansible.builtin.copy:
+    src: 'lander.backup.sh'
+    dest: '/etc/backups/lander.backup.sh'
+    owner: 'root'
+    group: 'root'
+    mode: '0644'
+
 - name: Ensure service file is present
   ansible.builtin.copy:
     src: 'lander.service'