feat(backups): choose which provider backs the primary and secondary restic repo #268

Merged

jfraeys merged 1 commit from jfraeys/feat/backups-repo-credentials into main

2026-10-17 14:35:11 -04:00

jfraeys commented

2026-10-17 14:16:11 -04:00

Owner

The role hardwired the primary to the Linode keys (OBJECT_STORAGE_*, which also back the Terraform state) and the secondary to OVH_OBJECT_STORAGE_*, so flipping the repos at cutover (runbook step 9) would have needed swapping vault values. Now backups_primary_provider / backups_secondary_provider (defaults linode / ovh, so nothing changes) select the credentials; tasks/credentials.yml holds the mapping and rejects equal or unknown providers.

At cutover: set them to ovh / linode in host_vars/services.yml, swap the two repository URLs in the vault, deploy --tags backups. Runbook step 9 and the role notes say so.

Test: scripts/tests/test-backups-credentials.sh (fake keys; default, flipped, same-provider, unknown), wired into lint.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

The role hardwired the primary to the Linode keys (`OBJECT_STORAGE_*`, which also back the Terraform state) and the secondary to `OVH_OBJECT_STORAGE_*`, so flipping the repos at cutover (runbook step 9) would have needed swapping vault values. Now `backups_primary_provider` / `backups_secondary_provider` (defaults linode / ovh, so nothing changes) select the credentials; `tasks/credentials.yml` holds the mapping and rejects equal or unknown providers. At cutover: set them to ovh / linode in host_vars/services.yml, swap the two repository URLs in the vault, deploy `--tags backups`. Runbook step 9 and the role notes say so. Test: scripts/tests/test-backups-credentials.sh (fake keys; default, flipped, same-provider, unknown), wired into lint. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys added 1 commit

2026-10-17 14:16:12 -04:00

feat(backups): choose which provider backs the primary and secondary restic repo

Lint / lint (pull_request) Successful in 2m36s

Details

Secret scan / scan (pull_request) Successful in 15s

Details

77973f75a2

backups_primary_provider / backups_secondary_provider (linode/ovh) pick the credentials per repo, so the
OVH cutover's repo flip is a host_vars + repo-URL change; the Linode key (also the Terraform state key)
is never swapped in the vault. Defaults keep today's behaviour. Test with fake keys, wired into lint.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

jfraeys referenced this pull request

2026-10-17 14:22:01 -04:00

refactor(secrets): OBJECT_STORAGE_* -> LINODE_OBJECT_STORAGE_* #269

jfraeys merged commit 6fe44706b1 into main

2026-10-17 14:35:11 -04:00

jfraeys referenced this pull request from a commit

2026-10-17 14:35:13 -04:00

Merge pull request 'feat(backups): choose which provider backs the primary and secondary restic repo' (#268) from jfraeys/feat/backups-repo-credentials into main

jfraeys referenced this pull request

2026-10-17 19:38:14 -04:00

Migrate production compute from Linode to OVH (starting with services) #187

jfraeys referenced this pull request