Rework backup to remote host to reduce possibility to see a password in a plain text.

Fix #705

Author: php-coder

src/main/config/cron/mystamps-backup-remote

@@ -1,6 +1,6 @@
 # /etc/cron.d/mystamps-backup-remote file for backuping my-stamps.ru data to remote host
 MAILTO=coder
 #
-# min	hour	dom		mon		dow		user		command
-45	0	*		*		*		mystamps	duplicity --name=uploads --no-compression --no-encryption /data/uploads {{ uploads_target_url }} 2>&1
-50	0	*		*		*		mystamps	PASSPHRASE='{{ gpg_passphrase }}' duplicity --name=mysql-backups --no-compression /data/backups {{ mysql_backups_target_url }} 2>&1
+# min  hour  dom  mon  dow  user  command
+45     0     *    *    *    root  /data/bin/remote-backup.sh uploads 2>&1
+50     0     *    *    *    root  /data/bin/remote-backup.sh mysql-backups 2>&1

src/main/scripts/remote-backup.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+set -o nounset
+set -o errexit
+
+UPLOADS_DST='{{ uploads_target_url }}'
+MYSQL_BACKUPS_DST='{{ mysql_backups_target_url }}'
+PASSPHRASE='{{ gpg_passphrase }}'
+
+case "${1:-}" in
+	'uploads')
+		su \
+			mystamps \
+			-c "duplicity --name=uploads --no-compression --no-encryption /data/uploads ${UPLOADS_DST}" \
+			2>&1
+		;;
+	'mysql-backups')
+		PASSPHRASE="$PASSPHRASE" su \
+			mystamps \
+			-c "duplicity --name=mysql-backups --no-compression /data/backups ${MYSQL_BACKUPS_DST}" \
+			2>&1
+		;;
+	*)
+		echo 2>&1 "Usage: $(dirname "$0") (uploads|mysql-backups)"
+		exit 1
+esac

vagrant/provisioning/roles/mystamps-backup/tasks/main.yml

@@ -53,13 +53,32 @@
     creates: /etc/duplicity/cacert.pem
     warn: no
 
-- name: Creating a cron task for backup to a remote host
+- name: Creating /data/bin directory
+  file:
+    path: /data/bin
+    state: directory
+    owner: root
+    group: root
+    mode: '0755'
+
+# @todo #705 remote-backup.sh: find a way to protect duplicity against ps
+- name: Creating a script for doing remote backup
   template:
+    src: ../../src/main/scripts/remote-backup.sh
+    dest: /data/bin/remote-backup.sh
+    force: yes
+    backup: no
+    owner: root
+    group: root
+    mode: '0700'
+
+- name: Creating a cron task for backup to a remote host
+  copy:
     src: ../../src/main/config/cron/mystamps-backup-remote
     dest: /etc/cron.d/mystamps-backup-remote
     force: yes
     backup: no
     owner: root
     group: root
-    mode: '0600'
+    mode: '0644'