Skip to content

backup: fix undefined DB name/user vars in borgmatic config

jedmund requested to merge jedmund/backup-db-vars into main

Created by: jedmund

Summary

PR 2's borgmatic config template referenced variables like `immich_db_name` and `synapse_db_user` expecting they'd resolve from each stack's role defaults. They didn't, because role defaults only load when their own role is applied; the backup playbook only loads the backup role's defaults.

Symptom

`make deploy-backup` fails at the "Deploy borgmatic config" task:

``` [ERROR]: Task failed: 'immich_db_name' is undefined ```

Why vault values worked but defaults didn't

Each per-stack `group_vars//vault.yml` loads automatically for every group nuc-mini is a member of (which is all of them). So `immich_db_password`, `komodo_db_password`, `couchdb_user`, etc. all resolve fine. But non-secret DB facts like `immich_db_name: immich` live in `roles/content_management/defaults/main.yml`, which only loads when the content_management role itself is being applied.

Fix

Mirror the non-secret DB names and users into `roles/backup/defaults/main.yml` with a comment explaining the duplication. The per-stack role defaults remain the source of truth; this is a scoped mirror for the backup playbook's variable namespace.

Verified each value against the per-stack defaults via grep before locking in:

Stack DB name DB user
Immich (content_management) `immich` `postgres`
Mastodon (social) `mastodon_production` `mastodon`
Synapse (matrix) `synapse` `synapse`
MAS (matrix) `mas` `mas`
n8n (utilities) `n8n` `n8n`
Miniflux (media_consumption) `miniflux` `miniflux`
Forgejo (development) `forgejo` `forgejo`
Blinko (productivity) `blinko` `blinko`
Draftboard (productivity) `draftboard` `draftboard`

Alternative considered

`group_vars/all/databases.yml` would be a single source of truth visible to every role, but introducing a new global vars file feels heavier than the duplication problem deserves at one consumer. If a second role ever needs the same facts, refactor then.

Commits

  1. `backup: mirror DB name/user defaults so borgmatic config can resolve them`

Test plan

  • `make deploy-backup` completes successfully through the "Deploy borgmatic config" task
  • `cat /opt/docker/backup/config/borgmatic/config.yaml` on nuc-mini shows fully-resolved DB names and users with no `{{ }}` leftovers
  • Manual borgmatic run: `docker exec borgmatic borgmatic --verbosity 1` completes without errors about missing/wrong DB credentials

Merge request reports