---
# Stand up the off-cluster S3 backup target on the Proxmox host — the store Velero (R-STATE-03)
# and CloudNativePG (R-IDP-05) back up into. Implemented with versitygw (Versity Gateway), which
# REPLACES the earlier MinIO target; the role also decommissions any pre-existing MinIO install so
# a re-run is a clean swap. Host infra, surgical + idempotent: the ONE ZFS dataset it owns
# (Storage/k3s-backups), the versitygw user/service/binary, and the velero + cnpg buckets. It never
# touches other datasets, sharenfs, pvesm storage, VMs or firewall.
#
# Credentials come from Ansible vault (inventory/group_vars/proxmox_hosts/vault.yml):
#   s3_backup_target_access_key / _secret_key  (versitygw ROOT key)
# The SAME key is staged for the GitOps side (SOPS) at
#   platform/backup/minio-credentials.sops.yaml
# Endpoint + key + secret + bucket names are byte-identical to the old MinIO target, so the
# cluster-side Velero/CNPG config + the SOPS secret need ZERO change.
#
# Prereqs:  ansible-galaxy collection install -r collections/requirements.yml   (community.general.zfs)
# Run:      ansible-playbook playbooks/backup-s3.yml
- name: Provision the versitygw S3 backup target on the Proxmox host
  hosts: proxmox_hosts
  become: true
  gather_facts: true          # need ansible_facts.all_ipv4_addresses to discover the LAN bind addr
  roles:
    - role: s3_backup_target