fixed structure

azure/ansible/roles/backup/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+# Restic backup setup — installs restic and deploys the backup script
+- name: Install restic
+  apt:
+    name: restic
+    state: present
+
+- name: Create secrets directory
+  file:
+    path: /srv/secrets
+    state: directory
+    mode: "0700"
+
+- name: Deploy backup script
+  template:
+    src: backup.sh.j2
+    dest: /usr/local/bin/backup.sh
+    mode: "0700"
+
+- name: Setup daily backup cron (3 AM)
+  cron:
+    name: "restic daily backup"
+    hour: "3"
+    minute: "0"
+    job: "/usr/local/bin/backup.sh >> /var/log/backup.log 2>&1"

azure/ansible/roles/backup/templates/backup.sh.j2

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Managed by Ansible — do not edit manually
+
+export B2_ACCOUNT_ID="{{ b2_account_id | default('YOUR_KEY_ID') }}"
+export B2_ACCOUNT_KEY="{{ b2_account_key | default('YOUR_APPLICATION_KEY') }}"
+export RESTIC_PASSWORD="{{ restic_password | default('YOUR_BACKUP_PASSWORD') }}"
+
+REPO="b2:{{ b2_bucket | default('your-bucket') }}:/backup"
+
+restic -r "$REPO" backup \
+  --exclude /home/papyrus/apps/navidrome/music \
+  /var/lib/docker/volumes \
+  /srv/secrets \
+  /home/papyrus/apps
+
+restic -r "$REPO" forget --keep-last 7 --keep-weekly 4 --prune