LubeLogger: back up data+keys volumes to PBS via the playbook

Close the volume-backup gap: the pg_dump covered Postgres only; the ASP.NET
DataProtection keyring (root-user credential) and uploaded docs live in the
lubelogger-{data,keys} volumes. The docker-volume-backup sidecar can't target PBS
natively, so both volumes now ride the same proxmox-backup-client job as the SQL
dump — one host/lubelogger snapshot, three .pxar archives, keep-daily 14. Backup
script+units are now installed by the Ansible playbook (idempotent, changed=0);
PBS token from ansible-vault. Restore verified: keyring XML + sentinel doc
byte-identical (sha256). Removes the now-playbook-managed standalone script/units.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lubelogger/deploy-lubelogger.yml

@@ -6,6 +6,11 @@
     app_dir: /home/tommy/lubelogger
     app_port: 8099
 
+  handlers:
+    - name: reload systemd
+      ansible.builtin.systemd_service:
+        daemon_reload: true
+
   tasks:
     - name: Create lubelogger directory
       ansible.builtin.file:
@@ -102,3 +107,100 @@
     - name: Show deployment result
       ansible.builtin.debug:
         msg: "lubelogger is {{ 'running (changed)' if app_result.changed else 'already up (no-op)' }} on port {{ app_port }}"
+
+    # ---- Backup: pg_dump + data/keys volumes -> PBS (host/lubelogger, keep-daily 14) ----
+    # docker-volume-backup sidecar cannot target a PBS datastore natively, so the two
+    # volumes ride the same proxmox-backup-client job as the SQL dump: one snapshot,
+    # three archives, one retention. Secrets come from ansible-vault, never committed.
+
+    - name: Install PBS backup credentials (from vault)
+      ansible.builtin.copy:
+        dest: /etc/lubelogger-backup.env
+        owner: root
+        group: root
+        mode: "0600"
+        content: |
+          # Managed by deploy-lubelogger.yml. PBS push creds — NOT in git.
+          PBS_PASSWORD={{ vault_lubelogger_pbs_token }}
+          PBS_FINGERPRINT=90:6B:3E:85:C4:E7:77:F0:24:25:1D:B0:2C:F9:6D:08:AA:CE:08:CE:7B:04:4C:C7:C9:E0:CF:DD:99:44:DB:21
+          PBS_REPOSITORY='root@pam!vaultwarden-backup@192.168.99.153:rust-usb'
+      no_log: true
+
+    - name: Install lubelogger backup script
+      ansible.builtin.copy:
+        dest: /usr/local/bin/lubelogger-backup.sh
+        owner: root
+        group: root
+        mode: "0700"
+        content: |
+          #!/bin/bash
+          # LubeLogger backup -> Proxmox Backup Server.
+          # One snapshot (host/lubelogger), three archives: Postgres logical dump +
+          # the data and keys volumes (uploads, config, ASP.NET DataProtection keyring).
+          # Managed by deploy-lubelogger.yml; driven by lubelogger-backup.timer.
+          set -euo pipefail
+          source /etc/lubelogger-backup.env
+          export PBS_PASSWORD PBS_FINGERPRINT
+
+          DATA_VOL=/var/lib/docker/volumes/lubelogger_lubelogger-data/_data
+          KEYS_VOL=/var/lib/docker/volumes/lubelogger_lubelogger-keys/_data
+
+          TMPDIR=$(mktemp -d)
+          trap 'rm -rf "$TMPDIR"' EXIT
+
+          # Logical DB dump (app schema + data); app stays online.
+          docker exec lubelogger-db pg_dump -U lubelogger lubelogger > "$TMPDIR/lubelogger.sql"
+
+          proxmox-backup-client backup \
+            "lubelogger-db.pxar:$TMPDIR" \
+            "lubelogger-data.pxar:$DATA_VOL" \
+            "lubelogger-keys.pxar:$KEYS_VOL" \
+            --repository "$PBS_REPOSITORY" \
+            --backup-type host \
+            --backup-id lubelogger
+
+          proxmox-backup-client prune "host/lubelogger" \
+            --repository "$PBS_REPOSITORY" \
+            --keep-daily 14
+      notify: reload systemd
+
+    - name: Install backup systemd service unit
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/lubelogger-backup.service
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=LubeLogger backup (pg_dump + volumes) -> PBS
+          After=docker.service
+          Requires=docker.service
+
+          [Service]
+          Type=oneshot
+          ExecStart=/usr/local/bin/lubelogger-backup.sh
+      notify: reload systemd
+
+    - name: Install backup systemd timer unit
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/lubelogger-backup.timer
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Daily LubeLogger backup to PBS
+
+          [Timer]
+          OnCalendar=*-*-* 03:30:00
+          Persistent=true
+
+          [Install]
+          WantedBy=timers.target
+      notify: reload systemd
+
+    - name: Enable lubelogger backup timer
+      ansible.builtin.systemd_service:
+        name: lubelogger-backup.timer
+        enabled: true
+        state: started