@yunuseon/kayra 0.0.0-stage → 0.4.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Yunus Öztürk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,81 @@
-# Temporary Holding Version
+# kayra
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A self-hosted app platform for running other people's apps safely, one server
+per customer, all of it as code.
+
+kayra sets up a server (Hetzner, a machine at home, or a local Multipass VM)
+with Traefik, Authelia, Jenkins, a private registry and rootless BuildKit, and
+then builds and deploys apps from their own repositories: a push to an app's
+branch is a deploy. Servers are described in a git repository (a **fleet**);
+kayra is the engine that turns that description into running machines.
+
+```
+   kayra (this repo, versioned)            a fleet (your repo)          apps (their repos)
+ ┌──────────────────────────────┐      ┌───────────────────────┐    ┌──────────────────┐
+ │ CLI: kayra up/setup/apps/…   │◀─────│ servers/<name>/       │    │ app.yml          │
+ │ Ansible, OpenTofu, compose   │ pins │   server.yml, vars,   │    │ Dockerfiles      │
+ │ Jenkins pipeline library     │      │   vault secrets       │    └────────┬─────────┘
+ │ compose admission policy     │      │ package.json → kayra  │             │ built & deployed
+ └──────────────────────────────┘      └───────────────────────┘             ▼ by the platform
+```
+
+## Why
+
+- **Apps are untrusted by design.** Builds run in rootless BuildKit with no
+  Docker socket; an app's compose files are admitted against an allow-list
+  modelled on Kubernetes' Pod Security "restricted" before anything starts;
+  platform services sit on a network apps cannot reach.
+- **Apps are plain data.** An app is an `app.yml` and its Dockerfiles — no
+  Jenkinsfile, no Ansible. It runs without the platform locally and can leave
+  with its customer at any time.
+- **One server per customer, reproducible.** Everything about a server lives in
+  its folder of the fleet; secrets per server in Ansible Vault; machines from
+  OpenTofu; every version pinned and kept current by Renovate.
+- **Small and self-hosted.** No cloud provider beyond a VPS; it runs on a
+  single Hetzner box or at home.
+
+## Status
+
+`0.x`: in production on its author's own servers, and the fleet format may
+still change between releases. Expect to read the code.
+
+## Quick start
+
+You need Node 24, `yq`, `jq`, OpenTofu and Ansible (and Multipass plus
+`mkcert` for a local test server):
+
+```bash
+brew install yq jq opentofu ansible mkcert nss && mkcert -install
+npm install -g @yunuseon/kayra
+```
+
+A fleet is a git repository with a `package.json` that pins kayra
+(`npm install -D -E @yunuseon/kayra`), a `servers/defaults.yml` and one folder per
+server under `servers/` — see [CLAUDE.md](CLAUDE.md#the-fleet-contract-one-folder-per-server)
+for what goes where. Any `kayra` on your PATH then runs the version the fleet
+pins:
+
+```bash
+kayra doctor              # what is still missing
+kayra up shop-test        # provision + set up a server, register its apps
+kayra deploy shop-prod    # host setup + apps, no re-provision (from main only)
+kayra status
+```
+
+## Documentation
+
+| | |
+|---|---|
+| [`CLAUDE.md`](CLAUDE.md) | how everything fits together, and the rules that keep it working |
+| [`docs/app-contract.md`](docs/app-contract.md) | what an app provides and what it may not do |
+| [`docs/authentication.md`](docs/authentication.md) | staff login (Authelia), adding people, recovery |
+| [`docs/ci-isolation.md`](docs/ci-isolation.md) | why app code cannot reach the host or the platform |
+
+## Contributing
+
+Issues and pull requests are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md).
+Security problems: [SECURITY.md](SECURITY.md).
+
+## License
+
+[MIT](LICENSE) © Yunus Öztürk

package/ansible/.ansible-lint

@@ -0,0 +1,13 @@
+# ansible-lint, run by the platform checks (ci/checks).
+skip_list:
+  # Variable names are the contract with every server's vars.yml (several
+  # vaulted) and are shared across roles (domain, apps_dir); prefixing them
+  # per role would rename that contract for nothing.
+  - var-naming[no-role-prefix]
+  # edge-proxy predates the check; renaming a role is churn, not safety.
+  - role-name
+  # Ordering matters in the platform role: JCasC reloads before the agent
+  # secret is fetched, the agent is recreated right after. Handlers would run
+  # at the end of the play instead.
+  - no-handler
+  - yaml[line-length]

package/ansible/ansible.cfg

@@ -0,0 +1,12 @@
+[defaults]
+roles_path = roles/
+host_key_checking = False
+retry_files_enabled = False
+callbacks_enabled = ansible.builtin.default
+[callback_default]
+result_format = yaml
+nocows = True
+
+[ssh_connection]
+pipelining = True
+ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

package/ansible/playbooks/adopt.yml

@@ -0,0 +1,35 @@
+---
+# =============================================================================
+# Adopt playbook — makes a server we did not create reachable the way our
+# cloud-init would have: a `deploy` user with sudo and our key. Runs as root,
+# once; everything after that is the server's normal playbook as deploy.
+#
+# Usage: kayra adopt <server>
+# =============================================================================
+
+- name: Adopt server
+  hosts: servers
+  gather_facts: false
+  vars:
+    # A play var, so it beats the inventory's ansible_user=deploy (-u does not).
+    ansible_user: root
+
+  tasks:
+    - name: Create the deploy user
+      ansible.builtin.user:
+        name: deploy
+        groups: sudo
+        append: true
+        shell: /bin/bash
+
+    - name: Authorize our key for deploy
+      ansible.posix.authorized_key:
+        user: deploy
+        key: "{{ lookup('file', ansible_ssh_private_key_file ~ '.pub') }}"
+
+    - name: Passwordless sudo for deploy
+      ansible.builtin.copy:
+        content: "deploy ALL=(ALL) NOPASSWD:ALL\n"
+        dest: /etc/sudoers.d/deploy
+        mode: "0440"
+        validate: visudo -cf %s

package/ansible/playbooks/app.yml

@@ -0,0 +1,21 @@
+---
+# =============================================================================
+# App Playbook — registers one app with the platform.
+#
+# `app` is the app's entry from servers/<server>/server.yml, as JSON:
+#   {"name": "x", "repo": "https://…", "ref": "main", "path": "."}
+#
+# Usage: kayra apps <server>
+# =============================================================================
+
+- name: Register app
+  hosts: servers
+
+  # git_token: the app's repo is fetched with it.
+  vars_files:
+    - "{{ server_dir }}/../defaults.yml"
+    - "{{ server_dir }}/vars.yml"
+    - "{{ server_dir }}/secrets.yml"
+
+  roles:
+    - app

package/ansible/playbooks/apps-prune.yml

@@ -0,0 +1,30 @@
+---
+# =============================================================================
+# Apps-prune playbook — removes every app registered on the server that
+# server.yml no longer lists. Registered = has a 10-<app>.yaml, the one file
+# every app gets. Data (volumes) is kept; see bin/app-remove.
+#
+# `keep` is the list of app names in server.yml, as JSON.
+# Usage: kayra apps <server>  (runs this after registering the apps)
+# =============================================================================
+
+- name: Prune apps
+  hosts: servers
+  become: true
+
+  vars:
+    platform_dir: /opt/platform
+
+  tasks:
+    - name: Find registered apps
+      ansible.builtin.find:
+        paths: "{{ platform_dir }}/jenkins/casc"
+        patterns: "10-*.yaml"
+      register: fragments
+
+    - name: Remove apps no longer in server.yml
+      ansible.builtin.command: "{{ platform_dir }}/bin/app-remove {{ item }}"
+      loop: "{{ registered | difference(keep) }}"
+      vars:
+        registered: "{{ fragments.files | map(attribute='path') | map('basename') | map('regex_replace', '^10-(.*)\\.yaml$', '\\1') | list }}"
+      changed_when: true

package/ansible/playbooks/edge.yml

@@ -0,0 +1,41 @@
+---
+# =============================================================================
+# Edge playbook — a server that exposes services from a private network (the
+# home NAS behind a Fritzbox) to the internet: a WireGuard tunnel to the LAN
+# and Caddy terminating TLS in front of it, plus the outside check on that
+# network's backups. No platform, no apps. Its firewall is Hetzner's
+# (servers/<server>/terraform/); nothing on the host filters on top.
+#
+# Usage: kayra setup <server>  (for servers with kind: edge)
+# =============================================================================
+
+- name: Edge server
+  hosts: servers
+  become: true
+
+  vars_files:
+    - "{{ server_dir }}/../defaults.yml"
+    - "{{ server_dir }}/vars.yml"
+    - "{{ server_dir }}/secrets.yml"
+
+  roles:
+    - common
+    - docker
+    - wireguard
+    - edge-proxy
+    - backup-check
+
+  # ufw predates the repo on adopted servers: a second, drifting copy of the
+  # Hetzner firewall's rules. Docker's own FORWARD chains carry Caddy's
+  # traffic into the tunnel either way.
+  tasks:
+    - name: Read ufw's status
+      ansible.builtin.command: ufw status
+      register: ufw_status
+      changed_when: false
+      failed_when: false
+
+    - name: Disable ufw
+      ansible.builtin.command: ufw disable
+      when: "'Status: active' in ufw_status.stdout"
+      changed_when: true

package/ansible/playbooks/nas.yml

@@ -0,0 +1,47 @@
+---
+# =============================================================================
+# NAS playbook — a storage box whose OS belongs to its vendor (UGOS). Nothing
+# here touches the OS: no packages, users or system config, which an update
+# could reset. Everything runs as containers from files below nas_root, and
+# the play stops before any change if a path it writes lies outside. What it
+# backs up may lie anywhere: mounted read-only, and only if it already exists.
+#
+# Usage: kayra setup <server>  (for servers with kind: nas)
+# =============================================================================
+
+- name: NAS
+  hosts: servers
+  become: true
+
+  vars_files:
+    - "{{ server_dir }}/../defaults.yml"
+    - "{{ server_dir }}/vars.yml"
+    - "{{ server_dir }}/secrets.yml"
+
+  pre_tasks:
+    - name: Write only inside nas_root
+      ansible.builtin.assert:
+        that: item is match('^' ~ nas_root ~ '/') and '/../' not in item ~ '/'
+        fail_msg: "{{ item }} lies outside {{ nas_root }}"
+        quiet: true
+      loop: "{{ [restic_backup.dir, compose_stacks.dir] }}"
+
+    # Docker creates a missing bind-mount source, a write wherever it points.
+    - name: Find the backed-up paths
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      register: backed_up
+      loop: "{{ restic_backup.paths }}"
+
+    - name: Back up only paths that exist
+      ansible.builtin.assert:
+        that: item.stat.isdir | default(false) and '/../' not in item.item ~ '/'
+        fail_msg: "{{ item.item }} is not an existing directory"
+        quiet: true
+      loop: "{{ backed_up.results }}"
+      loop_control:
+        label: "{{ item.item }}"
+
+  roles:
+    - restic-backup
+    - compose-stacks

package/ansible/playbooks/platform.yml

@@ -0,0 +1,62 @@
+---
+# =============================================================================
+# Platform Playbook — app-agnostic infrastructure setup
+#
+# Play 1: Bootstrap — base packages, deploy user, Docker installation.
+#         Run once on a fresh server (idempotent, safe to re-run).
+# Play 2: Platform — Traefik + Jenkins + Registry via docker compose.
+#         Re-run whenever platform config, certs, or Jenkins config changes.
+#
+# The platform lives in /opt/platform and knows no app by name. Apps live in
+# /opt/apps/<name> and register with Jenkins via /opt/platform/bin/jenkins-app-apply.
+#
+# server, server_dir, domain and target are passed via -e. Platform vars
+# (git_token, jenkins_admin_password, etc.) come from servers/<server>/vars.yml.
+#
+# Usage: kayra setup <server>
+# =============================================================================
+
+- name: Bootstrap server
+  hosts: servers
+  become: true
+
+  vars_files:
+    - "{{ server_dir }}/../defaults.yml"
+    - "{{ server_dir }}/vars.yml"
+    - "{{ server_dir }}/secrets.yml"
+
+  roles:
+    - common
+    - docker
+
+  post_tasks:
+    - name: Verify Docker is working
+      ansible.builtin.command: docker info
+      changed_when: false
+
+- name: Deploy platform stack
+  hosts: servers
+
+  vars_files:
+    - "{{ server_dir }}/../defaults.yml"
+    - "{{ server_dir }}/vars.yml"
+    - "{{ server_dir }}/secrets.yml"
+
+  roles:
+    - platform
+    # A server's own stacks (servers/<server>/stacks/), where it has any.
+    - role: compose-stacks
+      become: true
+      when: compose_stacks is defined
+    - role: forgejo-config
+      when: forgejo_config is defined
+
+  post_tasks:
+    - name: Show platform status
+      ansible.builtin.debug:
+        msg: |
+          Platform ready! ({{ server }})
+          Jenkins:   https://jenkins.{{ domain }}
+          Traefik:   https://traefik.{{ domain }}
+
+          Next: `kayra apps {{ server }}` to register this server's apps.

package/ansible/requirements.yml

@@ -0,0 +1,7 @@
+# Collections the playbooks use, pinned. Installed by kayra
+# before any playbook runs.
+collections:
+  - name: ansible.posix
+    version: 2.2.2
+  - name: community.docker
+    version: 5.3.0

package/ansible/roles/app/defaults/main.yml

@@ -0,0 +1,9 @@
+---
+# The platform's server-side contract (see the platform role's defaults).
+platform_dir: /opt/platform
+apps_dir: /opt/apps
+# The fleet's files (servers/, .cache/apps) lie above the server's folder;
+# the engine's (compose files, scripts, hosts.conf) above the playbooks. Two
+# roots, so the engine can live apart from the fleet it serves.
+fleet_root: "{{ server_dir }}/../.."
+kayra_root: "{{ playbook_dir }}/../.."

package/ansible/roles/app/tasks/main.yml

@@ -0,0 +1,107 @@
+---
+# =============================================================================
+# App role — the same for every app. Reads the app's app.yml and the
+# operator's values for it, servers/<server>/apps/<app>.yml (config,
+# plaintext) and <app>.secrets.yml (secrets, vault on real servers), and
+# registers the app:
+#   {{ apps_dir }}/<app>/.env                 operator config for compose
+#   {{ platform_dir }}/jenkins/casc/10-<app>.yaml   folder, jobs, credentials
+#   jenkins-app-apply                          secrets + JCasC reload
+#
+# Compose files are not copied: the deploy takes them from the commit it
+# deploys. Nothing here is specific to any app.
+# =============================================================================
+
+# With the token Jenkins clones with, not the operator's git credentials: a
+# token that cannot read the app fails here, at registration, rather than at
+# its first build. Sent as a header via the environment, so it is neither in
+# the clone's config nor in the process list (Ansible prints the environment
+# only at -vvv).
+- name: Fetch app from its repository
+  ansible.builtin.git:
+    repo: "{{ app.repo }}"
+    version: "{{ app.ref | default('main') }}"
+    dest: "{{ fleet_root }}/.cache/apps/{{ app.name }}"
+    depth: 1
+    force: true
+  environment:
+    GIT_CONFIG_COUNT: "1"
+    GIT_CONFIG_KEY_0: http.extraHeader
+    GIT_CONFIG_VALUE_0: "Authorization: Basic {{ ('x-access-token:' ~ git_token) | b64encode }}"
+  delegate_to: localhost
+  run_once: true
+
+- name: Resolve app source
+  ansible.builtin.set_fact:
+    app_root: "{{ fleet_root }}/.cache/apps/{{ app.name }}/{{ app.path | default('.') }}"
+    app_repo: "{{ app.repo }}"
+    app_ref: "{{ app.ref | default('main') }}"
+
+- name: Read app.yml
+  ansible.builtin.include_vars:
+    file: "{{ app_root }}/app.yml"
+    name: manifest
+
+# Either file may be missing: an app without config or without secrets.
+- name: Read the operator's values for this app
+  ansible.builtin.include_vars:
+    file: "{{ server_dir }}/apps/{{ app.name }}{{ item.suffix }}"
+    name: "{{ item.name }}"
+  when: (server_dir ~ '/apps/' ~ app.name ~ item.suffix) is file
+  loop:
+    - {name: app_config, suffix: .yml}
+    - {name: app_secrets, suffix: .secrets.yml}
+  loop_control: {label: "{{ app.name }}{{ item.suffix }}"}
+
+- name: Check the app against the platform
+  ansible.builtin.assert:
+    that:
+      - manifest.name == app.name
+      - missing_secrets | length == 0
+      - missing_config | length == 0
+      - reserved_subdomains | length == 0
+    fail_msg: >-
+      {{ app.name }}: app.yml name={{ manifest.name }};
+      missing config {{ missing_config }} in servers/{{ server }}/apps/{{ app.name }}.yml,
+      missing secrets {{ missing_secrets }} in servers/{{ server }}/apps/{{ app.name }}.secrets.yml;
+      subdomains reserved by the platform {{ reserved_subdomains }}
+    quiet: true
+  vars:
+    missing_secrets: "{{ manifest.secrets | default([]) | difference(app_secrets | default({}) | list) }}"
+    missing_config: "{{ manifest.config | default([]) | difference(app_config | default({}) | list) }}"
+    reserved_subdomains: "{{ manifest.subdomains | intersect(lookup('file', kayra_root ~ '/hosts.conf').splitlines() | reject('match', '^\\s*(#|$)') | list) }}"
+
+- name: Create app directory
+  ansible.builtin.file:
+    path: "{{ apps_dir }}/{{ app.name }}"
+    state: directory
+    owner: deploy
+    group: deploy
+    mode: "0755"
+  become: true
+
+- name: Render app .env
+  ansible.builtin.template:
+    src: app.env.j2
+    dest: "{{ apps_dir }}/{{ app.name }}/.env"
+    owner: deploy
+    group: deploy
+    mode: "0644"
+  become: true
+
+- name: Render the app's JCasC fragment
+  ansible.builtin.template:
+    src: casc-app.yaml.j2
+    dest: "{{ platform_dir }}/jenkins/casc/10-{{ app.name }}.yaml"
+    owner: deploy
+    group: deploy
+    mode: "0644"
+  become: true
+
+- name: Apply secrets and reload Jenkins
+  ansible.builtin.command:
+    cmd: "{{ platform_dir }}/bin/jenkins-app-apply {{ app.name }}"
+    stdin: "{% for key in manifest.secrets | default([]) %}{{ key }}={{ app_secrets[key] }}\n{% endfor %}"
+  no_log: true
+  become: true
+  changed_when: true

package/ansible/roles/app/templates/app.env.j2

@@ -0,0 +1,9 @@
+# {{ apps_dir }}/{{ app.name }}/.env — generated by the platform app role from
+# servers/{{ server }}/apps/{{ app.name }}.yml. Do not edit on the server.
+# Secrets are not here: the deploy injects them from Jenkins credentials.
+
+COMPOSE_PROJECT_NAME={{ app.name }}
+DOMAIN={{ domain }}
+{% for key in manifest.config | default([]) %}
+{{ key }}={{ app_config[key] }}
+{% endfor %}

package/ansible/roles/app/templates/casc-app.yaml.j2

@@ -0,0 +1,68 @@
+{#- Rendered once per app by the platform app role. The jobs run the platform
+    library's pipelines; the app's repo is only ever checked out as data. -#}
+{% set coords = {
+  'name': app.name, 'repo': app_repo, 'ref': app_ref, 'path': app.path | default('.'),
+  'hosts': manifest.subdomains | map('regex_replace', '$', '.' ~ domain) | list,
+  'secrets': manifest.secrets | default([]),
+} -%}
+{% set literal = coords | to_json | regex_replace('^\\{', '[') | regex_replace('\\}$', ']') | regex_replace('"(\\w+)": ', '\\1: ') %}
+# =============================================================================
+# {{ app.name }} — generated by the platform app role. Do not edit on the server.
+# =============================================================================
+
+credentials:
+  system:
+    domainCredentials:
+      - credentials:
+{% for key in manifest.secrets | default([]) %}
+          - string:
+              scope: GLOBAL
+              id: "{{ app.name }}-{{ key | lower | replace('_', '-') }}"
+              description: "{{ app.name }}: {{ key }}"
+              secret: "${readFile:/run/app-secrets/{{ app.name }}/{{ key }}}"
+{% endfor %}
+
+jobs:
+  - script: |
+      folder("{{ app.name }}") {
+        displayName("{{ app.name }}")
+      }
+
+      pipelineJob("{{ app.name }}/build") {
+        displayName("Build")
+        description("Builds {{ app.name }}'s images from {{ app_ref }} on every push (GitHub webhook, hourly poll as fallback); any other branch on demand. A green {{ app_ref }} build deploys that exact commit.")
+        logRotator { numToKeep(20) }
+        // Declared here as well as in the pipeline: a JCasC reload regenerates
+        // the job from this DSL, and parameters only the pipeline declared
+        // would be gone — Jenkins then silently drops the ones passed in.
+        parameters {
+          stringParam("BRANCH", "{{ app_ref }}", "Branch, tag or commit to build")
+        }
+        definition {
+          cps {
+            script('''@Library('platform') _
+      appBuild({{ literal }})''')
+            sandbox(true)
+          }
+        }
+        triggers {
+          githubPush()
+          scm("H * * * *")
+        }
+      }
+
+      pipelineJob("{{ app.name }}/deploy") {
+        displayName("Deploy")
+        description("Deploys any branch, tag or commit of {{ app.name }}: builds missing images, admits the compose config against the platform policy, runs it, records the release. Rollback starts it with an older SHA.")
+        logRotator { numToKeep(50) }
+        parameters {
+          stringParam("REF", "{{ app_ref }}", "Branch, tag or commit SHA to deploy")
+        }
+        definition {
+          cps {
+            script('''@Library('platform') _
+      appDeploy({{ literal }})''')
+            sandbox(true)
+          }
+        }
+      }

package/ansible/roles/backup-check/files/backup-check.service

@@ -0,0 +1,9 @@
+# Managed by Ansible (backup-check role).
+[Unit]
+Description=Report stale backups as GitHub issues
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/opt/backup-check/bin/backup-check

package/ansible/roles/backup-check/files/backup-check.timer

@@ -0,0 +1,10 @@
+# Managed by Ansible (backup-check role).
+[Unit]
+Description=Hourly check for stale backups
+
+[Timer]
+OnCalendar=hourly
+Persistent=true
+
+[Install]
+WantedBy=timers.target

package/ansible/roles/backup-check/tasks/main.yml

@@ -0,0 +1,59 @@
+---
+# =============================================================================
+# backup-check role — hourly, asks each of backup_check.repositories (a restic
+# repository served read-only over HTTPS) for its newest snapshot, and
+# reports one older than stale_after_hours as a GitHub issue, and likewise a
+# failed or overdue restore test (restore_test_max_days). Runs off the
+# backed-up network on purpose: it notices a source that has gone quiet.
+# =============================================================================
+
+- name: Install jq
+  ansible.builtin.apt:
+    name: jq
+
+- name: Create backup check directories
+  ansible.builtin.file:
+    path: "/opt/backup-check/{{ item }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  loop: ["", bin, state]
+
+- name: Install GitHub App key
+  ansible.builtin.copy:
+    content: "{{ backup_check_github_app_key }}"
+    dest: /opt/backup-check/github-app.pem
+    mode: "0600"
+  no_log: true
+
+# curl reads the logins from here, so they never show in a process list.
+- name: Render repository logins
+  ansible.builtin.copy:
+    content: |
+      {% for repository in backup_check.repositories %}
+      machine {{ repository.url | urlsplit('hostname') }} login {{ repository.user }} password {{ backup_check_passwords[repository.name] }}
+      {% endfor %}
+    dest: /opt/backup-check/netrc
+    mode: "0600"
+  no_log: true
+
+- name: Render backup check
+  ansible.builtin.template:
+    src: backup-check.sh.j2
+    dest: /opt/backup-check/bin/backup-check
+    mode: "0700"
+
+- name: Install backup check units
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "/etc/systemd/system/{{ item }}"
+    mode: "0644"
+  loop: [backup-check.service, backup-check.timer]
+
+- name: Enable backup check timer
+  ansible.builtin.systemd:
+    name: backup-check.timer
+    enabled: true
+    state: started
+    daemon_reload: true