init

meta/main.yml

+---
+galaxy_info:
+  role_name: ansible_lza_amrepo_backup
+  namespace: slub
+  author: Jörg Sachse
+  company: SLUB Dresden
+  description: This role will install a server that will pull regular backups of Artefactual's GitHub repositories, including Archivematica.
+  galaxy_tags: []
+    # List tags for your role here, one per line. A tag is a keyword that describes and categorizes the role. Users find roles by searching for tags. Be sure to remove the '[]' above, if you
+    # add tags to this list.
+    #
+    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
+    #       Maximum 20 tags per role.
+  # issue_tracker_url: "https://example.com/"
+    # If the issue tracker for your role is not on github, uncomment the next line and provide a value issue_tracker_url: http://example.com/issue/tracker
+
+    # Choose a valid license ID from https://spdx.org - some suggested licenses:
+    # - BSD-3-Clause (default)
+    # - MIT
+    # - GPL-2.0-or-later
+    # - GPL-3.0-only
+    # - Apache-2.0
+    # - CC-BY-4.0
+  license: GPL-3.0-or-later
+
+  min_ansible_version: "2.5"
+    # If this a Container Enabled role, provide the minimum Ansible Container version. min_ansible_container_version: Optionally specify the branch Galaxy will use when accessing the GitHub repo
+    # for this role. During role install, if no tags are available, Galaxy will use this branch. During import Galaxy will access files on this branch. If Travis integration is configured, only
+    # notifications for this branch will be accepted. Otherwise, in all cases, the repo's default branch (usually master) will be used. github_branch:
+  # Provide a list of supported platforms, and for each platform a list of versions. If you don't wish to enumerate all versions for a particular platform, use 'all'. To view available
+  # platforms and versions (or releases), visit: https://galaxy.ansible.com/api/v1/platforms/
+  #
+  # platforms: - name: Fedora
+  #   versions: - all - 25 - name: SomePlatform versions: - all - 1.0 - 7 - 99.99
+  platforms:
+    - name: Debian
+      versions:
+        - "bookworm"
+dependencies: []

molecule/README.md

+# Testing with Molecule
+
+## Prerequisites
+
+In order to be able to use the tests, you need to have some software packages installed. You may need sudo privileges for some of these operations.
+
+There are two ways to accomplish this.
+
+### Option 1: use `molecule-skel` (SLUB staff only)
+
+1. Clone the project at [molecule-skel](https://git.slub-dresden.de/slub-referat-2-3/molecule-skel): `git clone https://git.slub-dresden.de/slub-referat-2-3/molecule-skel.git`
+2. Switch to the `molecule-skel` repository directory and run `./install_testenv.sh`.
+3. PROFIT!
+
+ Check the `README.md` over at [molecule-skel](https://git.slub-dresden.de/slub-referat-2-3/molecule-skel) for details on how to use that. It's easy, I promise.
+
+### Option 2: manual installation
+
+Run these steps on your terminal.
+
+```bash
+### install VirtualBox
+# do NOT use distribution packages, as they may be too old!
+# process documented at https://www.virtualbox.org/wiki/Linux_Downloads
+#
+# add GPG key
+wget -q https://www.virtualbox.org/download/oracle_vbox.asc -O- | sudo apt-key add -
+# add repository URL
+sudo echo "deb [arch=amd64] https://download.virtualbox.org/virtualbox/debian stretch contrib" > /etc/apt/sources.d/virtualbox.list
+# update sources and install VirtualBox
+sudo apt update; sudo apt-get install virtualbox-6.1
+
+### install Vagrant
+# do NOT use distribution packages, as they may be too old!
+# 
+# download Debian package from Hashicorp
+wget https://releases.hashicorp.com/vagrant/2.2.9/vagrant_2.2.9_x86_64.deb
+# install package
+sudo dpkg -i vagrant_2.2.9_x86_64.deb
+
+### install Molecule et. al.
+# prepare directories
+mkdir ~/python-envs/ && cd ~/python-env/
+# create Python Virtual Environment with Python3 interpreter (Python2 is deprecated!)
+virtualenv -p python3 molecule-env
+# enter the Virtual Environment in your current shell (other shells will be unaffected)
+source molecule-env/bin/activate
+# install packages
+pip3 install molecule ansible testinfra ansible-lint molecule-vagrant molecule-docker
+
+# leave the Virtual Environment only when you're done
+deactivate
+```
+
+You can find suitable documentation at the respective vendors' websites.
+* [Vagrant Installation Guide](https://www.vagrantup.com/docs/installation/)
+* [VirtualBox Installation Guide](https://www.virtualbox.org/wiki/Downloads)
+* [Molecule Installation Guide](https://molecule.readthedocs.io/en/stable/installation.html)
+
+## Initialising a new Molecule scenario
+
+If you have already created a role without the Molecule test framework or you want to add test scenarios, you can use:
+```bash
+molecule init scenario --scenario-name <my_scenario> --driver [azure|delegated|docker|ec2|gce|linode|lxc|lxd|openstack|vagrant] --verifier-name [ansible|testinfra]
+```
+
+If you need any help with the options, please use:
+```bash
+molecule init role --help
+```
+
+## Running Tests
+
+Molecule helps with creating a test infrastructure, running tests against it and removing the test infrastructure afterwards.
+
+Various test environments are separated into so-called "scenarios" that can be based on different OSses, drivers, verifiers or might just differ in a minor detail. 
+
+In the simplest configuration, the `molecule/` directory only contains one `default/` directory that contains the default scenario. This scenario is run if no other scenario is chosen using the `-s` CLI option.
+
+This is the basic usage of Molecule:
+```bash
+# create test infrastructure
+cd <role_directory>
+molecule create
+# run playbooks against test infrastructure
+molecule converge
+# run idempotence tests
+molecule idempotence
+# run tests, if they exist
+molecule verify
+# remove test infrastructure
+molecule destroy
+
+# run all steps at once:
+molecule test
+```
+
+It has proven helpful to use Vagrant to create a snapshot of the VM after the creation phase has completed. Just like this:
+```bash
+# First, get UUID of the VM
+vagrant global-status
+# Then, create the snapshot
+vagrant snapshot save <uuid> <snapshot_name>
+# To restore the snapshot, use
+vagrant snapshot restore <uuid> <snapshot_name>
+# And to remove the snapshot, use
+vagrant snapshot delete <uuid> <snapshot_name>
+```

molecule/default

+virtualbox/
\ No newline at end of file

molecule/docker/molecule.yml

+---
+prerun: false
+dependency:
+  name: galaxy
+  enabled: false
+driver:
+  name: docker
+platforms:
+  - name: instance
+    # dockerfile: ../resources/playbooks/Dockerfile
+    image: "debian:stable-slim"
+    # image: "sdvharbor.slub-dresden.de/replication/debian:stable-slim"
+    pre_build_image: false
+provisioner:
+  name: ansible
+  log: true
+  # config_options:
+  #   defaults:
+  #     # https://stackoverflow.com/questions/57435811/ansible-molecule-pass-multiple-vault-ids
+  #     # vault_identity_list: "@$HOME/.ansible/roles/lza_install_common.pass, @$HOME/.ansible/roles/passfile_1.pass"
+  #     vault_identity_list: "../../../passfile.pass"
+  vvv: false
+  playbooks:
+    #create: ../resources/playbooks/create.yml
+    #destroy: ../resources/playbooks/destroy.yml
+    converge: ../resources/playbooks/converge.yml
+    #prepare: ../resources/playbooks/prepare.yml
+    verify: ../resources/playbooks/verify.yml
+verifier:
+  name: ansible

molecule/resources/Dockerfile

+FROM debian:stable-slim
+
+RUN adduser lza;
+
+### configure SLUB Debian Repository
+RUN apt-get update; \
+    apt-get install -y --no-install-recommends gnupg wget git python3 ansible sudo; \
+    wget -O - http://sdvdebianrepo.slub-dresden.de/deb-repository/pub.gpg.key | apt-key add - ; \
+    echo "deb http://sdvdebianrepo.slub-dresden.de/deb-repository bookworm main" > /etc/apt/sources.list.d/slub.list; \
+    apt-get update;
+    #apt-get -y --no-install-recommends install python3-pip python3-virtualenv;
+
+RUN echo "lza     ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/lza-user
+
+#RUN mkdir /opt/venv/ && cd /opt/venv/; \
+#    virtualenv -p python3 molecule; \
+#    . /opt/venv/molecule/bin/activate; \
+#    pip3 install ansible molecule molecule-docker;
+
+USER lza

molecule/resources/playbooks/INSTALL.rst

+*********************************
+Vagrant driver installation guide
+*********************************
+
+Requirements
+============
+
+* Vagrant
+* Virtualbox, Parallels, VMware Fusion, VMware Workstation or VMware Desktop
+
+Install
+=======
+
+Please refer to the `Virtual environment`_ documentation for installation best
+practices. If not using a virtual environment, please consider passing the
+widely recommended `'--user' flag`_ when invoking ``pip``.
+
+.. _Virtual environment: https://virtualenv.pypa.io/en/latest/
+.. _'--user' flag: https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site
+
+.. code-block:: bash
+
+    $ pip install 'molecule_vagrant'

molecule/resources/playbooks/README.md

+This drectory contains shared playbooks and a shared Dockerfile.
+
+Visit https://molecule.readthedocs.io/en/latest/examples.html#sharing-across-scenarios for details on sharing playbooks, tests etc. across multiple scenarios.

molecule/resources/playbooks/converge.yml

+---
+- name: Converge
+  hosts: all
+  pre_tasks:
+    - name: update apt cache
+      ansible.builtin.apt:
+        update_cache: true
+        upgrade: dist
+      become: true
+      when: ansible_os_family == "Debian"
+    - name: update yum cache
+      ansible.builtin.yum:
+        update_cache: true
+      become: true
+      when: ansible_os_family == "RedHat"
+  roles:
+    - {role: "ansible_lza_amrepo_backup", become: true}

molecule/resources/playbooks/prepare.yml

+---
+- name: Prepare
+  hosts: "*"
+  pre_tasks:
+    - name: configure additional package repositories for Debian
+      when: ansible_os_family == "Debian"
+      block: 
+      - name: install GPG
+        ansible.builtin.apt:
+          name: "gnupg"
+          state: latest
+          update_cache: true
+        become: true
+      - name: add custom repo for SLUB's custom Debian repo
+        ansible.builtin.deb822_repository:
+          architectures: "amd64"
+          components: "main"
+          enabled: true
+          name: "slub"
+          pdiffs: true
+          signed_by: "https://sdvdebianrepo.slub-dresden.de/deb-repository/pub.gpg.key"
+          suites: "{{ ansible_lsb.codename }}"
+          uris: "https://sdvdebianrepo.slub-dresden.de/deb-repository"
+        notify: update package cache
+        become: true
+
+    - name: configure additional package repositories for RedHat
+      block:
+      - name: add custom repositories
+        ansible.builtin.yum_repository:
+          name: "{{ item.name }}"
+          description: "{{ item.description }}"
+          baseurl: "{{ item.baseurl }}"
+          gpgcheck: "{{ item.gpgcheck | default('true') }}"
+          gpgkey: "{{ item.gpgkey | default(omit) }}"
+        loop:
+          - name: "epel"
+            description: EPEL YUM repo
+            baseurl: "https://download.fedoraproject.org/pub/epel/{{ ansible_distribution_major_version }}/x86_64/"
+            gpgkey: "https://dl.fedoraproject.org/pub/epel/RPM-GPG-KEY-EPEL-{{ ansible_distribution_major_version }}"
+          - name: "slub"
+            description: SLUB YUM repo
+            baseurl: "https://sdvrhelrepo.slub-dresden.de/"
+            gpgcheck: "false"
+        notify: update package cache
+      - name: remove legacy repo configuration to avoid double configuration for SLUB repo
+        ansible.builtin.file:
+          path: "/etc/yum.repos.d/SLUB.repo"
+          state: absent
+        notify: update package cache
+      when: ansible_os_family == "RedHat"
+
+    # Ansible roles can install a multitude of firewall rules, some of which
+    # will lock us out of our Molecule test VM if we don't take precautions.
+    # As Molecule itself uses SSH just like Ansible, we need to open port
+    # tcp/22 to the private /24 subnet that Vagrant uses when provisioning the
+    # VM. As we don't know for sure what the address for this subnet is and it
+    # can change across servers/platforms, we gather this information
+    # dynamically and filter it through `ipaddr` to get the address of the
+    # whole subnet. The rule is inserted right on top of the list to make sure
+    # we always get access.
+    - name: add firewall rule to allow access from Molecule host into testing VM
+      ansible.builtin.iptables:
+        action: insert
+        rule_num: 1
+        chain: INPUT
+        comment: "molecule access"
+        jump: "ACCEPT"
+        protocol: tcp
+        source: "{{ ansible_default_ipv4.address | ansible.utils.ipaddr('network') }}/24"
+        destination_port: "22"
+      become: true
+
+  handlers:
+    - name: update package cache
+      ansible.builtin.package:
+        update_cache: true
+      become: true

molecule/resources/playbooks/verify.yml

+---
+# This is an example playbook to execute Ansible tests.
+
+- name: Verify
+  hosts: all
+  gather_facts: false
+  tasks:
+  - name: Example assertion
+    ansible.builtin.assert:
+      that: true

molecule/virtualbox/molecule.yml

+---
+dependency:
+  name: galaxy
+  enabled: false
+driver:
+  name: vagrant
+platforms:
+  # Check out the documentation at
+  # https://github.com/ansible-community/molecule-vagrant#documentation
+  # for more platform parameters.
+  - name: mol-am-backup
+    box: debian/bookworm64
+    memory: 1024
+    # List of raw Vagrant `config` options.
+    # provider_raw_config_args:
+    #   - "customize [ 'modifyvm', :id, '--natdnshostresolver1', 'on' ]"
+    # Dictionary of `config` options.
+    config_options:
+      ssh.keep_alive: yes
+      ssh.remote_user: "backupam"
+provisioner:
+  name: ansible
+  log: true
+  config_options:
+    defaults:
+      # https://stackoverflow.com/questions/57435811/ansible-molecule-pass-multiple-vault-ids
+      #vault_identity_list: "@$HOME/.ansible/roles/lza_install_common.pass, @$HOME/.ansible/roles/passfile_1.pass"
+      vault_identity_list: "../../../../../lza_amrepo_backup.pass"
+  vvv: false
+  playbooks:
+    # create: ../resources/playbooks/create.yml
+    # destroy: ../resources/playbooks/destroy.yml
+    converge: ../resources/playbooks/converge.yml
+    prepare: ../resources/playbooks/prepare.yml
+    verify: ../resources/playbooks/verify.yml
+verifier:
+  name: ansible

setup_gitconfig.sh

+#!/usr/bin/env bash
+set -ex
+
+# Change the path that Git expects the hooks to be in, so we can track the hooks
+# within the repository (as the default `.git/` directory is not tracked).
+git config --local core.hooksPath .githooks/
+
+# To be able to run `git diff` on Ansible Vault files, please set you local
+# `git/config` files as described in (https://stackoverflow.com/a/52863794) for
+# the `~/.gitconfig` file or just blindly follow the instructions there to set
+# it for you Git installation as a whole.
+git config --local core.attributesfile "../.gitattributes"
+git config --local diff.ansible-vault.textconv "ansible-vault view"

tasks/configure_ssh_keys.yml

+---
+- name: mkdir ~/.ssh/
+  ansible.builtin.file:
+    path: "~/.ssh/"
+    state: directory
+    mode: "0600"
+
+- name: copy deploykey files to managed servers
+  ansible.builtin.copy:
+    src: "{{ item }}"
+    dest: "~/.ssh/{{ item }}"
+    owner: "root"
+    group: "root"
+    mode: "0400"
+  loop:
+    - "id_ed25519_deploykey"
+    - "id_ed25519_deploykey.pub"

tasks/create_users.yml

+---
+# tasks file for ansible_lza_amrepo_backup
+
+- name: >
+    Create primary group for daemon user.
+  ansible.builtin.group:
+    name: "backupam"
+
+- name: >
+    Create daemon user itself.
+  ansible.builtin.user:
+    comment: "Daemon user to run Artefactual GitHub backups"
+    create_home: false
+    group: "backupam"
+    name: "backupam"
+    password: "!"
+    password_lock: true
+    shell: "/bin/false"
+    system: true
+    update_password: always

tasks/install_backup_script.yml

+---
+# tasks file for ansible_lza_amrepo_backup
+
+#- ansible.builtin.include_vars: "{{ role_path }}/../ansible_vaults/{{ role_name }}/main.vault"
+#  tags: [always]
+#- ansible.builtin.import_tasks: "taskfile1.yml"
+#  tags: [tag1, tag2]
+
+- name: >
+    Install prerequisite packages for Ansible and the backup script.
+  ansible.builtin.package:
+    name: [
+      "curl",
+      "git",
+      "wget",
+    ]
+    state: latest
+
+- name: >
+    Check if the git directory exists. The git module expects the dest 
+    directory to be empty, so we might have to delete it.
+  ansible.builtin.stat:
+    path: "/opt/backup_archivematica_repos/bin/"
+  register: stat
+  changed_when: false
+
+- name: >
+    Remove git dir if it exists. The git module expects the dest directory to
+    be empty.
+  ansible.builtin.file:
+    path: "/opt/backup_archivematica_repos/bin/"
+    state: absent
+  when:
+    - stat.stat.exists
+    - stat.stat.isdir
+  changed_when: false
+
+- name: >
+    Create directories for Backup script and SystemD units.
+  ansible.builtin.file:
+    path: "{{ item.p }}"
+    state: directory
+    mode: "0775"
+    group: "{{ item.g | default('root') }}"
+  loop:
+    - p: "/opt/backup_archivematica_repos/bin/"
+    - p: "/opt/backup_archivematica_repos/archivematica_related_repos/"
+      g: "backupam"
+    - p: "/opt/backup_archivematica_repos/archivematica_related_issues/"
+      g: "backupam"
+#    - p: "/usr/local/lib/systemd/system/"
+  changed_when: false
+
+- name: >
+    Pull Git repository with the backup script.
+  ansible.builtin.git:
+    depth: 1
+    dest: "/opt/backup_archivematica_repos/bin/"
+    repo: "https://git.slub-dresden.de/digital-preservation/backup_archivematica_repos.git"
+    single_branch: true
+  changed_when: false
+
+- name: >
+    Make backup script executable.
+  ansible.builtin.file:
+    path: "/opt/backup_archivematica_repos/bin/backup_am_github_repos_and_issues.sh"
+    mode: "0755"
+  changed_when: false

tasks/install_ibmsp_client.yml

+---
+- name: IBMSP-Client Pakete installieren
+  ansible.builtin.apt:
+    name: [
+      # GSKit Packages
+      'gskcrypt64',
+      'gskssl64',
+      # TSM API
+      'tivsm-api64',
+      # TSM API CIT (Common Inventory Technology, für die Berechnung der PVUs notwendig)
+      'tivsm-apicit',
+      # TSM Backup-Client
+      'tivsm-ba',
+      # TSM Backup-Client CIT (Common Inventory Technology)
+      'tivsm-bacit',
+      # TSM ONTAP Bibliothek (Support für NetApp Speicher)
+      'tivsm-bahdw',
+      #'tivsm-jbb',
+    ]
+    state: latest
+
+- name: link IBMSP Client kernel modules
+  ansible.builtin.file:
+    src: "/usr/local/ibm/gsk8_64/lib64/{{ item }}"
+    path: "/usr/lib/{{ item }}"
+    state: link
+  loop:
+    - "libgsk8acmeidup_64.so"
+    - "libgsk8cms_64.so"
+    - "libgsk8dbfl_64.so"
+    - "libgsk8drld_64.so"
+    - "libgsk8iccs_64.so"
+    - "libgsk8kicc_64.so"
+    - "libgsk8km2_64.so"
+    - "libgsk8km_64.so"
+    - "libgsk8ldap_64.so"
+    - "libgsk8p11_64.so"
+    - "libgsk8ssl_64.so"
+    - "libgsk8sys_64.so"
+    - "libgsk8valn_64.so"
+
+- name: write IBMSP config files
+  ansible.builtin.template:
+    src: "opt/tivoli/tsm/client/ba/bin/{{ item }}.j2"
+    dest: "/opt/tivoli/tsm/client/ba/bin/{{ item }}"
+    mode: "0644"
+  loop:
+    - "dsm.opt"
+    - "dsm.sys"
+  notify: restart dsmcad
+
+# - based on Michail Angelos Simos' Ansible Role:
+#   https://github.com/mikesimos/tsm-client.git
+# - dsmc CLI arg ducumentation can be found at:
+#   https://publib.boulder.ibm.com/tividd/td/TSMC/GC32-0789-01/en_US/HTML/ans5000016.htm#HDRCMD6036
+#- name: write password file
+#  ansible.builtin.command:
+#    #use: dsmc set password       <Old PW>               <New PW>
+#    cmd: "dsmc set password {{ ansible_hostname }} {{ ansible_hostname }}"
+#    creates: "/etc/adsm/TSM.sth"
+#  register: dsmc_result
+#  failed_when: (dsmc_result.rc != 0) and (dsmc_result.rc != 8)
+#  notify: restart dsmcad
+#  tags: [molecule-notest]
+
+- name: Start dsmcad service. This service triggers regular checks for backup schedules on the IBMSP server.
+  ansible.builtin.systemd:
+    name: "dsmcad.service"
+    state: started
+
+# check is run as a logrotage PreCmd, so no Cronjob/Timer is required
+- name: install check-backup scripts
+  block:
+    - name: install Git (required by Ansible builtin Git module)
+      ansible.builtin.apt:
+        name: "git"
+        state: latest
+    - name: install logrotate (required by check-backup script)
+      ansible.builtin.apt:
+        name: "logrotate"
+        state: latest
+    - name: check out check-backup Git repo
+      ansible.builtin.git:
+        repo: "git@git.slub-dresden.de:slub-referat-2-3/check-backup.git"
+        dest: "/tmp/check-backup/"
+        key_file: "~/.ssh/id_ed25519_deploykey"
+        accept_hostkey: true
+        force: true
+    - name: copy binaries and config to the system
+      ansible.builtin.copy:
+        src: "/tmp/check-backup/Linux{{ item.name }}"
+        dest: "{{ item.name }}"
+        mode: "{{ item.mode }}"
+        remote_src: true
+      loop:
+        - name: "/etc/logrotate.d/dsmcad"
+          mode: "0444"
+        - name: "/usr/share/doc/check-backup.man"
+          mode: "0444"
+        - name: "/usr/local/bin/check-backup.sh"
+          mode: "0555"
+    - name: template script config
+      ansible.builtin.template:
+        src: "etc/check-backup.cfg.j2"
+        dest: "/etc/check-backup.cfg"
+        owner: "root"
+        group: "root"
+        mode: "0644"

tasks/main.yml

+---
+# tasks file for ansible_lza_amrepo_backup
+
+- name: >
+    Include variables from Ansible Vaults.
+  # ansible.builtin.include_vars: "{{ role_path }}/../ansible_vaults/{{ role_name }}/{{ vaultname }}.vault"
+  ansible.builtin.include_vars: "{{ vaultname }}.vault"
+  loop_control:
+    loop_var: "vaultname"
+  loop:
+    - "ibmsp"
+  tags: [always]
+# - ansible.builtin.import_tasks: "taskfile1.yml"
+#   tags: [tag1, tag2]
+- name: >
+    Create Users.
+  ansible.builtin.import_tasks: "create_users.yml"
+  tags: [user, users, group, groups]
+- name: >
+    Install SSH Keys for deploying check_backup script.
+  ansible.builtin.import_tasks: "configure_ssh_keys.yml"
+  tags: [ssh, key, keys]
+- name: >
+    Install IBM SP Client.
+  ansible.builtin.import_tasks: "install_ibmsp_client.yml"
+  tags: [ibmsp, tsm]
+- name: >
+    Install Git backup script.
+  ansible.builtin.import_tasks: "install_backup_script.yml"
+  tags: [git, backup, archivematica, artefactual, clone]

templates/etc/check-backup.cfg.j2

+#####################################
+#                                   #
+#  CONFIG FILE FOR check-backup.sh  #
+#                                   #
+#####################################
+
+### HELP
+
+# Use this file to set custom configurations for check-backup.sh. These settings
+# will overwrite the defaults that are encoded in the script.
+# As check-backup.sh includes this file, you have to use valid Bash syntax.
+
+
+### CONFIGURATION
+
+## DSM Logs
+# search this path to find logs written by TSM Client
+# Default: DSMLOGS_PATH="/var/log/"
+DSMLOGS_PATH="/var/log/"
+# array of log file names
+# Default: DSMLOGS=("dsmsched.log" "dsmerror.log")
+DSMLOGS=("dsmsched.log" "dsmerror.log")
+
+## Log rotation
+# general log directory on the system
+# Default: BACKUP_FOLDER_PATH="/var/log/"
+BACKUP_FOLDER_PATH="/var/log/"
+# save rotated logs to this directory
+# Default: LOG_BACKUP_FOLDER="${BACKUP_FOLDER_PATH}/tsm_logs_archive/"
+LOG_BACKUP_FOLDER="${BACKUP_FOLDER_PATH}/tsm_logs_archive/"
+# save this many generations of rotated logs
+# Default: LOG_RETENTION_COUNT=5
+LOG_RETENTION_COUNT=5
+
+## Error capture
+# Regex to search for error messages
+# Default: REGEX="ANS[0-9]{4}[ES]"
+REGEX="ANS[0-9]{4}[ES]"
+
+## E-Mail settings
+# name of TSM node
+# Default: NODENAME=""
+NODENAME="{{ ansible_hostname }}"
+# email recipient
+# Default: EMAIL_TO="example@slub-dresden.de"
+EMAIL_TO="{{ vault_ibmsp_mail_to }}"
+# email carbon copy recipients
+# EMAIL_CC="~c Vorname.Nachname@slub-dresden.de,root@${HOSTNAME}"		# example
+# Default: EMAIL_CC=""
+EMAIL_CC="{{ vault_ibmsp_mail_cc }}"
+# email sender
+# Default: EMAIL_FROM="TSM-Backup-PostSchedCmd@${HOSTNAME}"
+EMAIL_FROM="TSM-Backup-PostSchedCmd@${HOSTNAME}"

templates/opt/tivoli/tsm/client/ba/bin/dsm.opt.j2

+************************************************************************
+* Tivoli Storage Manager                                               *
+*                                                                      *
+* Sample Client User Options file for UNIX (dsm.opt.smp)               *
+************************************************************************
+
+*  This file contains an option you can use to specify the TSM
+*  server to contact if more than one is defined in your client
+*  system options file (dsm.sys).  Copy dsm.opt.smp to dsm.opt.
+*  If you enter a server name for the option below, remove the
+*  leading asterisk (*).
+
+************************************************************************
+
+* Servername       A server name defined in the dsm.sys file
+* Servername      sdvtsm1_backup 
+Servername      {{ servername }}
+Password        {{ ansible_hostname }}

templates/opt/tivoli/tsm/client/ba/bin/dsm.sys.j2

+************************************************************************
+* Tivoli Storage Manager                                               *
+*                                                                      *
+* Sample Client System Options file for UNIX (dsm.sys.smp)             *
+************************************************************************
+
+*  This file contains the minimum options required to get started
+*  using TSM.  Copy dsm.sys.smp to dsm.sys.  In the dsm.sys file,
+*  enter the appropriate values for each option listed below and
+*  remove the leading asterisk (*) for each one.
+
+*  If your client node communicates with multiple TSM servers, be
+*  sure to add a stanza, beginning with the SERVERNAME option, for
+*  each additional server.
+
+************************************************************************
+
+Servername {{ servername }} 
+   COMMMethod         {{ comm_method }}
+   TCPPort            {{ tcp_port }}
+   TCPServeraddress   {{ tcp_serveraddress }}
+   nodename           {{ ansible_hostname }}
+   passwordaccess     {{ passwordaccess }}
+   managedservices    {{ managedservices }}
+
+   PRESCHEDULECMD     '/opt/backup_archivematica_repos/bin/backup_am_github_repos_and_issues.sh'
+
+   Domain             {{ domain }}
+
+   include.backup /opt/backup_archivematica_repos/
+
+   exclude.fs /dev/shm
+   exclude.dir /dev
+   exclude.dir /proc
+   exclude.dir /tmp
+   exclude.dir /var/log/.../*
+
+   schedlogname       {{ schedlogname }}
+   schedlogretention  {{ schedlogretention }}
+   errorlogname       {{ errorlogname }}
+   errorlogretention  {{ errorlogretention }}
+   COMPRESSION        NO