Replace restic cron with systemd timer

This avoids needing to `setcap` the binary, and gives a little more
sandboxing

ansible/roles/restic/files/restic-post.hook

@@ -1,9 +0,0 @@
-[Trigger]
-Operation = Upgrade
-Type = Package
-Target = restic
-
-[Action]
-Description = Set restic binary permissions
-When = PostTransaction
-Exec = /usr/share/libalpm/scripts/restic-post.sh

ansible/roles/restic/files/restic-post.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-
-# See https://restic.readthedocs.io/en/stable/080_examples.html#backing-up-your-system-without-running-restic-as-root
-
-set -e
-
-RESTIC_BIN=$(which restic)
-
-# Set owner
-chown root:restic $RESTIC_BIN
-chmod 750 $RESTIC_BIN
-
-# Lest restic run root things
-setcap cap_dac_read_search=+ep $RESTIC_BIN

ansible/roles/restic/files/restic.service

@@ -0,0 +1,34 @@
+[Unit]
+Description=Backup system
+
+[Service]
+Type=oneshot
+User=restic
+Environment="CHECK_UUID={{ vault_restic_healthchecks_id }}"
+
+AmbientCapabilities=CAP_DAC_READ_SEARCH
+CapabilityBoundingSet=CAP_DAC_READ_SEARCH
+DevicePolicy=closed
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+NoNewPrivileges=yes
+PrivateDevices=yes
+PrivateTmp=yes
+ProtectClock=yes
+ProtectControlGroups=yes
+ProtectHome=no
+ProtectHostname=yes
+ProtectKernelLogs=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectProc=invisible
+ProtectSystem=strict
+RemoveIPC=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+RestrictNamespaces=yes
+RestrictRealtime=yes
+RestrictSUIDSGID=yes
+SystemCallFilter=@system-service
+UMask=7007
+
+ExecStart=/usr/bin/runitor -- /home/restic/restic-backup.sh

ansible/roles/restic/files/restic.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=Timer for Restic backups
+
+[Timer]
+OnCalendar=*-*-* 00:00:00
+Persistent=true
+Unit=restic.service
+
+[Install]
+WantedBy=timers.target

ansible/roles/restic/handlers/main.yml

@@ -0,0 +1,3 @@
+- name: reload systemd
+  systemd_service:
+    daemon_reload: true

ansible/roles/restic/tasks/main.yml

@@ -58,32 +58,22 @@
     owner: root
     group: restic
 
-- name: Set cap_sys_chroot=+ep on restic
+- name: Install Systemd service
-  community.general.capabilities:
-    path: /usr/bin/restic
-    capability: cap_dac_read_search=+ep
-
-- name: Schedule backup
-  cron:
-    name: restic backup
-    hour: 0
-    minute: 0
-    job: CHECK_UUID={{ vault_restic_healthchecks_id }} /usr/bin/runitor -- /home/restic/restic-backup.sh
-    user: restic
-
-- name: Install pacman post script
   template:
-    src: files/restic-post.sh
+    src: files/{{ item }}
-    dest: /usr/share/libalpm/scripts/restic-post.sh
+    dest: /etc/systemd/system/{{ item }}
-    mode: "0700"
-  when: ansible_os_family == 'Archlinux'
-
-- name: Install pacman post hook
-  template:
-    src: files/restic-post.hook
-    dest: /usr/share/libalpm/hooks/restic-post.hook
     mode: "0600"
-  when: ansible_os_family == 'Archlinux'
+  loop:
+    - restic.service
+    - restic.timer
+  notify:
+    - reload systemd
+
+- name: Enable backups
+  systemd_service:
+    name: restic.timer
+    enabled: true
+    state: started
 
 - name: Install HomeAssistant mounts
   include_tasks: homeassistant.yml