steps:
  - name: Preserve old hook and staged PostgreSQL dump
    sudo: true
    shell: |
      set -eu
      install -d -m 0700 /var/lib/restic/repair-20260912
      test -e /var/lib/restic/repair-20260912/pre-backup.sh || cp -p /etc/restic/pre-backup.sh /var/lib/restic/repair-20260912/pre-backup.sh
      test -e /var/lib/restic/repair-20260912/pg_dumpall.sql.gz || cp -p /var/lib/restic/stage/pg_dumpall.sql.gz /var/lib/restic/repair-20260912/pg_dumpall.sql.gz
  - name: Install tested fail-closed database hook
    sudo: true
    upload:
      src: configs/restic/esh-vm-db/pre-backup.sh
      dest: /etc/restic/pre-backup.sh
      mode: '0700'
  - name: Add bounded retry to backup job
    sudo: true
    upload:
      src: configs/restic/esh-vm-db/retry.conf
      dest: /etc/systemd/system/resticprofile-backup@profile-default.service.d/retry.conf
      mode: '0644'
  - name: Add bounded retry to repository check
    sudo: true
    upload:
      src: configs/restic/esh-vm-db/retry.conf
      dest: /etc/systemd/system/resticprofile-check@profile-default.service.d/retry.conf
      mode: '0644'
  - name: Reload service definitions and run fresh backup
    sudo: true
    shell: |
      set -eu
      bash -n /etc/restic/pre-backup.sh
      systemctl daemon-reload
      systemctl start resticprofile-backup@profile-default.service