freedomofpress/securedrop — pull request #766 by dolanjs (2014-11-25 23:57:45+00:00)
Title: Anisble backup task

This adds a modified copy of the 0.2.1_collect.py script as 0.3_collect.py that will be run at the end of the staging and production ansible playbooks.

The `0.3_collect.py` script zips the following files (from /staging$/ environment):

```
Archive: sd-backup-2014-11-25--23-41-53.zip
extracting: var/www/securedrop/config.py
extracting: var/lib/securedrop/db.sqlite
extracting: var/lib/securedrop/test_journalist_key.pub
extracting: var/lib/securedrop/keys/pubring.gpg~
extracting: var/lib/securedrop/keys/pubring.gpg
extracting: var/lib/securedrop/keys/trustdb.gpg
extracting: var/lib/securedrop/keys/secring.gpg
extracting: var/www/securedrop/static/i/logo.png
extracting: var/lib/tor/services/source/hostname
extracting: var/lib/tor/services/source/private_key
extracting: var/lib/tor/services/ssh/hostname
extracting: var/lib/tor/services/ssh/client_keys
extracting: var/lib/tor/services/ssh/private_key
extracting: var/lib/tor/services/document/hostname
extracting: var/lib/tor/services/document/client_keys
extracting: var/lib/tor/services/document/private_key
extracting: etc/tor/torrc
```

An ansible role `backup` was added to run the script and fetch the output back to the admin's host machine in the `ansible_base` directory for the `App Server`.

The ansible task also secure deletes the backup off the `App Server`

Example output:
`./install_files/ansible-base/sd-backup-2014-11-25--23-41-53.zip`

The 0.3_collect.py script should be modified to encrypt the backup with the application's GPG public key.