Add verified Prometheus backup pull to Atlas

ansible/inventory/group_vars/server.yml

@@ -80,5 +80,30 @@ server_sshd_settings:
 
 server_sshd_allow_users:
   - "{{ server_username }}"
+server_backup_export_enabled: false
+server_backup_username: prometheus-backup
+server_backup_public_key_name: atlas-pull
+server_backup_export_root: /var/lib/prometheus-backup-export
+server_backup_rrsync_path: /usr/share/doc/rsync/support/rrsync
+server_backup_export_calendar: "*-*-* 02:00:00 Europe/Rome"
+server_backup_export_start_timer: false
+server_backup_export_source_keep: 3
+server_backup_export_paths:
+  - opt/npm/data
+  - opt/npm/letsencrypt
+  - opt/gitea/data
+  - home/git/.ssh
+  - opt/docker/server/docker-compose.yml
+  - etc/systemd/system/podman-compose-server.service
+  - etc/ssh/sshd_config
+  - etc/ssh/sshd_config.d
+  - etc/firewalld
+  - etc/wireguard/wg0.conf
+server_backup_export_excludes:
+  - opt/npm/data/logs
+  - opt/gitea/data/gitea/log
+  - opt/gitea/data/gitea/tmp
+  - opt/gitea/data/gitea/sessions
+  - opt/gitea/data/gitea/indexers
 server_ssh_authorized_keys: []
 server_ssh_authorized_key_directory: "{{ server_user_home }}/.ssh/authorized_keys.d"

ansible/inventory/host_vars/atlas.yml

@@ -49,6 +49,7 @@ atlas_zfs_backup_reservation: 500G
 atlas_zfs_dataset_photobook: media/photobook
 atlas_mount_root: /zpool
 atlas_manage_storage: true
+atlas_prometheus_pull_start_timer: true
 atlas_manage_zfs_snapshots: true
 atlas_zfs_snapshot_prefix: atlas-auto
 atlas_zfs_snapshot_policies:
@@ -91,6 +92,12 @@ atlas_usb_backup_mapper_name: zpool-backup
 atlas_manage_usb_reminder: true
 atlas_usb_reminder_calendar: "Sat *-*-01..07 10:00:00 Europe/Rome"
 atlas_manage_monitoring: true
+atlas_manage_prometheus_backup_pull: true
+# Prometheus ED25519 host key read through the controller's strict SSH trust on 2026-09-30.
+# Fingerprint: SHA256:rfedk7DHI9mLB3UHk/4F3HHlSIiswtCAFsAXvfh6iXk
+atlas_prometheus_ssh_host_key: >-
+  179.237.102.172 ssh-ed25519
+  AAAAC3NzaC1lZDI1NTE5AAAAIC4b+QXlPupoEx71W9NKs9tTeYjBqTkVMqbGB97nMNWv
 # Physical pool disks and the system NVMe; the disconnected USB disk is intentionally excluded.
 atlas_monitor_smart_devices:
   - { name: pool-1, path: "{{ atlas_zpool_disks[0] }}", warning_c: 50, critical_c: 55 }

ansible/inventory/host_vars/prometheus.yml

@@ -6,6 +6,8 @@ ansible_port: 22
 ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519
 
 server_username: rocky
+server_backup_export_enabled: true
+server_backup_export_start_timer: true
 server_duckdns_domain: fscotto
 server_ssh_authorized_keys:
   - name: ikaros