Prepare consistent final Gitea export on Prometheus

ansible/roles/profile_server/tasks/gitea_final_export.yml

@@ -0,0 +1,34 @@
+---
+- name: Install the explicit Gitea final-export helper
+  tags: [services, gitea_final_export]
+  ansible.builtin.template:
+    src: prometheus-gitea-final-export.sh.j2
+    dest: /usr/local/sbin/prometheus-gitea-final-export
+    owner: root
+    group: root
+    mode: "0750"
+  when: server_gitea_cutover_tools_enabled | bool
+
+- name: Require the prepared source and explicit final-export approval
+  tags: [services, gitea_final_export]
+  ansible.builtin.assert:
+    that:
+      - server_gitea_cutover_tools_enabled | bool
+      - server_backup_export_enabled | bool
+      - not ansible_check_mode
+    fail_msg: >-
+      Install the cutover helper and perform an explicit non-check-mode run
+      only after the Gitea outage gate has been approved.
+  when: server_gitea_final_export | bool
+
+- name: Stop source Gitea and publish the final consistent export
+  tags: [services, gitea_final_export]
+  ansible.builtin.command:
+    argv:
+      - /usr/local/sbin/prometheus-gitea-final-export
+  register: server_gitea_final_export_result
+  changed_when: server_gitea_final_export_result.rc == 0
+  no_log: true
+  when:
+    - server_gitea_final_export | bool
+    - not ansible_check_mode

ansible/roles/profile_server/tasks/main.yml

@@ -59,6 +59,9 @@
 - name: Import Prometheus backup export job tasks
   ansible.builtin.import_tasks: backup_export_job.yml
 
+- name: Import explicit Prometheus Gitea final-export tasks
+  ansible.builtin.import_tasks: gitea_final_export.yml
+
 - name: Ensure server SSH authorized key fragments directory exists
   tags: [services, ssh]
   ansible.builtin.file: