david_igou.routeros_configuration.backup role – Back up RouterOS configuration over network_cli.

Note

This role is part of the david_igou.routeros_configuration collection (version 0.0.8-alpha).

It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it use: ansible-galaxy collection install david_igou.routeros_configuration.

To use it in a playbook, specify: david_igou.routeros_configuration.backup.

Entry point main – Back up RouterOS configuration over network_cli.

Synopsis

  • Writes a text configuration export (/export) to a file on the Ansible controller, rewriting it only when the device config changed (idempotent).

  • Optionally takes a full-fidelity binary backup (/system backup save) on the device.

  • Runs over network_cli (community.routeros.command); /export is not available over the binary API.

Parameters

Parameter

Comments

routeros_backup_binary

boolean

Also take a binary backup (/system backup save) on the device. Restore with /system backup load. Stays on the device.

Choices:

  • false ← (default)

  • true

routeros_backup_dir

string

Controller directory for the .rsc export, one file per host (<inventory_hostname>.rsc).

Default: "./routeros-backups"

routeros_backup_export_options

string

Extra arguments appended to /export (e.g. a menu path like ip firewall, or terse).

Default: ""

routeros_backup_name

string

Binary backup file name.

Default: "ansible"

routeros_backup_password

string

Encryption password for the binary backup. Secret — supply via vault. Recommended, as the binary backup contains sensitive data.

Default: ""

routeros_backup_show_sensitive

boolean

Run /export show-sensitive to include service secrets. /export still never includes /user passwords, certificates, SSH keys, Dude, or the User-manager database.

Choices:

  • false

  • true ← (default)

Examples

# The text /export runs over network_cli (SSH); the device must be reachable
# over an SSH connection (see the getting started guide).
#
# Export the running config to the controller as <inventory_hostname>.rsc,
# rewritten only when the device config changed (idempotent).
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.backup
      vars:
        routeros_backup_dir: ./routeros-backups

# Include service secrets and scope the export to a menu path.
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.backup
      vars:
        routeros_backup_show_sensitive: true
        routeros_backup_export_options: ip firewall

# Also take an encrypted binary backup on the device (password via Vault).
- hosts: routers
  gather_facts: false
  roles:
    - role: david_igou.routeros_configuration.backup
      vars:
        routeros_backup_binary: true
        routeros_backup_name: nightly
        routeros_backup_password: "{{ vault_routeros_backup_password }}"