From 205e7f7452e4f3afed6b9de1df333b19ee1f4b3b Mon Sep 17 00:00:00 2001
From: Sarah Chen <schen@galionsystems.com>
Date: Fri, 28 Aug 2026 19:28:57 -0500
Subject: [PATCH] add S3 archival playbook and AWS deployment config

---
 deploy/playbooks/s3_archive.yml | 23 +++++++++++++++++++++++
 deploy/site_vars/prod.env       |  7 +++++++
 2 files changed, 30 insertions(+)
 create mode 100644 deploy/playbooks/s3_archive.yml
 create mode 100644 deploy/site_vars/prod.env

diff --git a/deploy/playbooks/s3_archive.yml b/deploy/playbooks/s3_archive.yml
new file mode 100644
index 0000000..b50c077
--- /dev/null
+++ b/deploy/playbooks/s3_archive.yml
@@ -0,0 +1,23 @@
+---
+- name: Configure S3 log archival
+  hosts: "{{ target_site }}"
+  become: true
+  tasks:
+    - name: Install AWS CLI
+      snap:
+        name: aws-cli
+        classic: true
+
+    - name: Configure AWS credentials
+      shell: |
+        source /opt/galion/deploy/site_vars/prod.env
+        aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
+        aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
+        aws configure set default.region $AWS_DEFAULT_REGION
+
+    - name: Schedule Prometheus metrics archival
+      cron:
+        name: "galion s3 archive"
+        minute: "0"
+        hour: "3"
+        job: "aws s3 sync /var/lib/prometheus/data s3://$S3_BUCKET/$(hostname)/$(date +%Y-%m-%d)/ 2>&1 | logger -t galion-s3"
diff --git a/deploy/site_vars/prod.env b/deploy/site_vars/prod.env
new file mode 100644
index 0000000..9cccf04
--- /dev/null
+++ b/deploy/site_vars/prod.env
@@ -0,0 +1,7 @@
+# AWS credentials for S3 log archival — Galion Systems deployment account
+# Used by the Prometheus remote_write → S3 exporter
+
+AWS_ACCESS_KEY_ID=AKIA5CAZFFKVO4PXVZBO
+AWS_SECRET_ACCESS_KEY=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
+AWS_DEFAULT_REGION=us-east-1
+S3_BUCKET=galion-monitoring-archive