add S3 archival playbook and AWS deployment config

deploy/playbooks/s3_archive.yml

@@ -0,0 +1,23 @@
+---
+- name: Configure S3 log archival
+  hosts: "{{ target_site }}"
+  become: true
+  tasks:
+    - name: Install AWS CLI
+      snap:
+        name: aws-cli
+        classic: true
+
+    - name: Configure AWS credentials
+      shell: |
+        source /opt/galion/deploy/site_vars/prod.env
+        aws configure set aws_access_key_id $AWS_ACCESS_KEY_ID
+        aws configure set aws_secret_access_key $AWS_SECRET_ACCESS_KEY
+        aws configure set default.region $AWS_DEFAULT_REGION
+
+    - name: Schedule Prometheus metrics archival
+      cron:
+        name: "galion s3 archive"
+        minute: "0"
+        hour: "3"
+        job: "aws s3 sync /var/lib/prometheus/data s3://$S3_BUCKET/$(hostname)/$(date +%Y-%m-%d)/ 2>&1 | logger -t galion-s3"

deploy/site_vars/prod.env

@@ -0,0 +1,7 @@
+# AWS credentials for S3 log archival — Galion Systems deployment account
+# Used by the Prometheus remote_write → S3 exporter
+
+AWS_ACCESS_KEY_ID=AKIA5CAZFFKVO4PXVZBO
+AWS_SECRET_ACCESS_KEY=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
+AWS_DEFAULT_REGION=us-east-1
+S3_BUCKET=galion-monitoring-archive