client user

defaults/main.yml

@@ -1,7 +1,8 @@
 ---
 borgbackup_required: True
 
-borgbackup_ssh_key: "~/.ssh/id_borg_rsa"
+borgbackup_client_user: root
+borgbackup_ssh_key: "~{{ borgbackup_client_user }}/.ssh/id_borg_rsa"
 
 borgbackup_version: "1.0.11"
 borgbackup_checksum: "sha256:fbdc0e0d6d05a0935551f2f408f370236a76b7a30d3bb90a31c3628fe3611359"
@@ -28,7 +29,6 @@ borgbackup_retention:
   monthly: 6
   yearly: 1
 
-borgbackup_cron_user: root
 borgbackup_cron_day: "*"
 borgbackup_cron_hour: "{{ 5|random }}"
 borgbackup_cron_minute: "{{ 59|random }}"

tasks/borg-client.yml

@@ -1,6 +1,11 @@
 ---
 - name: client | generate ssh key for this machine
-  shell: if [ -f {{ borgbackup_ssh_key }} ]; then rm -f {{ borgbackup_ssh_key }}; fi && ssh-keygen -q -t rsa -b 4096 -f {{ borgbackup_ssh_key }} -N "" creates="{{ borgbackup_ssh_key }}.pub"
+  user:
+    name: "{{ borgbackup_client_user }}"
+    generate_ssh_key: yes
+    ssh_key_bits: 2048
+    ssh_key_file: "{{ borgbackup_ssh_key }}"
+    ssh_key_type: rsa
 
 - name: client | fetch ssh-key
   shell: "cat {{ borgbackup_ssh_key }}.pub"
@@ -9,14 +14,14 @@
 
 - name: client | write passphrase
   lineinfile:
-    dest: "/root/.borg.passphrase"
+    dest: "~{{ borgbackup_client_user }}/.borg.passphrase"
     state: "present"
     line: 'export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"'
     create: "yes"
 
 - name: client | disable strict key checking for backup servers
   blockinfile:
-    dest: /root/.ssh/config
+    dest: "~{{ borgbackup_client_user }}/.ssh/config"
     create: yes
     marker: "### {mark} ANSIBLE MANAGED BLOCK {{ item.fqdn }} ###"
     content: |
@@ -96,7 +101,7 @@
 - name: client | create backup cronjob
   cron:
     cron_file: "borg-backup"
-    user: "{{ borgbackup_cron_user }}"
+    user: "{{ borgbackup_client_user }}"
     name: "borg-backup"
     minute: "{{ borgbackup_cron_minute }}"
     hour: "{{ borgbackup_cron_hour }}"

templates/borg-backup.sh.j2

@@ -7,7 +7,7 @@ fi
 
 # Sourcing the backup-passphrase
 
-. /root/.borg.passphrase
+. ~{{ borgbackup_client_user }}/.borg.passphrase
 
 # Small helper commands, like listing backups, will help us in the future :)
 
@@ -48,7 +48,7 @@ if [ "$1" = "init" ]
   then
 {% for b in borgbackup_servers %}
     REPOSITORY={% if b.type == 'hetzner' %}ssh://{% endif %}{{ b.user }}@{{ b.fqdn }}:{% if b.type == 'hetzner' %}23/./{% endif %}{{ b.home }}{{ b.pool }}/{{ inventory_hostname }}
-    /usr/local/bin/borg init $REPOSITORY {{ b.options }}
+    /usr/local/bin/borg init --encryption=keyfile $REPOSITORY {{ b.options }}
 {% endfor %}
     exit 0
 fi