Add option to disable decryption key export

5 files changed, 63 insertions, 43 deletions

diff --git a/README.md b/README.md
index 3d80e28..c01e109 100644
--- a/README.md
+++ b/README.md
@@ -161,6 +161,12 @@ the keys in a secure location outside of git.
 borg_decryption_keys_yaml_path: "{{ inventory_dir }}/decryption_keys.yml"
 ```
 
+Set to an empty string to disable exporting decryption keys entirely:
+
+```yaml
+borg_decryption_keys_yaml_path: ""
+```
+
 The scheduling of the backups is done via systemd. For this purpose a systemd
 service and a corresponding timer are created.
 Additionally, we create backup scripts for use in the systemd service and for
diff --git a/defaults/main.yml b/defaults/main.yml
index 9869589..c4b481e 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -140,6 +140,7 @@ borg_passphrase: ""
 # If wish to encrypt the decryption keys, you look into third party tools for
 # that such as ansible-vault, git-crypt or a completely separate secrets
 # management system.
+# Set to empty string to disable exporting decryption keys entirely.
 borg_decryption_keys_yaml_path: "{{ inventory_dir }}/decryption_keys.yml"
 
 # The role creates a script for backing up with the configured parameters that
diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml
index be65609..d5d118d 100644
--- a/molecule/default/converge.yml
+++ b/molecule/default/converge.yml
@@ -69,7 +69,7 @@
       vars:
         borg_server_host: borg-server
         borg_server_user_home: /opt/borg
-        borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"
+        borg_decryption_keys_yaml_path: ""
         borg_ssh_key_type: ed25519
         borg_backup_service_successful_exit_status:
           - 1
diff --git a/molecule/default/tests/test_decryption_keys.py b/molecule/default/tests/test_decryption_keys.py
index c772477..bd5ff6a 100644
--- a/molecule/default/tests/test_decryption_keys.py
+++ b/molecule/default/tests/test_decryption_keys.py
@@ -46,9 +46,6 @@ def test_decryption_keys_structure_single_repo():
     assert 'borg-client_borg-client:' in content, (
         "Single repo host should have key named 'hostname_repo_name'"
     )
-    assert 'borg-client-2_borg-client-2:' in content, (
-        "Second single repo host should have key named 'hostname_repo_name'"
-    )
 
 
 def test_decryption_keys_structure_multi_repo():
@@ -113,10 +110,23 @@ def test_decryption_keys_all_hosts_present():
 
     expected_keys = [
         'borg-client_borg-client:',
-        'borg-client-2_borg-client-2:',
         'borg-client-multi_configs:',
         'borg-client-multi_home-data:',
     ]
 
     for key in expected_keys:
         assert key in content, f"Expected key {key} not found in decryption_keys.yml"
+
+
+def test_no_keys_for_disabled_export():
+    """Test that no decryption keys are exported when disabled"""
+    keys_path = _get_keys_path()
+    if not os.path.exists(keys_path):
+        pytest.skip('decryption_keys.yml not yet generated')
+
+    with open(keys_path, 'r') as f:
+        content = f.read()
+
+    assert 'borg-client-2_borg-client-2:' not in content, (
+        'Keys should not be exported for borg-client-2 (export disabled)'
+    )
diff --git a/tasks/client_setup.yml b/tasks/client_setup.yml
index e39826a..71027c3 100644
--- a/tasks/client_setup.yml
+++ b/tasks/client_setup.yml
@@ -177,48 +177,51 @@
       and 'already exists' not in init_borg_output.stderr
       )
 
-- name: Make sure key file exists
-  ansible.builtin.file:
-    path: "{{ borg_decryption_keys_yaml_path }}"
-    state: touch
-    mode: "0600"
-    access_time: preserve
-    modification_time: preserve
-  delegate_to: localhost
-  become: false
+- name: Export decryption keys
+  when: borg_decryption_keys_yaml_path | default('') | length > 0
+  block:
+    - name: Make sure key file exists
+      ansible.builtin.file:
+        path: "{{ borg_decryption_keys_yaml_path }}"
+        state: touch
+        mode: "0600"
+        access_time: preserve
+        modification_time: preserve
+      delegate_to: localhost
+      become: false
 
-- name: Read Vars file
-  ansible.builtin.include_vars:
-    file: "{{ borg_decryption_keys_yaml_path }}"
-  register: local
+    - name: Read Vars file
+      ansible.builtin.include_vars:
+        file: "{{ borg_decryption_keys_yaml_path }}"
+      register: local
 
-- name: Add repository encryption keys to ansible repo
-  when: not (inventory_hostname ~ '_' ~ borg_repo_name) in local.ansible_facts
-  throttle: 1
-  block:
-    - name: If host new read encryption keys
-      ansible.builtin.command: >
-        borg key export --paper
-        borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
-      environment:
-        BORG_RSH: "{{ ('ssh -i ' ~ borg_ssh_key_path) if borg_ssh_key_per_repo else omit }}"
-      become: true
-      become_user: "{{ borg_client_user }}"
-      register: borg_keys
-      changed_when: borg_keys.rc != 0
+    - name: Add repository encryption keys to ansible repo
+      when: not (inventory_hostname ~ '_' ~ borg_repo_name) in local.ansible_facts
+      throttle: 1
+      block:
+        - name: If host new read encryption keys
+          ansible.builtin.command: >
+            borg key export --paper
+            borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
+          environment:
+            BORG_RSH: "{{ ('ssh -i ' ~ borg_ssh_key_path) if borg_ssh_key_per_repo else omit }}"
+          become: true
+          become_user: "{{ borg_client_user }}"
+          register: borg_keys
+          changed_when: borg_keys.rc != 0
 
-    - name: If host new add encryption keys to vars
-      ansible.builtin.set_fact:
-        decryption_keys: "{{ local.ansible_facts | combine({(inventory_hostname ~ '_' ~ borg_repo_name): borg_keys.stdout}) }}"
+        - name: If host new add encryption keys to vars
+          ansible.builtin.set_fact:
+            decryption_keys: "{{ local.ansible_facts | combine({(inventory_hostname ~ '_' ~ borg_repo_name): borg_keys.stdout}) }}"
 
-- name: Update encryption vars
-  ansible.builtin.copy:
-    content: "{{ decryption_keys | to_nice_yaml(indent=2, width=2048) }}"
-    dest: "{{ borg_decryption_keys_yaml_path }}"
-    mode: "0600"
-  when: decryption_keys is defined
-  delegate_to: localhost
-  become: false
+    - name: Update encryption vars
+      ansible.builtin.copy:
+        content: "{{ decryption_keys | to_nice_yaml(indent=2, width=2048) }}"
+        dest: "{{ borg_decryption_keys_yaml_path }}"
+        mode: "0600"
+      when: decryption_keys is defined
+      delegate_to: localhost
+      become: false
 
 - name: Create backup scripts
   ansible.builtin.include_tasks: client_create_scripts_each.yml