feat: add storage quota support

Add borg_storage_quota variable to limit repository storage on the
borg server via --storage-quota option in authorized_keys.

When not using borg_ssh_key_per_repo, all repos for a host must share
the same quota setting (similar to --append-only). Per-repo SSH keys
enable independent quotas per repository.

1 files changed, 68 insertions, 10 deletions

diff --git a/README.md b/README.md
index 4235294..3d80e28 100644
--- a/README.md
+++ b/README.md
@@ -115,10 +115,15 @@ variable. You can use placeholders such as `{hostname}` for the backups, see:
 This can increase security but comes at the cost of not being able to clean up
 old backups from the client.
 
+`borg_storage_quota` limits the storage space used by the repository on the
+Borg server. Format: `N` (bytes), `NK` (kilobytes), `NM` (megabytes), `NG`
+(gigabytes), `NT` (terabytes). Empty string means no quota.
+
 ```yaml
 borg_repo_name: "{{ inventory_hostname }}"
 borg_backup_name_format: "{hostname}-{now:%Y-%m-%dT%H:%M:%S}"
-borg_mode_append_only: false # Server side append only config
+borg_mode_append_only: false
+borg_storage_quota: "" # e.g., "100G" for 100 gigabytes
 ```
 
 We use zstd compression by default, but you can change it to any of the
@@ -286,14 +291,15 @@ This creates:
 
 ## Important Behaviors and Limitations
 
-### Consistent `--append-only` Setting Required
+### Consistent `--append-only` and `--storage-quota` Settings Required
 
-All repositories for a given host must use the same `borg_mode_append_only`
-setting. The role will fail with an error if you attempt to configure
-repositories with conflicting `--append-only` settings for the same host.
+All repositories for a given host must use the same `borg_mode_append_only` and
+`borg_storage_quota` settings when sharing a single SSH key. The role will fail
+with an error if you attempt to configure repositories with conflicting settings
+for the same host.
 
-This is because the SSH `authorized_keys` entry uses a single `--append-only`
-flag that applies to all repositories accessible via that key.
+This is because the SSH `authorized_keys` entry uses a single `--append-only` and
+`--storage-quota` flag that applies to all repositories accessible via that key.
 
 ```yaml
 # This will FAIL - conflicting append-only settings
@@ -309,10 +315,62 @@ roles:
       borg_mode_append_only: true # ERROR: inconsistent
 ```
 
-### Single SSH Key per Host\*\*
+```yaml
+# This will FAIL - conflicting storage quota settings
+roles:
+  - role: kliwniloc.borgbackup
+    vars:
+      borg_repo_name: configs
+      borg_storage_quota: 10G # ERROR: inconsistent
+
+  - role: kliwniloc.borgbackup
+    vars:
+      borg_repo_name: home-data
+      borg_storage_quota: 50G # ERROR: inconsistent
+```
+
+### Per-Repo SSH Keys for Independent Settings
+
+To use different `--append-only` or `--storage-quota` settings per repository,
+enable `borg_ssh_key_per_repo: true`. This generates a unique SSH keypair for
+each `(server, repo)` combination, allowing each repository to have its own
+`authorized_keys` entry with independent settings.
+
+```yaml
+- name: Configure repos with independent settings using per-repo SSH keys
+  hosts: borg-client
+  vars:
+    borg_server_host: borg-server
+    borg_server_host_ssh_key: ssh-rsa AAAAAAAA...
+    borg_ssh_key_per_repo: true
+
+  roles:
+    - role: kliwniloc.borgbackup
+      vars:
+        borg_repo_name: configs
+        borg_backup_argument: configs
+        borg_mode_append_only: true
+        borg_storage_quota: 10G
+        borg_included_dirs:
+          - /etc
+
+    - role: kliwniloc.borgbackup
+      vars:
+        borg_repo_name: home-data
+        borg_backup_argument: home-data
+        borg_mode_append_only: false # OK: different key
+        borg_storage_quota: 50G # OK: different key
+        borg_included_dirs:
+          - /home
+```
+
+This creates:
 
-The role generates one SSH keypair per client host. All repositories for that
-host share the same SSH key for authentication to the Borg server.
+- Two separate SSH keypairs: `id_ed25519_borgbackup_borg_server_configs` and
+  `id_ed25519_borgbackup_borg_server_home_data`
+- Two separate `authorized_keys` entries with independent restrictions so that
+  each repository can have its own `--append-only` and `--storage-quota`
+  settings
 
 ### Decryption Keys Storage Format