Add support for non-root backup clients

1 files changed, 42 insertions, 20 deletions

diff --git a/molecule/default/converge.yml b/molecule/default/converge.yml
index c77202c..d90f33a 100644
--- a/molecule/default/converge.yml
+++ b/molecule/default/converge.yml
@@ -4,6 +4,7 @@
     - borg-client
     - borg-client-2
     - borg-client-multi
+    - borg-client-nonroot
 
   vars:
     borg_server_host: borg-server
@@ -12,29 +13,35 @@
     # This would usually be set by the user globally on their ansible
     # repository and can be a security risk to do automatically. We will
     # however set the variable here in the pre_tasks since it is for testing.
-    - name: Set borg server openssh key variable
+    - name: Start ssh
+      ansible.builtin.systemd:
+        name: sshd
+        state: started
       become: true
-      block:
-        - name: Start ssh
-          ansible.builtin.systemd:
-            name: sshd
-            state: started
-          become: true
-          delegate_to: "{{ borg_server_host }}"
+      delegate_to: "{{ borg_server_host }}"
 
-        - name: Fetch ssh_key
-          ansible.builtin.command: >-
-            ssh-keyscan -t rsa {{ borg_server_host }} | sed "s/^[^ ]* //"
-          register: borg_server_ssh_keyscan
-          changed_when: false
+    - name: Fetch ssh_key
+      ansible.builtin.command: >-
+        ssh-keyscan -t rsa {{ borg_server_host }} | sed "s/^[^ ]* //"
+      register: borg_server_ssh_keyscan
+      changed_when: false
 
-        - name: Set ssh_key
-          ansible.builtin.set_fact:
-            borg_server_host_ssh_key: >-
-              {{ borg_server_ssh_keyscan.stdout
-              | split(" ")
-              | reject("search", borg_server_host)
-              | join(" ") }}
+    - name: Set ssh_key
+      ansible.builtin.set_fact:
+        borg_server_host_ssh_key: >-
+          {{ borg_server_ssh_keyscan.stdout
+          | split(" ")
+          | reject("search", borg_server_host)
+          | join(" ") }}
+
+    - name: Create backup user for non-root test
+      ansible.builtin.user:
+        name: backupuser
+        home: /home/backupuser
+        shell: /bin/bash
+        state: present
+      become: true
+      when: inventory_hostname == 'borg-client-nonroot'
 
 - name: Converge - Default borg-client
   hosts: borg-client
@@ -62,6 +69,7 @@
         borg_server_host: borg-server
         borg_server_user_home: /opt/borg
         borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"
+        borg_ssh_key_type: ed25519
         borg_backup_service_successful_exit_status:
           - 1
           - TEMPFAIL
@@ -105,3 +113,17 @@
         borg_excluded_dirs:
           - /home/*/.cache
         borg_systemd_oncalendar: "*-*-* 04:00:00"
+
+- name: Converge - Non-root backup user
+  hosts: borg-client-nonroot
+
+  roles:
+    - role: kliwniloc.borgbackup
+      vars:
+        borg_server_host: borg-server
+        borg_server_user_home: /opt/borg
+        borg_client_user: backupuser
+        borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"
+        borg_included_dirs:
+          - /etc
+        borg_excluded_dirs: []