Add borg prune and compact jobs

Run repository retention either after a successful backup or from a
dedicated systemd timer. Clean up script generation with templates and
expand molecule test coverage.

BREAKING CHANGE: Aggregate backup scripts are no longer managed, and
state=preset now requires at least one readable included directory.

1 files changed, 167 insertions, 0 deletions

diff --git a/molecule/default/side_effect.yml b/molecule/default/side_effect.yml
new file mode 100644
index 0000000..63a10e5
--- /dev/null
+++ b/molecule/default/side_effect.yml
@@ -0,0 +1,167 @@
+---
+- name: Side effect - Configure SSH access for transition tests
+  hosts:
+    - borg-client-transition
+    - borg-client-validation
+
+  tasks:
+    - name: Start ssh on borg-server
+      ansible.builtin.systemd:
+        name: sshd
+        state: started
+      become: true
+      delegate_to: borg-server
+
+    - name: Fetch ssh key for borg-server
+      ansible.builtin.command: >-
+        ssh-keyscan -t rsa borg-server | sed "s/^[^ ]* //"
+      register: borg_server_ssh_keyscan
+      changed_when: false
+
+    - name: Set ssh key for borg-server
+      ansible.builtin.set_fact:
+        borg_server_host_ssh_key: >-
+          {{ borg_server_ssh_keyscan.stdout
+          | split(" ")
+          | reject("search", "borg-server")
+          | join(" ") }}
+
+- name: Side effect - Transition prune from timer to after_backup
+  hosts: borg-client-transition
+
+  tasks:
+    - name: Configure timer-triggered pruning
+      ansible.builtin.include_role:
+        name: kliwniloc.borgbackup
+      vars:
+        borg_server_host: borg-server
+        borg_server_user_home: /opt/borg
+        borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"
+        borg_repo_name: transition-repo
+        borg_backup_argument: transition-repo
+        borg_included_dirs:
+          - /etc
+        borg_excluded_dirs: []
+        borg_prune_enabled: true
+        borg_prune_trigger: timer
+        borg_prune_keep_daily: "2"
+        borg_prune_glob_archives: "{hostname}-*"
+        borg_prune_systemd_oncalendar: "*-*-* 05:15:00"
+
+    - name: Check timer-triggered prune resources
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      loop:
+        - /usr/local/bin/run_borg_prune@transition-repo
+        - /etc/systemd/system/borg_prune@transition-repo.service
+        - /etc/systemd/system/borg_prune@transition-repo.timer
+      register: transition_timer_resources
+
+    - name: Check timer-triggered prune timer is enabled
+      ansible.builtin.systemd:
+        name: borg_prune@transition-repo.timer
+      register: transition_timer_status
+      become: true
+
+    - name: Assert timer-triggered pruning was configured
+      ansible.builtin.assert:
+        that:
+          - transition_timer_resources.results | map(attribute='stat.exists') | list == [true, true, true]
+          - transition_timer_status.status.UnitFileState == 'enabled'
+
+    - name: Reconfigure pruning to run after backup
+      ansible.builtin.include_role:
+        name: kliwniloc.borgbackup
+      vars:
+        borg_server_host: borg-server
+        borg_server_user_home: /opt/borg
+        borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"
+        borg_repo_name: transition-repo
+        borg_backup_argument: transition-repo
+        borg_included_dirs:
+          - /etc
+        borg_excluded_dirs: []
+        borg_prune_enabled: true
+        borg_prune_trigger: after_backup
+        borg_prune_keep_last: "2"
+        borg_prune_glob_archives: "{hostname}-*"
+
+    - name: Check stale prune timer was removed
+      ansible.builtin.stat:
+        path: /etc/systemd/system/borg_prune@transition-repo.timer
+      register: stale_transition_timer
+
+    - name: Read transition backup service
+      ansible.builtin.slurp:
+        src: /etc/systemd/system/borg_backup@transition-repo.service
+      register: transition_backup_service
+      become: true
+
+    - name: Assert after_backup transition completed
+      ansible.builtin.assert:
+        that:
+          - not stale_transition_timer.stat.exists
+          - >-
+            'OnSuccess=borg_prune@transition-repo.service'
+            in (transition_backup_service.content | b64decode)
+
+- name: Side effect - Disable timer-triggered pruning
+  hosts: borg-client-validation
+
+  tasks:
+    - name: Configure timer-triggered pruning before disabling it
+      ansible.builtin.include_role:
+        name: kliwniloc.borgbackup
+      vars:
+        borg_server_host: borg-server
+        borg_server_user_home: /opt/borg
+        borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"
+        borg_repo_name: validation-disable-prune
+        borg_backup_argument: validation-disable-prune
+        borg_included_dirs:
+          - /etc
+        borg_prune_enabled: true
+        borg_prune_trigger: timer
+        borg_prune_keep_last: "2"
+
+    - name: Check prune resources before disabling
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      loop:
+        - /usr/local/bin/run_borg_prune@validation-disable-prune
+        - /etc/systemd/system/borg_prune@validation-disable-prune.service
+        - /etc/systemd/system/borg_prune@validation-disable-prune.timer
+      register: enabled_prune_resources
+
+    - name: Assert prune resources were created
+      ansible.builtin.assert:
+        that:
+          - enabled_prune_resources.results | map(attribute='stat.exists') | list == [true, true, true]
+
+    - name: Disable timer-triggered pruning
+      ansible.builtin.include_role:
+        name: kliwniloc.borgbackup
+      vars:
+        borg_server_host: borg-server
+        borg_server_user_home: /opt/borg
+        borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"
+        borg_repo_name: validation-disable-prune
+        borg_backup_argument: validation-disable-prune
+        borg_included_dirs:
+          - /etc
+        borg_prune_enabled: false
+
+    - name: Check that disabled prune resources were removed
+      ansible.builtin.stat:
+        path: "{{ item }}"
+      loop:
+        - /usr/local/bin/run_borg_prune
+        - /usr/local/bin/run_borg_prune@validation-disable-prune
+        - /etc/systemd/system/borg_prune@validation-disable-prune.service
+        - /etc/systemd/system/borg_prune@validation-disable-prune.timer
+      register: disabled_prune_resources
+
+    - name: Assert disabled prune resources were removed
+      ansible.builtin.assert:
+        that:
+          - disabled_prune_resources.results | map(attribute='stat.exists') | select | list | length == 0