feat: add per-repo SSH key support

Add borg_ssh_key_per_repo option to generate unique SSH keypairs per
(server, repo) combination. When enabled, each repository gets its own
authorized_keys entry, enabling:

- Independent --append-only settings per repository
- Per-repo storage quotas

1 files changed, 43 insertions, 2 deletions

diff --git a/molecule/default/tests/test_ssh_connectivity.py b/molecule/default/tests/test_ssh_connectivity.py
index 89b24a5..0cc1897 100644
--- a/molecule/default/tests/test_ssh_connectivity.py
+++ b/molecule/default/tests/test_ssh_connectivity.py
@@ -1,7 +1,19 @@
 """Tests for SSH connectivity between client and server"""
 import pytest
 
-testinfra_hosts = ['borg-client', 'borg-client-2', 'borg-client-multi']
+testinfra_hosts = ['borg-client', 'borg-client-2', 'borg-client-multi', 'borg-client-multi-keys']
+
+
+def get_borg_rsh(host, repo_name):
+    hostname = host.backend.get_hostname()
+    if hostname != 'borg-client-multi-keys':
+        return ''
+
+    sanitized_repo_name = repo_name.replace('-', '_')
+    return (
+        'BORG_RSH="ssh -i '
+        f'/root/.ssh/id_ed25519_borgbackup_borg_server_{sanitized_repo_name}"'
+    )
 
 
 def test_ssh_connection_to_server(host):
@@ -10,7 +22,19 @@ def test_ssh_connection_to_server(host):
 
 
 def test_no_password_prompt_on_connect(host):
-    c = host.run('ssh -o BatchMode=yes -o PreferredAuthentications=publickey borg@borg-server exit')
+    hostname = host.backend.get_hostname()
+
+    if hostname == 'borg-client-multi-keys':
+        c = host.run(
+            'ssh -i /root/.ssh/id_ed25519_borgbackup_borg_server_configs_keys '
+            '-o BatchMode=yes -o PreferredAuthentications=publickey '
+            'borg@borg-server exit'
+        )
+    else:
+        c = host.run(
+            'ssh -o BatchMode=yes -o PreferredAuthentications=publickey '
+            'borg@borg-server exit'
+        )
     assert c.rc == 0
 
 
@@ -27,6 +51,12 @@ def test_borg_can_connect_to_server(host):
     if hostname == 'borg-client-multi':
         c = host.run('borg list borg@borg-server:/opt/borg/configs')
         assert c.rc == 0, 'Should be able to connect to configs repo'
+    elif hostname == 'borg-client-multi-keys':
+        c = host.run(
+            f'{get_borg_rsh(host, "configs-keys")} '
+            'borg list borg@borg-server:/opt/borg/configs-keys'
+        )
+        assert c.rc == 0, 'Should be able to connect to configs-keys repo'
     elif hostname == 'borg-client':
         c = host.run('borg list borg@borg-server:/opt/borg/borg-client')
         assert c.rc == 0
@@ -45,6 +75,17 @@ def test_borg_info_works(host):
         assert c.rc == 0, 'Should be able to get info for configs repo'
         c2 = host.run('borg info borg@borg-server:/opt/borg/home-data')
         assert c2.rc == 0, 'Should be able to get info for home-data repo'
+    elif hostname == 'borg-client-multi-keys':
+        c = host.run(
+            f'{get_borg_rsh(host, "configs-keys")} '
+            'borg info borg@borg-server:/opt/borg/configs-keys'
+        )
+        assert c.rc == 0, 'Should be able to get info for configs-keys repo'
+        c2 = host.run(
+            f'{get_borg_rsh(host, "home-data-keys")} '
+            'borg info borg@borg-server:/opt/borg/home-data-keys'
+        )
+        assert c2.rc == 0, 'Should be able to get info for home-data-keys repo'
     elif hostname == 'borg-client':
         c = host.run('borg info borg@borg-server:/opt/borg/borg-client')
         assert c.rc == 0