feat: add per-repo SSH key support

Add borg_ssh_key_per_repo option to generate unique SSH keypairs per
(server, repo) combination. When enabled, each repository gets its own
authorized_keys entry, enabling:

- Independent --append-only settings per repository
- Per-repo storage quotas

1 files changed, 24 insertions, 5 deletions

diff --git a/tasks/client_setup.yml b/tasks/client_setup.yml
index a1a2267..18d5b18 100644
--- a/tasks/client_setup.yml
+++ b/tasks/client_setup.yml
@@ -32,6 +32,18 @@
   become_user: "{{ borg_client_user }}"
   when: borg_included_dirs | length > 0
 
+- name: Compute SSH key identifier
+  ansible.builtin.set_fact:
+    borg_ssh_key_identifier: "{{ (borg_server_host_url ~ '_' ~ borg_repo_name) | regex_replace('[^a-zA-Z0-9]', '_') }}"
+
+- name: Compute SSH key path
+  ansible.builtin.set_fact:
+    borg_ssh_key_path: >-
+      {{ borg_client_user_home }}/.ssh/id_{{ borg_ssh_key_type }}
+      {%- if borg_ssh_key_per_repo -%}
+      _borgbackup_{{ borg_ssh_key_identifier }}
+      {%- endif -%}
+
 - name: Create SSH Directory
   ansible.builtin.file:
     path: "{{ borg_client_user_home }}/.ssh"
@@ -52,12 +64,12 @@
 
 - name: Generate SSH keys
   community.crypto.openssh_keypair:
-    path: "{{ borg_client_user_home }}/.ssh/id_{{ borg_ssh_key_type }}"
+    path: "{{ borg_ssh_key_path }}"
     type: "{{ borg_ssh_key_type }}"
     owner: "{{ borg_client_user }}"
     group: "{{ borg_client_user }}"
     mode: "0600"
-    comment: "{{ borg_client_user }}@{{ inventory_hostname }}"
+    comment: "{{ borg_client_user }}@{{ inventory_hostname }}{% if borg_ssh_key_per_repo %}_{{ borg_ssh_key_identifier }}{% endif %}"
   become: true
   register: ssh_key
 
@@ -132,13 +144,18 @@
     borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
   environment:
     BORG_PASSPHRASE: "{{ borg_passphrase }}"
+    BORG_RSH: "{{ ('ssh -i ' ~ borg_ssh_key_path) if borg_ssh_key_per_repo else omit }}"
   become: true
   become_user: "{{ borg_client_user }}"
   register: init_borg_output
-  changed_when: init_borg_output.rc != 2
+  changed_when: init_borg_output.rc == 0
   failed_when:
-    - init_borg_output.rc != 2
-    - init_borg_output.rc != 0
+    - init_borg_output.rc not in [0, 2]
+      or (
+      init_borg_output.rc == 2
+      and 'already exists' not in init_borg_output.stdout
+      and 'already exists' not in init_borg_output.stderr
+      )
 
 - name: Make sure key file exists
   ansible.builtin.file:
@@ -163,6 +180,8 @@
       ansible.builtin.command: >
         borg key export --paper
         borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
+      environment:
+        BORG_RSH: "{{ ('ssh -i ' ~ borg_ssh_key_path) if borg_ssh_key_per_repo else omit }}"
       become: true
       become_user: "{{ borg_client_user }}"
       register: borg_keys