Add option to disable decryption key export

1 files changed, 41 insertions, 38 deletions

diff --git a/tasks/client_setup.yml b/tasks/client_setup.yml
index e39826a..71027c3 100644
--- a/tasks/client_setup.yml
+++ b/tasks/client_setup.yml
@@ -177,48 +177,51 @@
       and 'already exists' not in init_borg_output.stderr
       )
 
-- name: Make sure key file exists
-  ansible.builtin.file:
-    path: "{{ borg_decryption_keys_yaml_path }}"
-    state: touch
-    mode: "0600"
-    access_time: preserve
-    modification_time: preserve
-  delegate_to: localhost
-  become: false
+- name: Export decryption keys
+  when: borg_decryption_keys_yaml_path | default('') | length > 0
+  block:
+    - name: Make sure key file exists
+      ansible.builtin.file:
+        path: "{{ borg_decryption_keys_yaml_path }}"
+        state: touch
+        mode: "0600"
+        access_time: preserve
+        modification_time: preserve
+      delegate_to: localhost
+      become: false
 
-- name: Read Vars file
-  ansible.builtin.include_vars:
-    file: "{{ borg_decryption_keys_yaml_path }}"
-  register: local
+    - name: Read Vars file
+      ansible.builtin.include_vars:
+        file: "{{ borg_decryption_keys_yaml_path }}"
+      register: local
 
-- name: Add repository encryption keys to ansible repo
-  when: not (inventory_hostname ~ '_' ~ borg_repo_name) in local.ansible_facts
-  throttle: 1
-  block:
-    - name: If host new read encryption keys
-      ansible.builtin.command: >
-        borg key export --paper
-        borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
-      environment:
-        BORG_RSH: "{{ ('ssh -i ' ~ borg_ssh_key_path) if borg_ssh_key_per_repo else omit }}"
-      become: true
-      become_user: "{{ borg_client_user }}"
-      register: borg_keys
-      changed_when: borg_keys.rc != 0
+    - name: Add repository encryption keys to ansible repo
+      when: not (inventory_hostname ~ '_' ~ borg_repo_name) in local.ansible_facts
+      throttle: 1
+      block:
+        - name: If host new read encryption keys
+          ansible.builtin.command: >
+            borg key export --paper
+            borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
+          environment:
+            BORG_RSH: "{{ ('ssh -i ' ~ borg_ssh_key_path) if borg_ssh_key_per_repo else omit }}"
+          become: true
+          become_user: "{{ borg_client_user }}"
+          register: borg_keys
+          changed_when: borg_keys.rc != 0
 
-    - name: If host new add encryption keys to vars
-      ansible.builtin.set_fact:
-        decryption_keys: "{{ local.ansible_facts | combine({(inventory_hostname ~ '_' ~ borg_repo_name): borg_keys.stdout}) }}"
+        - name: If host new add encryption keys to vars
+          ansible.builtin.set_fact:
+            decryption_keys: "{{ local.ansible_facts | combine({(inventory_hostname ~ '_' ~ borg_repo_name): borg_keys.stdout}) }}"
 
-- name: Update encryption vars
-  ansible.builtin.copy:
-    content: "{{ decryption_keys | to_nice_yaml(indent=2, width=2048) }}"
-    dest: "{{ borg_decryption_keys_yaml_path }}"
-    mode: "0600"
-  when: decryption_keys is defined
-  delegate_to: localhost
-  become: false
+    - name: Update encryption vars
+      ansible.builtin.copy:
+        content: "{{ decryption_keys | to_nice_yaml(indent=2, width=2048) }}"
+        dest: "{{ borg_decryption_keys_yaml_path }}"
+        mode: "0600"
+      when: decryption_keys is defined
+      delegate_to: localhost
+      become: false
 
 - name: Create backup scripts
   ansible.builtin.include_tasks: client_create_scripts_each.yml