Add support for non-root backup clients

2 files changed, 49 insertions, 12 deletions

diff --git a/tasks/client_create_scripts_each.yml b/tasks/client_create_scripts_each.yml
index b91c385..6c0615f 100644
--- a/tasks/client_create_scripts_each.yml
+++ b/tasks/client_create_scripts_each.yml
@@ -3,8 +3,8 @@
   ansible.builtin.file:
     dest: "{{ script_location }}"
     state: touch
-    owner: root
-    group: root
+    owner: "{{ borg_client_user }}"
+    group: "{{ borg_client_user }}"
     modification_time: preserve
     access_time: preserve
     mode: "0711"
diff --git a/tasks/client_setup.yml b/tasks/client_setup.yml
index 8769852..a1a2267 100644
--- a/tasks/client_setup.yml
+++ b/tasks/client_setup.yml
@@ -1,10 +1,43 @@
 ---
+- name: Ensure borg_client_user exists
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ borg_client_user }}"
+  become: true
+
+- name: Compute borg_client_user_home if not set
+  ansible.builtin.set_fact:
+    borg_client_user_home: "{{ getent_passwd[borg_client_user][4] }}"
+  when: borg_client_user_home is not defined
+
+- name: Validate borg_client_user home exists
+  ansible.builtin.stat:
+    path: "{{ borg_client_user_home }}"
+  register: user_home_stat
+  become: true
+
+- name: Fail if borg_client_user home missing
+  ansible.builtin.fail:
+    msg: |
+      Home directory {{ borg_client_user_home }} for user {{ borg_client_user }} does not exist.
+      Please ensure the user has a valid home directory before running this role.
+  when: not user_home_stat.stat.exists
+
+- name: Check readability of included paths
+  ansible.builtin.stat:
+    path: "{{ item }}"
+  loop: "{{ borg_included_dirs }}"
+  register: included_paths_stat
+  become: true
+  become_user: "{{ borg_client_user }}"
+  when: borg_included_dirs | length > 0
+
 - name: Create SSH Directory
   ansible.builtin.file:
-    path: /root/.ssh
-    owner: root
-    group: root
-    mode: "0640"
+    path: "{{ borg_client_user_home }}/.ssh"
+    owner: "{{ borg_client_user }}"
+    group: "{{ borg_client_user }}"
+    mode: "0700"
     state: directory
   become: true
 
@@ -12,17 +45,19 @@
   ansible.builtin.known_hosts:
     name: "{{ borg_server_host_url }}"
     key: "{{ borg_server_host_url }} {{ borg_server_host_ssh_key }}"
-    path: /root/.ssh/known_hosts
+    path: "{{ borg_client_user_home }}/.ssh/known_hosts"
     state: present
   become: true
+  become_user: "{{ borg_client_user }}"
 
 - name: Generate SSH keys
   community.crypto.openssh_keypair:
-    path: /root/.ssh/id_rsa
-    owner: root
-    group: root
+    path: "{{ borg_client_user_home }}/.ssh/id_{{ borg_ssh_key_type }}"
+    type: "{{ borg_ssh_key_type }}"
+    owner: "{{ borg_client_user }}"
+    group: "{{ borg_client_user }}"
     mode: "0600"
-    comment: root@{{ inventory_hostname }}
+    comment: "{{ borg_client_user }}@{{ inventory_hostname }}"
   become: true
   register: ssh_key
 
@@ -86,7 +121,7 @@
     line: >-
       restrict,command="borg serve{{ " --append-only" if borg_mode_append_only }}
       {{ all_repos | map('regex_replace', '^', '--restrict-to-repository ') | join(' ') }}"
-      {{ ssh_key.public_key | trim }} root@{{ inventory_hostname }}
+      {{ ssh_key.public_key | trim }} {{ borg_client_user }}@{{ inventory_hostname }}
     state: present
   become: true
   delegate_to: "{{ borg_server_host }}"
@@ -98,6 +133,7 @@
   environment:
     BORG_PASSPHRASE: "{{ borg_passphrase }}"
   become: true
+  become_user: "{{ borg_client_user }}"
   register: init_borg_output
   changed_when: init_borg_output.rc != 2
   failed_when:
@@ -128,6 +164,7 @@
         borg key export --paper
         borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
       become: true
+      become_user: "{{ borg_client_user }}"
       register: borg_keys
       changed_when: borg_keys.rc != 0