diff options
Diffstat (limited to 'tasks/client_setup.yml')
| -rw-r--r-- | tasks/client_setup.yml | 70 |
1 files changed, 61 insertions, 9 deletions
diff --git a/tasks/client_setup.yml b/tasks/client_setup.yml index 1eae105..8769852 100644 --- a/tasks/client_setup.yml +++ b/tasks/client_setup.yml @@ -26,15 +26,67 @@ become: true register: ssh_key -- name: Deploy Keys to Borg server +- name: Ensure authorized_keys file exists on borg server + ansible.builtin.file: + path: "{{ borg_server_user_home }}/.ssh/authorized_keys" + state: touch + owner: borg + group: borg + mode: "0600" + access_time: preserve + modification_time: preserve + become: true + delegate_to: "{{ borg_server_host }}" + +- name: Read existing authorized_keys content + ansible.builtin.slurp: + src: "{{ borg_server_user_home }}/.ssh/authorized_keys" + become: true + delegate_to: "{{ borg_server_host }}" + register: auth_keys_content + +- name: Find existing authorized_keys line for this host + ansible.builtin.set_fact: + existing_line: >- + {{ + (auth_keys_content.content | b64decode).splitlines() + | select("search", ssh_key.public_key | trim | regex_escape) + | first + | default("") + }} + +- name: Detect --append-only setting from existing entry + ansible.builtin.set_fact: + existing_append_only: "{{ existing_line is search('--append-only') }}" + when: existing_line | length > 0 + +- name: Fail if --append-only setting differs from existing entry + ansible.builtin.fail: + msg: | + Inconsistent --append-only setting for host {{ inventory_hostname }}. + Existing entry has --append-only={{ existing_append_only }}, but current invocation uses --append-only={{ borg_mode_append_only }}. + All repositories for a host must have the same --append-only setting. + when: + - existing_line | length > 0 + - existing_append_only != borg_mode_append_only + +- name: Compute all repos for this host + ansible.builtin.set_fact: + all_repos: >- + {{ + ( + (existing_line | regex_findall('--restrict-to-repository ([^\s"]+)')) + + [borg_server_user_home + '/' + borg_repo_name] + ) | unique | sort }} + +- name: Update authorized_keys entry for this host ansible.builtin.lineinfile: path: "{{ borg_server_user_home }}/.ssh/authorized_keys" - line: > - restrict,command="borg serve - {{ "--append-only" if borg_mode_append_only }} - --restrict-to-repository {{ borg_repo_name }}" - {{ ssh_key.public_key }} root@{{ inventory_hostname }} - search_string: --restrict-to-repository {{ borg_repo_name }}" {{ ssh_key.public_key }} + search_string: "{{ ssh_key.public_key | trim }}" + line: >- + restrict,command="borg serve{{ " --append-only" if borg_mode_append_only }} + {{ all_repos | map('regex_replace', '^', '--restrict-to-repository ') | join(' ') }}" + {{ ssh_key.public_key | trim }} root@{{ inventory_hostname }} state: present become: true delegate_to: "{{ borg_server_host }}" @@ -68,7 +120,7 @@ register: local - name: Add repository encryption keys to ansible repo - when: not inventory_hostname in local.ansible_facts + when: not (inventory_hostname ~ '_' ~ borg_repo_name) in local.ansible_facts throttle: 1 block: - name: If host new read encryption keys @@ -81,7 +133,7 @@ - name: If host new add encryption keys to vars ansible.builtin.set_fact: - decryption_keys: "{{ local.ansible_facts | combine({inventory_hostname: borg_keys.stdout}) }}" + decryption_keys: "{{ local.ansible_facts | combine({(inventory_hostname ~ '_' ~ borg_repo_name): borg_keys.stdout}) }}" - name: Update encryption vars ansible.builtin.copy: |