aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Declare community.crypto dependencyHEADmasterColin Wilk2026-07-023-1/+15
|
* Add github actions for moleculeColin Wilk2026-07-021-0/+42
|
* Add state: absent variableColin Wilk2026-07-0216-29/+1118
| | | | Allow removing configuration for repositories.
* Support custom arguments for borg createColin Wilk2026-06-296-1/+60
|
* Format python files with ruffColin Wilk2026-06-289-442/+512
|
* fix: use ansible_facts for getent_passwdColin Wilk2026-06-282-2/+2
| | | | | | | | | | | | | Replace direct usage of getent_passwd with ansible_facts.getent_passwd in both client_setup.yml and server_setup.yml. Ansible 2.24+ will remove the INJECT_FACTS_AS_VARS feature, requiring explicit use of ansible_facts dictionary instead of top-level fact variables. Fixes deprecation warning: INJECT_FACTS_AS_VARS default to 'True' is deprecated, top-level facts will not be auto injected after the change.
* Parametrize server-side borg userColin Wilk2026-06-2815-412/+530
| | | | Adds option to choose a non-default borg backup user on the server.
* Add option to disable decryption key exportColin Wilk2026-06-285-43/+63
|
* docs: sync argument_specs.ymlColin Wilk2026-06-281-1/+27
|
* feat: add storage quota supportColin Wilk2026-06-277-12/+252
| | | | | | | | | Add borg_storage_quota variable to limit repository storage on the borg server via --storage-quota option in authorized_keys. When not using borg_ssh_key_per_repo, all repos for a host must share the same quota setting (similar to --append-only). Per-repo SSH keys enable independent quotas per repository.
* feat: add per-repo SSH key supportColin Wilk2026-06-279-23/+303
| | | | | | | | | Add borg_ssh_key_per_repo option to generate unique SSH keypairs per (server, repo) combination. When enabled, each repository gets its own authorized_keys entry, enabling: - Independent --append-only settings per repository - Per-repo storage quotas
* Add support for non-root backup clientsColin Wilk2026-06-2710-64/+270
|
* borg!: support multiple backups to same targetColin Wilk2026-06-274-83/+310
| | | | | | | | | | | | | | | | | | This brings support for multiple backups pointing to the same borg server, different repositories, from the same client. We support this by parsing the SSH authorized key file first and appending allowed repositories to allow independent definitions of the borg targets. So that the decryption_keys do not clash we include the repository name as well as the host in the key. This will lead to new keys being created for existing hosts in the new format. Old Format: {{ combine({inventory_hostname: borg_keys.stdout}) }} New Format: {{ combine({(inventory_hostname ~ '_' ~ borg_repo_name): borg_keys.stdout}) }} If upgrading from an older version that used just the hostname as the key, your existing `decryption_keys.yml` can be manually removed once the new format is also added.
* docs: add passphrase warning for true e2eeColin Wilk2026-06-271-0/+5
| | | | We should mention that users need to add a passphrase for true E2EE.
* test: add larger test suite for roleColin Wilk2026-06-2711-68/+871
| | | | | | | | - Add test systems for client/server setup - Add tests for systemd service and timer files - Add tests for SSH connectivity - Add tests for security configurations - Add tests for multi-instance backup scenarios
* backup_script!: ensure unique blockinfile markerColin Wilk2026-06-271-1/+1
| | | | | | | | | | | | | | | | | The blockinfile marker was only keyed by borg_server_host_url, causing backup blocks to overwrite each other when running the role multiple times on the same host with different repositories. This change includes borg_repo_name in the marker, allowing multiple backup blocks to coexist in the base script. Now running the role twice with different borg_repo_name values creates separate blocks instead of overwriting. This ensures idempotent behavior and allows the base script to accumulate all backup targets as documented. Before: marker for "borg-server" (overwrites on second run) After: marker for "borg-server/configs" and "borg-server/home-data"
* shell.nix: add fix for molecule docker driverColin Wilk2026-06-261-15/+19
| | | | | | | | Currently molecule is incompatible with Ansible 14 / ansible-core 2.21 so we need to inject invocation variables via env var to make it work. Should be fixed when this gets closed: https://github.com/ansible-community/molecule-plugins/issues/363
* Update and fix pre-commit hooksColin Wilk2026-06-2613-112/+99
|
* Add shell.nix for molecule testsColin Wilk2026-06-231-0/+40
|
* test: add tests for systemd exist success statusColin Wilk2026-06-234-20/+57
|
* Add option to configure SuccessExitStatusv1.0.5Colin Wilk2026-06-222-1/+21
| | | | | | | | Useful for letting systemd services not get marked as failed state when borg throws warnings. Keeping default to only accept exit code 0 as a successful state. Related: PR #2 https://github.com/kliwniloc/ansible-role-borgbackup/pull/2
* fix: systemd SuccessExitStatus to accept warning exit as successIgnacio Garcia2026-06-221-0/+1
|
* Handle special characters around BORG_PASSPHRASE variablev1.0.4Magnus Kühne2026-01-231-1/+1
| | | | | If passphrase contains special characters like (!, $, &, ^, *, @), this needs to be escaped. Co-authored-by: Colin Wilk <colin@wilk.cx>
* Fix typo in install scriptv1.0.3Colin Wilk2024-05-111-2/+2
| | | | Signed-off-by: Colin Wilk <colin.wilk@tum.de>
* Fix correct branch in READMEv1.0.2Colin Wilk2023-11-261-1/+1
| | | | Signed-off-by: Colin Wilk <colin.wilk@tum.de>
* Fix new galaxy meta schemaColin Wilk2023-11-261-1/+0
| | | | Signed-off-by: Colin Wilk <colin.wilk@tum.de>
* Add pre-commit actionv1.0.1Colin Wilk2023-11-261-0/+12
| | | | Signed-off-by: Colin Wilk <colin.wilk@tum.de>
* Add release actionv1.0.0Colin Wilk2023-11-261-0/+34
| | | | Signed-off-by: Colin Wilk <colin.wilk@tum.de>
* Add proper variables docs to READMEColin Wilk2023-11-261-31/+91
| | | | Signed-off-by: Colin Wilk <colin.wilk@tum.de>
* Migrate role from cron to systemdColin Wilk2023-11-0412-71/+175
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Systemd gives us the ability to monitor backup job status using existing monitoring solutions (node exporter) and allows us greater control over the scheduling of the backup jobs. This introduces a breaking change that requires users to manually remove the old repositories from the clients and redeploying them with the role. You will have to remove the Cron job that was created by the Ansible script, everything else will be overwritten with a run from the newer version. - name: Remove backup cron jobs ansible.builtin.cron: name: BORG (Application level backups) state: absent become: true - name: Remove env for backup cron job ansible.builtin.cron: name: BORG_PASSPHRASE env: true state: absent become: true Performing manual migrations on the Borg server is not required. We now additionally support multiple Borg repositories per client host using the `borg_backup_argument` variable. Signed-off-by: Colin Wilk <colin.wilk@tum.de>
* Refactor failed_when condition into condition listColin Wilk2023-05-241-3/+3
| | | | | | | Change single logic condition with `and` string into two logic conditions in a condition list. Signed-off-by: Colin Wilk <colin.wilk@tum.de>
* Add ansible-lint configurationColin Wilk2023-05-241-5/+72
| | | | | | | The configuration is still compliant with the current source but will be enforced from now on. Signed-off-by: Colin Wilk <colin.wilk@tum.de>
* Add YAMLLint rulesColin Wilk2023-05-2410-42/+96
| | | | | | | | | | | | | | | Fix linting errors that came up with the new rules Main changes: * Enforce YAML document start headers * Enforce spacing with commas, colons and hyphens * Enforce indentation * Enforce use of quotes only then required * Enforce use of single quotes over double quotes * Enforce use of true/false over yes/no and derivatives * [..] Other minor rules that were already followed Signed-off-by: Colin Wilk <colin.wilk@tum.de>
* initColin Wilk2023-05-2416-0/+779
Signed-off-by: Colin Wilk <colin.wilk@tum.de>