From 7d96c1a11fc442b4efddf9ce5250cf0a9dfaf02e Mon Sep 17 00:00:00 2001
From: Colin Wilk <colin@wilk.cx>
Date: Sun, 28 Jun 2026 22:47:11 +0200
Subject: Parametrize server-side borg user

Adds option to choose a non-default borg backup user on the server.
---
 tasks/server_setup.yml | 64 ++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 57 insertions(+), 7 deletions(-)

(limited to 'tasks/server_setup.yml')

diff --git a/tasks/server_setup.yml b/tasks/server_setup.yml
index e47d012..66b92bd 100644
--- a/tasks/server_setup.yml
+++ b/tasks/server_setup.yml
@@ -1,10 +1,60 @@
 ---
-- name: Create borg user
-  ansible.builtin.user:
-    name: borg
-    comment: Borgbackup user
-    create_home: true
-    home: "{{ borg_server_user_home }}"
-    generate_ssh_key: true
+- name: Create borg_server_user on server
+  when: borg_server_user_create
+  block:
+    - name: Create borg user
+      ansible.builtin.user:
+        name: "{{ borg_server_user }}"
+        comment: Borgbackup user
+        create_home: true
+        home: "{{ borg_server_user_home }}"
+        generate_ssh_key: false
+      become: true
+      delegate_to: "{{ borg_server_host }}"
+
+- name: Ensure borg_server_user exists
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ borg_server_user }}"
+  become: true
+  delegate_to: "{{ borg_server_host }}"
+
+- name: Fail if borg_server_user does not exist
+  ansible.builtin.fail:
+    msg: |
+      User {{ borg_server_user }} does not exist on {{ borg_server_host }}.
+      Please create the user before running this role or set borg_server_user_create: true.
+  when: getent_passwd[borg_server_user] is not defined
+  delegate_to: "{{ borg_server_host }}"
+
+- name: Ensure borg server user home directory exists
+  ansible.builtin.file:
+    path: "{{ borg_server_user_home }}"
+    state: directory
+    owner: "{{ borg_server_user }}"
+    group: "{{ borg_server_user }}"
+    mode: "0700"
+  become: true
+  delegate_to: "{{ borg_server_host }}"
+
+- name: Ensure .ssh directory exists
+  ansible.builtin.file:
+    path: "{{ borg_server_user_home }}/.ssh"
+    state: directory
+    owner: "{{ borg_server_user }}"
+    group: "{{ borg_server_user }}"
+    mode: "0700"
+  become: true
+  delegate_to: "{{ borg_server_host }}"
+
+- name: Ensure authorized_keys file exists
+  ansible.builtin.file:
+    path: "{{ borg_server_user_home }}/.ssh/authorized_keys"
+    state: touch
+    owner: "{{ borg_server_user }}"
+    group: "{{ borg_server_user }}"
+    mode: "0600"
+    access_time: preserve
+    modification_time: preserve
   become: true
   delegate_to: "{{ borg_server_host }}"
-- 
cgit v1.2.3