From 7d96c1a11fc442b4efddf9ce5250cf0a9dfaf02e Mon Sep 17 00:00:00 2001
From: Colin Wilk <colin@wilk.cx>
Date: Sun, 28 Jun 2026 22:47:11 +0200
Subject: Parametrize server-side borg user

Adds option to choose a non-default borg backup user on the server.
---
 tasks/client_create_scripts_each.yml |  2 +-
 tasks/client_setup.yml               |  8 ++---
 tasks/server_setup.yml               | 64 ++++++++++++++++++++++++++++++++----
 3 files changed, 62 insertions(+), 12 deletions(-)

(limited to 'tasks')

diff --git a/tasks/client_create_scripts_each.yml b/tasks/client_create_scripts_each.yml
index a9c5c31..e185013 100644
--- a/tasks/client_create_scripts_each.yml
+++ b/tasks/client_create_scripts_each.yml
@@ -28,7 +28,7 @@
       export BORG_RSH="ssh -i {{ borg_ssh_key_path }}"
       {% endif %}
       borg create -C {{ borg_compression }} \
-      borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}::{{ borg_backup_name_format }} \
+      {{ borg_server_user }}@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}::{{ borg_backup_name_format }} \
       {{ borg_included_dirs | map('quote') | join(' ') }} \
       {% for e in (borg_excluded_dirs | map('quote')) %} --exclude {{ e }} {% endfor %}
   become: true
diff --git a/tasks/client_setup.yml b/tasks/client_setup.yml
index 71027c3..fc32e03 100644
--- a/tasks/client_setup.yml
+++ b/tasks/client_setup.yml
@@ -77,8 +77,8 @@
   ansible.builtin.file:
     path: "{{ borg_server_user_home }}/.ssh/authorized_keys"
     state: touch
-    owner: borg
-    group: borg
+    owner: "{{ borg_server_user }}"
+    group: "{{ borg_server_user }}"
     mode: "0600"
     access_time: preserve
     modification_time: preserve
@@ -161,7 +161,7 @@
 - name: Initialise Borg repository
   ansible.builtin.command: >
     borg init --encryption=repokey
-    borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
+    {{ borg_server_user }}@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
   environment:
     BORG_PASSPHRASE: "{{ borg_passphrase }}"
     BORG_RSH: "{{ ('ssh -i ' ~ borg_ssh_key_path) if borg_ssh_key_per_repo else omit }}"
@@ -202,7 +202,7 @@
         - name: If host new read encryption keys
           ansible.builtin.command: >
             borg key export --paper
-            borg@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
+            {{ borg_server_user }}@{{ borg_server_host_url }}:{{ borg_server_user_home }}/{{ borg_repo_name }}
           environment:
             BORG_RSH: "{{ ('ssh -i ' ~ borg_ssh_key_path) if borg_ssh_key_per_repo else omit }}"
           become: true
diff --git a/tasks/server_setup.yml b/tasks/server_setup.yml
index e47d012..66b92bd 100644
--- a/tasks/server_setup.yml
+++ b/tasks/server_setup.yml
@@ -1,10 +1,60 @@
 ---
-- name: Create borg user
-  ansible.builtin.user:
-    name: borg
-    comment: Borgbackup user
-    create_home: true
-    home: "{{ borg_server_user_home }}"
-    generate_ssh_key: true
+- name: Create borg_server_user on server
+  when: borg_server_user_create
+  block:
+    - name: Create borg user
+      ansible.builtin.user:
+        name: "{{ borg_server_user }}"
+        comment: Borgbackup user
+        create_home: true
+        home: "{{ borg_server_user_home }}"
+        generate_ssh_key: false
+      become: true
+      delegate_to: "{{ borg_server_host }}"
+
+- name: Ensure borg_server_user exists
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ borg_server_user }}"
+  become: true
+  delegate_to: "{{ borg_server_host }}"
+
+- name: Fail if borg_server_user does not exist
+  ansible.builtin.fail:
+    msg: |
+      User {{ borg_server_user }} does not exist on {{ borg_server_host }}.
+      Please create the user before running this role or set borg_server_user_create: true.
+  when: getent_passwd[borg_server_user] is not defined
+  delegate_to: "{{ borg_server_host }}"
+
+- name: Ensure borg server user home directory exists
+  ansible.builtin.file:
+    path: "{{ borg_server_user_home }}"
+    state: directory
+    owner: "{{ borg_server_user }}"
+    group: "{{ borg_server_user }}"
+    mode: "0700"
+  become: true
+  delegate_to: "{{ borg_server_host }}"
+
+- name: Ensure .ssh directory exists
+  ansible.builtin.file:
+    path: "{{ borg_server_user_home }}/.ssh"
+    state: directory
+    owner: "{{ borg_server_user }}"
+    group: "{{ borg_server_user }}"
+    mode: "0700"
+  become: true
+  delegate_to: "{{ borg_server_host }}"
+
+- name: Ensure authorized_keys file exists
+  ansible.builtin.file:
+    path: "{{ borg_server_user_home }}/.ssh/authorized_keys"
+    state: touch
+    owner: "{{ borg_server_user }}"
+    group: "{{ borg_server_user }}"
+    mode: "0600"
+    access_time: preserve
+    modification_time: preserve
   become: true
   delegate_to: "{{ borg_server_host }}"
-- 
cgit v1.2.3