# Changelog

All notable changes to this project will be documented in this file.

## [Unreleased]

<!-- TODO: High level overview of new major release -->

### Breaking Changes

#### Decryption keys file format changed

**Am I affected?**
You have a `decryption_keys.yml` file with entries from previous versions.

**What changed?**
Keys now include the repository name to support multiple repos per host.

Old format:

```yaml
my-host: BORG_KEY_abc123...
```

New format:

```yaml
my-host_repo-name: BORG_KEY_abc123...
```

Generally a harmless change, just leads to duplicate keys with old and new
format.

**Migration:**

1. Run the role with the new version (new keys created automatically)
2. Verify backups work correctly
3. Remove old hostname-only entries from `decryption_keys.yml`

---

#### Backup script block markers changed

**Am I affected?**
Yes.

**What changed?**
Block markers in the backup script now include repository name to support
multiple repos per host.

Old:

```bash
## BEGIN ANSIBLE MANAGED BLOCK for server: backup-server
```

New:

```bash
## BEGIN ANSIBLE MANAGED BLOCK for backup-server/my-repo
```

**Migration:**

<!-- TODO: We want to auto-migrate this -->

Delete the script and re-run the role:

```bash
rm /usr/local/bin/run_borg_backup
# Then run your playbook
```

---

#### Default backup argument

**Am I affected?**
You are using the default value of `borg_backup_argument`.

**What will change?**
Default will change from `{{ borg_server_host_url }}` to
`{{ borg_server_host_url }}-{{ borg_repo_name }}`.

**Migration:**

<!-- TODO: Consider if we want to migrate this automatically aswell -->

Systemd unit names will change. Manually migrate:

```bash
# Stop old units
systemctl stop borg_backup@OLD-VALUE.timer
systemctl disable borg_backup@OLD-VALUE.timer

# Run role to create new units
# Then enable new units
systemctl enable borg_backup@NEW-VALUE.timer
systemctl start borg_backup@NEW-VALUE.timer
```

### Added

- Multi-instance backup support (multiple repositories per client host)
- Non-root backup user support via `borg_client_user` variable
- Configurable SSH key type (`borg_ssh_key_type`) with support for
  ed25519, rsa, and ecdsa
- Per-repo SSH key support (`borg_ssh_key_per_repo`) for independent keys per repository
- Storage quota support (`borg_storage_quota`) to limit repository size on server
- Comprehensive test suite including disaster recovery scenarios
- Negative security tests for cross-host repository isolation
- Appendix-only repository mode (`borg_mode_append_only`)