---
- name: Setup - Configure SSH keys for all hosts
  hosts:
    - borg-client
    - borg-client-2
    - borg-client-multi
    - borg-client-nonroot

  vars:
    borg_server_host: borg-server

  pre_tasks:
    # This would usually be set by the user globally on their ansible
    # repository and can be a security risk to do automatically. We will
    # however set the variable here in the pre_tasks since it is for testing.
    - name: Start ssh
      ansible.builtin.systemd:
        name: sshd
        state: started
      become: true
      delegate_to: "{{ borg_server_host }}"

    - name: Fetch ssh_key
      ansible.builtin.command: >-
        ssh-keyscan -t rsa {{ borg_server_host }} | sed "s/^[^ ]* //"
      register: borg_server_ssh_keyscan
      changed_when: false

    - name: Set ssh_key
      ansible.builtin.set_fact:
        borg_server_host_ssh_key: >-
          {{ borg_server_ssh_keyscan.stdout
          | split(" ")
          | reject("search", borg_server_host)
          | join(" ") }}

    - name: Create backup user for non-root test
      ansible.builtin.user:
        name: backupuser
        home: /home/backupuser
        shell: /bin/bash
        state: present
      become: true
      when: inventory_hostname == 'borg-client-nonroot'

- name: Converge - Default borg-client
  hosts: borg-client

  roles:
    - role: kliwniloc.borgbackup
      vars:
        borg_server_host: borg-server
        borg_server_user_home: /opt/borg
        borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"
        borg_included_dirs:
          - /etc
          - /home
        borg_excluded_dirs:
          - /opt
          - /var
          - /reee reeee

- name: Converge - borg-client-2
  hosts: borg-client-2

  roles:
    - role: kliwniloc.borgbackup
      vars:
        borg_server_host: borg-server
        borg_server_user_home: /opt/borg
        borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"
        borg_ssh_key_type: ed25519
        borg_backup_service_successful_exit_status:
          - 1
          - TEMPFAIL
        borg_compression: lz4
        borg_systemd_oncalendar: "*-*-* 03:00:00"
        borg_included_dirs:
          - /etc
          - /home
        borg_excluded_dirs:
          - /opt
          - /var
          - /reee reeee

- name: Converge - Multi-instance backup (same host, different repos)
  hosts: borg-client-multi
  serial: 1

  vars:
    borg_server_host: borg-server
    borg_server_user_home: /opt/borg
    borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"

  roles:
    - role: kliwniloc.borgbackup
      vars:
        borg_repo_name: configs
        borg_backup_argument: configs
        borg_compression: zstd
        borg_included_dirs:
          - /etc
        borg_excluded_dirs: []
        borg_systemd_oncalendar: "*-*-* 02:00:00"

    - role: kliwniloc.borgbackup
      vars:
        borg_repo_name: home-data
        borg_backup_argument: home-data
        borg_compression: lz4
        borg_included_dirs:
          - /home
        borg_excluded_dirs:
          - /home/*/.cache
        borg_systemd_oncalendar: "*-*-* 04:00:00"

- name: Converge - Non-root backup user
  hosts: borg-client-nonroot

  roles:
    - role: kliwniloc.borgbackup
      vars:
        borg_server_host: borg-server
        borg_server_user_home: /opt/borg
        borg_client_user: backupuser
        borg_decryption_keys_yaml_path: "{{ playbook_dir }}/decryption_keys.yml"
        borg_included_dirs:
          - /etc
        borg_excluded_dirs: []