Merge pull request #53 from corvus-migratorius/role-borg-server

add borg_server role

.ansible-lint

@@ -8,5 +8,7 @@ loop_var_prefix: "^(__|{role}_)"
 exclude_paths:
   - .github/
   - .ansible/
-  # ansible-lint thinks it's a playbook so gives an error, but its tasks are for include_task. decided to exclude it
+
+  # ansible-lint thinks they're playbooks so gives errors, but they're not
   - roles/rustdesk/molecule/default/client-binary-existance.yml
+  - roles/borg_server/molecule/default/secrets.yaml

README.md

@@ -6,6 +6,7 @@
 ## Roles
 
 - [alertmanager](roles/alertmanager/README.md)
+- [borg_server](roles/borg_server/README.md)
 - [borgmatic](roles/borgmatic/README.md)
 - [curl_scheduled](roles/curl_scheduled/README.md)
 - [dnsmasq](roles/dnsmasq/README.md)

galaxy.yml

@@ -1,7 +1,7 @@
 ---
 namespace: genlab
 name: common
-version: 0.27.0
+version: 0.28.0
 readme: README.md
 authors:
   - Alexander Gorelyshev (corvus-migratorius@proton.me)

roles/borg_server/README.md

@@ -0,0 +1,32 @@
+ansible_borg_server
+=========
+
+An Ansible role to set up Borg repository(-ies) 
+
+Requirements
+------------
+
+Role Variables
+--------------
+
+None
+
+Dependencies
+------------
+
+None
+
+Example Playbook
+----------------
+
+see [converge.yml](molecule/default/converge.yml)
+
+License
+-------
+
+BSD
+
+Author Information
+------------------
+
+corvus-migratorius@proton.me

roles/borg_server/defaults/main.yml

@@ -0,0 +1,2 @@
+---
+borg_server_hide_logs: true

roles/borg_server/handlers/main.yml

@@ -0,0 +1 @@
+---

roles/borg_server/meta/main.yml

@@ -0,0 +1,17 @@
+---
+galaxy_info:
+  role_name: "borg_server"
+  namespace: genlab
+  author: "Alexander Gorelyshev"
+  company: "Genlab, LLC"
+  description: "Set up Borg repository(-ies) "
+  license: "MIT"
+  min_ansible_version: "2.1"
+
+  platforms:
+    - name: "Ubuntu"
+      versions: ["jammy", "noble"]
+
+  galaxy_tags: []
+
+dependencies: []

roles/borg_server/molecule/default/converge.yml

@@ -0,0 +1,7 @@
+---
+- name: Converge
+  hosts: all
+  roles:
+    - role: genlab.common.borg_server
+      borg_secrets_path: "secrets.yaml"
+      borg_server_hide_logs: false

roles/borg_server/molecule/default/molecule.yml

@@ -0,0 +1,27 @@
+---
+dependency:
+  name: galaxy
+
+driver:
+  name: docker
+
+platforms:
+  - name: ubuntu
+    image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2204}-ansible:latest
+    pre_build_image: true
+    command: ${MOLECULE_DOCKER_COMMAND:-""}
+    volumes:
+      - /sys/fs/cgroup:/sys/fs/cgroup:rw
+    cgroupns_mode: host
+    privileged: true
+
+provisioner:
+  name: ansible
+
+verifier:
+  name: ansible
+
+lint: |
+  set -e
+  yamllint .
+  ansible-lint .

roles/borg_server/molecule/default/secrets.yaml

@@ -0,0 +1,6 @@
+---
+borg_repo_root: /storage/backups
+borg_repos:
+  - name: test-server
+    user: borg_test
+    ssh_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE8EIHdDtrDnK92G/9rOEPujKPha3E0g7VGWdAWYLnqj borg_test@test-server

roles/borg_server/molecule/default/verify.yml

@@ -0,0 +1,11 @@
+---
+- name: Verify
+  hosts: all
+  gather_facts: false
+  any_errors_fatal: true
+
+  tasks:
+    - name: "Check if `borg` is available from PATH"  # noqa: no-changed-when
+      register: borg_server_version
+      ansible.builtin.command:
+        cmd: "borg --version"

roles/borg_server/tasks/main.yml

@@ -0,0 +1,62 @@
+---
+- name: "Read secret variables"
+  ansible.builtin.include_vars:
+    file: "{{ borg_secrets_path }}"  # `borg_secrets`
+
+- name: "Install packages"
+  ansible.builtin.package:
+    name:
+      - borgbackup
+      - openssh-server
+    state: present
+    update_cache: true
+
+- name: "Create a group for borgs"
+  ansible.builtin.group:
+    name: borgs
+    state: present
+
+- name: "Create Borg users"
+  no_log: "{{ borg_server_hide_logs }}"
+  loop: "{{ borg_repos }}"
+  ansible.builtin.user:
+    name: "{{ item.user }}"
+    comment: "Borg agent"
+    state: "present"
+    create_home: true
+    shell: "/bin/bash"
+    generate_ssh_key: true
+    groups: [borgs]
+    append: true
+
+- name: "Configure SSH authorized keys for Borg users"
+  no_log: "{{ borg_server_hide_logs }}"
+  loop: "{{ borg_repos }}"
+  ansible.builtin.lineinfile:
+    path: /home/{{ item.user }}/.ssh/authorized_keys
+    create: true
+    owner: "{{ item.user }}"
+    group: "{{ item.user }}"
+    mode: "0600"
+    regexp: '^restrict,command="borg serve --append-only --restrict-to-repository'
+    line: >
+      restrict,command="borg serve --append-only --restrict-to-repository {{ borg_repo_root }}/{{ item.name }}"
+      {{ item.ssh_key }}
+
+- name: "Create a root folder for backups"
+  ansible.builtin.file:
+    path: "{{ borg_repo_root }}"
+    state: "directory"
+    owner: "root"
+    group: "borgs"
+    mode: "0770"
+
+- name: "Create repository folders"
+  no_log: "{{ borg_server_hide_logs }}"
+  loop: "{{ borg_repos }}"
+  ansible.builtin.file:
+    path: "{{ borg_repo_root }}/{{ item.name }}"
+    state: "directory"
+    owner: "{{ item.user }}"
+    group: "{{ item.user }}"
+    mode: "0770"

roles/borg_server/vars/main.yml

@@ -0,0 +1 @@
+---