From 277900b6ba774f6a0f1a7f7dcf07519a99033ae4 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 18 Dec 2025 16:11:08 +0300 Subject: [PATCH 1/4] add borg_server role --- roles/borg_server/README.md | 35 +++++++++++ roles/borg_server/defaults/main.yml | 2 + roles/borg_server/handlers/main.yml | 1 + roles/borg_server/meta/main.yml | 17 +++++ .../borg_server/molecule/default/converge.yml | 7 +++ .../borg_server/molecule/default/molecule.yml | 27 ++++++++ .../borg_server/molecule/default/secrets.yaml | 6 ++ roles/borg_server/molecule/default/verify.yml | 11 ++++ roles/borg_server/tasks/main.yml | 62 +++++++++++++++++++ roles/borg_server/vars/main.yml | 1 + 10 files changed, 169 insertions(+) create mode 100644 roles/borg_server/README.md create mode 100644 roles/borg_server/defaults/main.yml create mode 100644 roles/borg_server/handlers/main.yml create mode 100644 roles/borg_server/meta/main.yml create mode 100644 roles/borg_server/molecule/default/converge.yml create mode 100644 roles/borg_server/molecule/default/molecule.yml create mode 100644 roles/borg_server/molecule/default/secrets.yaml create mode 100644 roles/borg_server/molecule/default/verify.yml create mode 100644 roles/borg_server/tasks/main.yml create mode 100644 roles/borg_server/vars/main.yml diff --git a/roles/borg_server/README.md b/roles/borg_server/README.md new file mode 100644 index 0000000..666bdb7 --- /dev/null +++ b/roles/borg_server/README.md @@ -0,0 +1,35 @@ +ansible_borg_server +========= + +An Ansible role to set up Borg repository(-ies) + +Requirements +------------ + +Role Variables +-------------- + +None + +Dependencies +------------ + +None + +Example Playbook +---------------- + +```yaml +roles: + - role: genlab.template +``` + +License +------- + +BSD + +Author Information +------------------ + +corvus-migratorius@proton.me diff --git a/roles/borg_server/defaults/main.yml b/roles/borg_server/defaults/main.yml new file mode 100644 index 0000000..c0ca809 --- /dev/null +++ b/roles/borg_server/defaults/main.yml @@ -0,0 +1,2 @@ +--- +hide_logs: true diff --git a/roles/borg_server/handlers/main.yml b/roles/borg_server/handlers/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/borg_server/handlers/main.yml @@ -0,0 +1 @@ +--- diff --git a/roles/borg_server/meta/main.yml b/roles/borg_server/meta/main.yml new file mode 100644 index 0000000..ed35ff2 --- /dev/null +++ b/roles/borg_server/meta/main.yml @@ -0,0 +1,17 @@ +--- +galaxy_info: + role_name: "ansible_borg_server" + namespace: genlab + author: "Alexander Gorelyshev" + company: "Genlab, LLC" + description: "Set up Borg repository(-ies) " + license: "MIT" + min_ansible_version: "2.1" + + platforms: + - name: "Ubuntu" + versions: [ "focal", "jammy" ] + + galaxy_tags: [ ] + +dependencies: [] diff --git a/roles/borg_server/molecule/default/converge.yml b/roles/borg_server/molecule/default/converge.yml new file mode 100644 index 0000000..660e2c2 --- /dev/null +++ b/roles/borg_server/molecule/default/converge.yml @@ -0,0 +1,7 @@ +--- +- name: Converge + hosts: all + roles: + - role: genlab.common.ansible_borg_server + borg_secrets_path: "secrets.yaml" + hide_logs: false diff --git a/roles/borg_server/molecule/default/molecule.yml b/roles/borg_server/molecule/default/molecule.yml new file mode 100644 index 0000000..fd2f06d --- /dev/null +++ b/roles/borg_server/molecule/default/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +driver: + name: docker + +platforms: + - name: ubuntu + image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu2204}-ansible:latest + pre_build_image: true + command: ${MOLECULE_DOCKER_COMMAND:-""} + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + cgroupns_mode: host + privileged: true + +provisioner: + name: ansible + +verifier: + name: ansible + +lint: | + set -e + yamllint . + ansible-lint . diff --git a/roles/borg_server/molecule/default/secrets.yaml b/roles/borg_server/molecule/default/secrets.yaml new file mode 100644 index 0000000..a9bf568 --- /dev/null +++ b/roles/borg_server/molecule/default/secrets.yaml @@ -0,0 +1,6 @@ +--- +borg_repo_root: /storage/backups +borg_repos: + - name: test-server + user: borg_test + ssh_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE8EIHdDtrDnK92G/9rOEPujKPha3E0g7VGWdAWYLnqj borg_test@test-server \ No newline at end of file diff --git a/roles/borg_server/molecule/default/verify.yml b/roles/borg_server/molecule/default/verify.yml new file mode 100644 index 0000000..21a9d83 --- /dev/null +++ b/roles/borg_server/molecule/default/verify.yml @@ -0,0 +1,11 @@ +--- +- name: Verify + hosts: all + gather_facts: false + any_errors_fatal: true + + tasks: + - name: "Check if `borg` is available from PATH" # noqa: no-changed-when + register: br_test__borg_version + ansible.builtin.command: + cmd: "borg --version" diff --git a/roles/borg_server/tasks/main.yml b/roles/borg_server/tasks/main.yml new file mode 100644 index 0000000..fd734be --- /dev/null +++ b/roles/borg_server/tasks/main.yml @@ -0,0 +1,62 @@ +--- +- name: "Read secret variables" + ansible.builtin.include_vars: + file: "{{ borg_secrets_path }}" # `borg_secrets` + +- name: "Install packages" + ansible.builtin.package: + name: + - borgbackup + - openssh-server + state: present + update_cache: true + +- name: "Create a group for borgs" + ansible.builtin.group: + name: borgs + state: present + +- name: "Create Borg users" + no_log: "{{ hide_logs }}" + loop: "{{ borg_repos }}" + ansible.builtin.user: + name: "{{ item.user }}" + comment: "Borg agent" + state: "present" + create_home: true + shell: "/bin/bash" + generate_ssh_key: true + groups: [ borgs ] + append: true + +- name: "Configure SSH authorized keys for Borg users" + no_log: "{{ hide_logs }}" + loop: "{{ borg_repos }}" + ansible.builtin.lineinfile: + path: /home/{{ item.user }}/.ssh/authorized_keys + create: true + owner: "{{ item.user }}" + group: "{{ item.user }}" + mode: "0600" + regexp: '^restrict,command="borg serve --append-only --restrict-to-repository' + line: > + restrict,command="borg serve --append-only --restrict-to-repository {{ borg_repo_root }}/{{ item.name }}" + {{ item.ssh_key }} + +- name: "Create a root folder for backups" + ansible.builtin.file: + path: "{{ borg_repo_root }}" + state: "directory" + owner: "root" + group: "borgs" + mode: "0770" + +- name: "Create repository folders" + no_log: "{{ hide_logs }}" + loop: "{{ borg_repos }}" + ansible.builtin.file: + path: "{{ borg_repo_root }}/{{ item.name }}" + state: "directory" + owner: "{{ item.user }}" + group: "{{ item.user }}" + mode: "0770" diff --git a/roles/borg_server/vars/main.yml b/roles/borg_server/vars/main.yml new file mode 100644 index 0000000..ed97d53 --- /dev/null +++ b/roles/borg_server/vars/main.yml @@ -0,0 +1 @@ +--- From 70808bad919d0bb7ecbcc62e673fc89ee68ca6c8 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 18 Dec 2025 16:37:50 +0300 Subject: [PATCH 2/4] fix ansible-lint errors --- .ansible-lint | 4 +++- roles/borg_server/defaults/main.yml | 2 +- roles/borg_server/meta/main.yml | 6 +++--- roles/borg_server/molecule/default/converge.yml | 4 ++-- roles/borg_server/molecule/default/verify.yml | 2 +- roles/borg_server/tasks/main.yml | 8 ++++---- 6 files changed, 14 insertions(+), 12 deletions(-) diff --git a/.ansible-lint b/.ansible-lint index f7c8aa6..548eab6 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -8,5 +8,7 @@ loop_var_prefix: "^(__|{role}_)" exclude_paths: - .github/ - .ansible/ - # ansible-lint thinks it's a playbook so gives an error, but its tasks are for include_task. decided to exclude it + + # ansible-lint thinks they're playbooks so gives errors, but they're not - roles/rustdesk/molecule/default/client-binary-existance.yml + - roles/borg_server/molecule/default/secrets.yaml diff --git a/roles/borg_server/defaults/main.yml b/roles/borg_server/defaults/main.yml index c0ca809..aea7bf7 100644 --- a/roles/borg_server/defaults/main.yml +++ b/roles/borg_server/defaults/main.yml @@ -1,2 +1,2 @@ --- -hide_logs: true +borg_server_hide_logs: true diff --git a/roles/borg_server/meta/main.yml b/roles/borg_server/meta/main.yml index ed35ff2..2d9eacc 100644 --- a/roles/borg_server/meta/main.yml +++ b/roles/borg_server/meta/main.yml @@ -1,6 +1,6 @@ --- galaxy_info: - role_name: "ansible_borg_server" + role_name: "borg_server" namespace: genlab author: "Alexander Gorelyshev" company: "Genlab, LLC" @@ -10,8 +10,8 @@ galaxy_info: platforms: - name: "Ubuntu" - versions: [ "focal", "jammy" ] + versions: ["jammy", "noble"] - galaxy_tags: [ ] + galaxy_tags: [] dependencies: [] diff --git a/roles/borg_server/molecule/default/converge.yml b/roles/borg_server/molecule/default/converge.yml index 660e2c2..f525799 100644 --- a/roles/borg_server/molecule/default/converge.yml +++ b/roles/borg_server/molecule/default/converge.yml @@ -2,6 +2,6 @@ - name: Converge hosts: all roles: - - role: genlab.common.ansible_borg_server + - role: genlab.common.borg_server borg_secrets_path: "secrets.yaml" - hide_logs: false + borg_server_hide_logs: false diff --git a/roles/borg_server/molecule/default/verify.yml b/roles/borg_server/molecule/default/verify.yml index 21a9d83..ada7def 100644 --- a/roles/borg_server/molecule/default/verify.yml +++ b/roles/borg_server/molecule/default/verify.yml @@ -6,6 +6,6 @@ tasks: - name: "Check if `borg` is available from PATH" # noqa: no-changed-when - register: br_test__borg_version + register: borg_server_version ansible.builtin.command: cmd: "borg --version" diff --git a/roles/borg_server/tasks/main.yml b/roles/borg_server/tasks/main.yml index fd734be..47d75d6 100644 --- a/roles/borg_server/tasks/main.yml +++ b/roles/borg_server/tasks/main.yml @@ -17,7 +17,7 @@ state: present - name: "Create Borg users" - no_log: "{{ hide_logs }}" + no_log: "{{ borg_server_hide_logs }}" loop: "{{ borg_repos }}" ansible.builtin.user: name: "{{ item.user }}" @@ -26,11 +26,11 @@ create_home: true shell: "/bin/bash" generate_ssh_key: true - groups: [ borgs ] + groups: [borgs] append: true - name: "Configure SSH authorized keys for Borg users" - no_log: "{{ hide_logs }}" + no_log: "{{ borg_server_hide_logs }}" loop: "{{ borg_repos }}" ansible.builtin.lineinfile: path: /home/{{ item.user }}/.ssh/authorized_keys @@ -52,7 +52,7 @@ mode: "0770" - name: "Create repository folders" - no_log: "{{ hide_logs }}" + no_log: "{{ borg_server_hide_logs }}" loop: "{{ borg_repos }}" ansible.builtin.file: path: "{{ borg_repo_root }}/{{ item.name }}" From ddef86f0ecba0c6d7460e4692569473b6f028b68 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 18 Dec 2025 16:39:46 +0300 Subject: [PATCH 3/4] update meta --- roles/borg_server/README.md | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/roles/borg_server/README.md b/roles/borg_server/README.md index 666bdb7..5c30510 100644 --- a/roles/borg_server/README.md +++ b/roles/borg_server/README.md @@ -19,10 +19,7 @@ None Example Playbook ---------------- -```yaml -roles: - - role: genlab.template -``` +see [converge.yml](molecule/default/converge.yml) License ------- From aa77a400e4aa9dbc5d000a1bcfaac89eedf62591 Mon Sep 17 00:00:00 2001 From: Sergey Malyuk Date: Thu, 18 Dec 2025 16:40:27 +0300 Subject: [PATCH 4/4] update meta --- README.md | 1 + galaxy.yml | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 0b8cb84..dea81b8 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,7 @@ ## Roles - [alertmanager](roles/alertmanager/README.md) +- [borg_server](roles/borg_server/README.md) - [borgmatic](roles/borgmatic/README.md) - [curl_scheduled](roles/curl_scheduled/README.md) - [dnsmasq](roles/dnsmasq/README.md) diff --git a/galaxy.yml b/galaxy.yml index da7bc61..dff95d3 100644 --- a/galaxy.yml +++ b/galaxy.yml @@ -1,7 +1,7 @@ --- namespace: genlab name: common -version: 0.27.0 +version: 0.28.0 readme: README.md authors: - Alexander Gorelyshev (corvus-migratorius@proton.me)