add borgmatic role

roles/borgmatic/tasks/config.yml

@@ -0,0 +1,34 @@
+---
+- name: "Compose basic configuration for Borgmatic"
+  ansible.builtin.set_fact:
+    borgmatic_composite_config:
+      source_directories: "{{ borg_source_directories }}"
+      repositories:
+        - path: "{{ borg_repo_path }}"
+          label: "{{ borg_repo_label }}"
+      encryption_passphrase: "{{ borg_encryption_passphrase }}"
+      compression: "{{ borg_compression }}"
+      # CLI output configuration
+      list_details: true
+      statistics: true
+      exclude_caches: true
+      # logging verbosity:
+      verbosity: 1
+      syslog_verbosity: 1
+      monitoring_verbosity: 1
+      # backup depth
+      keep_hourly: "{{ borg_keep_hourly }}"
+      keep_daily: "{{ borg_keep_daily }}"
+      keep_weekly: "{{ borg_keep_weekly }}"
+      keep_monthly: "{{ borg_keep_monthly }}"
+      keep_yearly: "{{ borg_keep_yearly }}"
+
+- name: "Add Uptime Kuma configuration"
+  when: borg_uptime_kuma
+  ansible.builtin.set_fact:
+    borgmatic_composite_config: "{{ borgmatic_composite_config | combine({'uptime_kuma': borg_uptime_kuma}) }}"
+
+- name: "Add Loki configuration"
+  when: borg_loki
+  ansible.builtin.set_fact:
+    borgmatic_composite_config: "{{ borgmatic_composite_config | combine({'loki': borg_loki}) }}"

roles/borgmatic/tasks/handle-ssh-keys.yml

@@ -0,0 +1,25 @@
+---
+- name: "Ensure the path for SSH keys exists"
+  ansible.builtin.file:
+    path: "{{ ssh_key_path | dirname }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+
+- name: "Generate an ed25519 SSH key pair with 100 KDF rounds"
+  register: ssh_key_pair
+  community.crypto.openssh_keypair:
+    type: ed25519
+    path: "{{ ssh_key_path }}"
+    comment: "Generated by Ansible for Borgmatic"
+    force: false
+    mode: '0600'
+
+- name: "Push the SSH key pair to the Borg repo host"
+  when: push_pubkey
+  delegate_to: "{{ repo_server_inventory_hostname }}"
+  ansible.posix.authorized_key:
+    user: "{{ repo_server_user }}"
+    key: "{{ ssh_key_pair.public_key }}"
+    state: present

roles/borgmatic/tasks/install.yml

@@ -0,0 +1,66 @@
+---
+- name: "Ensure that system dependencies are installed"
+  ansible.builtin.apt:
+    name:
+      - openssh-client
+      - python3-pip
+      - python3-venv
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: "Install pipx"
+  retries: 3
+  delay: 1
+  ansible.builtin.pip:
+    name: "pipx=={{ pipx_version }}"
+    executable: pip3
+    break_system_packages: true
+
+- name: "Ensure pipx binary is available in PATH"
+  changed_when: false
+  ansible.builtin.command:
+    cmd: pipx ensurepath
+
+- name: "Install borgmatic via pipx"
+  retries: 3
+  delay: 1
+  environment:
+    PIPX_BIN_DIR: "{{ borgmatic_pipx_bin_dir }}"
+  community.general.pipx:
+    name: borgmatic
+    state: present
+    install_deps: true
+
+- name: "Install Borg if the correct version is not available"
+  block:
+    # we are looking for Borg installed in a directory that Max Hoesel's role exects to find it
+    - name: "Get the currently installed version of Borg"
+      changed_when: false
+      register: borg_version_installed
+      ansible.builtin.command:
+        cmd: /usr/bin/borg --version
+
+    - name: "Check that the correct version of Borg is installed"
+      ansible.builtin.assert:
+        that: borg_version_installed.stdout.find(borg_version)
+        fail_msg: "The expected Borg version was not found: {{ borg_version_installed }}"
+        success_msg: "Found the expected Borg version ({{ borg_version }})"
+
+  rescue:
+    - name: "Download Borg from a custom URL: '{{ borg_binary_url }}'"
+      retries: 3
+      delay: 1
+      ansible.builtin.unarchive:
+        src: "{{ borg_binary_url }}"
+        dest: "/opt/"
+        remote_src: true
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: "Create a symbolic link for Borg"
+      ansible.builtin.file:
+        state: link
+        src: "/opt/borg-dir/borg.exe"
+        dest: "/usr/bin/borg"

roles/borgmatic/tasks/integrations.yml

@@ -0,0 +1 @@
+---

roles/borgmatic/tasks/main.yml

@@ -0,0 +1,15 @@
+---
+- name: "Include tool installation tasks"
+  ansible.builtin.include_tasks: "install.yml"
+
+- name: "Include SSH key handling tasks"
+  ansible.builtin.include_tasks: "handle-ssh-keys.yml"
+
+- name: "Include configuration tasks"
+  ansible.builtin.include_tasks: "config.yml"
+
+- name: "Include tasks for third-party integrations"
+  ansible.builtin.include_tasks: "integrations.yml"
+
+- name: "Include tasks for running borgmatic"
+  ansible.builtin.include_tasks: "run.yml"

roles/borgmatic/tasks/run.yml

@@ -0,0 +1,22 @@
+---
+# A workaround for maxhoesel.borgbackup.borgmatic that does not support custom paths
+- name: "Create symbolic links for Borgmatic executables"
+  loop:
+    - borgmatic
+    - generate-borgmatic-config
+    - validate-borgmatic-config
+  ansible.builtin.file:
+    state: link
+    src: "{{ borgmatic_pipx_bin_dir }}/{{ item }}"
+    dest: /usr/bin/{{ item }}
+
+- name: "Configure and run Borgmatic"
+  ansible.builtin.include_role:
+    name: maxhoesel.borgbackup.borgmatic
+  vars:
+    borgmatic_install: false  # we handle installation separately to get the recent version
+    # borgmatic_ssh_key_gen_options: "-t ed25519 -a 100"
+    borgmatic_ssh_key_path: "{{ ssh_key_path }}"
+    borgmatic_schedule_on: "{{ borgmatic_schedule_oncalendar }}"
+    borgmatic_schedule_max_random_delay: 600
+    borgmatic_config: "{{ borgmatic_composite_config }}"