---
- name: "✅ Ensure backup home directory exists"
ansible.builtin.file:
path: "{{ USER_BACKUP_HOME }}"
state: directory
owner: backup
group: backup
mode: "0700"
- name: "📁 create {{ USER_BACKUP_WRAPPER_DST }}"
ansible.builtin.template: # nocheck: stack-host-template (per-host backup user wrapper, lives in backup home on every backed-up host)
src: "ssh-wrapper.sh.j2"
dest: "{{ USER_BACKUP_WRAPPER_DST }}"
owner: backup
group: backup
mode: "0700"
- name: "✏️ Write authorized_keys for 'backup' via shared user role (wrapped)"
ansible.builtin.include_role:
name: user
vars:
user_key: "backup"
user_config: >-
{{
lookup('users', 'backup', {})
| combine(
{
'authorized_keys': (
lookup('users', 'backup', {}).authorized_keys
| default([])
| map('regex_replace', '^', 'command="' ~ USER_BACKUP_WRAPPER_DST ~ '" ')
| list
)
},
recursive=True
)
}}
