02_permissions_folders.yml

---
- name: 📦 Install ACL utilities
  package_install: # nocheck: package-install only the permissions step this file is included for needs setfacl
    id: acl

- name: ✅ Ensure backups root exists and owned by backup
  file:
    path: "{{ DIR_BACKUPS }}"
    state: directory
    owner: backup
    group: backup
    mode: "0700"

- name: 🔎 Detect the filesystem backing the backups root
  ansible.builtin.command:
    cmd: "findmnt -n -o FSTYPE --target {{ DIR_BACKUPS }}"
  register: _backups_fstype
  changed_when: false

- name: 🔎 Probe whether that filesystem serves POSIX ACLs
  ansible.builtin.command:
    cmd: "setfacl -m user:backup:rwx {{ DIR_BACKUPS }}"
  register: _backups_acl_probe
  changed_when: false
  failed_when: false

- name: "🔐 Apply POSIX ACLs on {{ _backups_fstype.stdout | trim }}"
  ansible.builtin.include_tasks: 02_permissions_folders/acl.yml
  when: _backups_acl_probe.rc == 0

- name: 📁 Fix ownership level 0..2 directories to backup:backup
  ansible.builtin.shell: >
    find "{{ DIR_BACKUPS }}" -mindepth 0 -maxdepth 2 -xdev -type d -exec chown backup:backup {} +
  changed_when: false

- name: 📁 Fix perms level 0..2 directories to 0700
  ansible.builtin.shell: >
    find "{{ DIR_BACKUPS }}" -mindepth 0 -maxdepth 2 -xdev -type d -exec chmod 700 {} +
  changed_when: false