Mirrors/ansible-role-borg-backup
1
0
Fork 0
mirror of https://github.com/borgbase/ansible-role-borgbackup.git synced 2024-12-21 19:09:37 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add user flag for decision

Browse Source
This commit is contained in:
Fabian Hausmann 2024-11-26 13:02:57 +01:00
parent 7f36d0aee4
commit abc50afac1
3 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
defaults/main.yml
View File

@ -48,4 +48,5 @@ borg_user: "root"
borg_group: "root" borg_group: "root"
backup_user_info: backup_user_info:
home: "/home/{{ borg_user }}" home: "/home/{{ borg_user }}"
borgmatic_run_as_root: false
... ...

4
meta/argument_specs.yml
View File

@ -192,3 +192,7 @@ argument_specs:
type: str type: str
required: false required: false
description: Name of the SSH public and private key description: Name of the SSH public and private key
borgmatic_run_as_root:
type: bool
required: false
description: If the variable is set, systemd will run borgmatic using sudo.

4
templates/borgmatic.service.j2
View File

@ -12,7 +12,7 @@ ConditionACPower=true
[Service] [Service]
Type=oneshot Type=oneshot
User={{ borg_user }} User={{ borg_user }}
ExecStart={{ 'sudo ' if borg_user != 'root'}}borgmatic -c /etc/borgmatic/{{ borgmatic_config_name }} ExecStart={{ 'sudo ' if borgmatic_run_as_root}}borgmatic -c /etc/borgmatic/{{ borgmatic_config_name }}
# Source: https://projects.torsion.org/borgmatic-collective/borgmatic/raw/branch/master/sample/systemd/borgmatic.service # Source: https://projects.torsion.org/borgmatic-collective/borgmatic/raw/branch/master/sample/systemd/borgmatic.service
# Security settings for systemd running as root, optional but recommended to improve security. You # Security settings for systemd running as root, optional but recommended to improve security. You
@ -22,7 +22,7 @@ LockPersonality=true
# Certain borgmatic features like Healthchecks integration need MemoryDenyWriteExecute to be off. # Certain borgmatic features like Healthchecks integration need MemoryDenyWriteExecute to be off.
# But you can try setting it to "yes" for improved security if you don't use those features. # But you can try setting it to "yes" for improved security if you don't use those features.
MemoryDenyWriteExecute=no MemoryDenyWriteExecute=no
NoNewPrivileges={{ 'no' if borg_user != 'root' else 'yes'}} NoNewPrivileges={{ 'no' if borgmatic_run_as_root else 'yes'}}
PrivateDevices=yes PrivateDevices=yes
PrivateTmp=yes PrivateTmp=yes
ProtectClock=yes ProtectClock=yes