add option borgmatic_unknown_unencrypted_repo_access_is_ok

Signed-off-by: Nish_ <120EE0980@nitrkl.ac.in>

EXAMPLES.md

@@ -10,6 +10,7 @@
     borg_repository: ssh://m5vz9gp4@m5vz9gp4.repo.borgbase.com/./repo
     borgmatic_timer: systemd
     borg_ssh_key_name: id_backup
+    borg_ssh_key_comment: backup key
     borg_ssh_command: "ssh -i {{ borg_ssh_key_file_path }} -o StrictHostKeyChecking=accept-new"
     borg_user: backupuser
     borg_group: backupuser

README.md

@@ -1,6 +1,6 @@
 # Ansible Role: BorgBackup Client
 
-[![Test](https://github.com/borgbase/ansible-role-borgbackup/actions/workflows/main.yml/badge.svg)](https://github.com/borgbase/ansible-role-borgbackup/actions/workflows/main.yml) [![Ansible Galaxy](https://img.shields.io/ansible/role/48519)](https://galaxy.ansible.com/borgbase/ansible_role_borgbackup)
+[![Test](https://github.com/borgbase/ansible-role-borgbackup/actions/workflows/main.yml/badge.svg)](https://github.com/borgbase/ansible-role-borgbackup/actions/workflows/main.yml) [![Ansible Galaxy](https://img.shields.io/ansible/role/d/borgbase/ansible_role_borgbackup?logo=ansible&color=5cbec1&label=Ansible%20Galaxy)](https://galaxy.ansible.com/ui/standalone/roles/borgbase/ansible_role_borgbackup/)
 
 Set up encrypted, compressed and deduplicated backups using [BorgBackup](https://borgbackup.readthedocs.io/en/stable/) and [Borgmatic](https://github.com/witten/borgmatic). Currently supports Debian/Ubuntu, CentOS/Red Hat/Fedora, Archlinux and Manjaro.
 
@@ -19,14 +19,16 @@ Works great with [BorgBase.com](https://www.borgbase.com) - Simple and Secure Ho
   Systemd timers, be sure to remove the Cron job in `/etc/cron.d/borgmatic` first.
   The role will also alert you when trying to use both timers.
 
-## Example playbook with root as backup user and Cron timer
+## Example playbook with root as backup user, using the distro package and Cron timer
 
 ```
 - hosts: all
   roles:
   - role: borgbase.ansible_role_borgbackup
+    borg_install_method: package
     borg_encryption_passphrase: CHANGEME
-    borg_repository: ssh://xxxxxx@xxxxxx.repo.borgbase.com/./repo
+    borg_repository:
+      - ssh://xxxxxx@xxxxxx.repo.borgbase.com/./repo
     borg_source_directories:
       - /var/www
     borgmatic_hooks:
@@ -86,7 +88,7 @@ $ git clone https://github.com/borgbase/ansible-role-borgbackup.git roles/ansibl
 - `borg_encryption_passphrase`: Password to use for repokey or keyfile. Empty if repo is unencrypted.
 - `borg_exclude_from`: Read exclude patterns from one or more separate named files, one pattern per line.
 - `borg_exclude_patterns`: Paths or patterns to exclude from backup. See [official documentation](https://borgbackup.readthedocs.io/en/stable/usage/help.html#borg-help-patterns) for more.
-- `borg_install_method`: By default `pip` is used to install borgmatic. To install via your distributions package manager set this to `package` and (if needed) overwrite the `borg_distro_packages` variable to contain your distributions package names required to install borgmatic. Note that many distributions ship outdated versions of borgbackup and borgmatic; use at your own risk.
+- `borg_install_method`: By default `pip` is used to install borgmatic. To install via your distributions package manager set this to `package` and (if needed) overwrite the `borg_distro_packages` variable to contain your distributions package names required to install borgmatic. Note that many distributions ship outdated versions of borgbackup and borgmatic; use at your own risk. `none` completely disables installation management.
 - `borg_require_epel`: When using `borg_install_method: package` on RHEL-based distributions, the EPEL repo is required. To disable the check (e.g. when using a custom mirror instead of the `epel-release` package), set this to `false`. Defaults to `{{ ansible_os_family == 'RedHat' and ansible_distribution != 'Fedora' }}` (i.e. `true` on Enterprise Linux-based distros).
 - `borg_lock_wait_time`: Config maximum seconds to wait for acquiring a repository/cache lock. Defaults to 5 seconds.
 - `borg_one_file_system`: Don't cross file-system boundaries. Defaults to `true`
@@ -98,6 +100,7 @@ $ git clone https://github.com/borgbase/ansible-role-borgbackup.git roles/ansibl
 - `borg_ssh_key_name`: Name of the SSH public and pivate key. Default `id_ed25519`
 - `borg_ssh_key_file_path`: SSH-key to be used. Default `~/.ssh/{{ borg_ssh_key_name }}`
 - `borg_ssh_key_type`: The algorithm used to generate the SSH private key. Choose: `rsa`, `dsa`, `rsa1`, `ecdsa`, `ed25519`. Default: `ed25519`
+- `borg_ssh_key_comment`: Comment added to the SSH public key.
 - `borg_ssh_command`: Command to use instead of just "ssh". This can be used to specify SSH options.
 - `borg_version`: Force a specific borg version to be installed
 - `borg_venv_path`: Path to store the venv for `borg(backup)` and `borgmatic`
@@ -107,9 +110,11 @@ $ git clone https://github.com/borgbase/ansible-role-borgbackup.git roles/ansibl
 - `borgmatic_config_name`: Name to use for the Borgmatic config file. Defaults to `config.yaml`
 - `borgmatic_timer_hour`: Hour when regular create and prune cron/systemd-timer job will run. Defaults to `{{ 6 | random }}`
 - `borgmatic_timer_minute`: Minute when regular create and prune cron/systemd-timer job will run. Defaults to  `{{ 59 | random }}`
+- `borgmatic_timer_flags`: Flags to pass to borgmatic cron/systemd-timer job, like "--log-file /path/to/file.log --log-file-verbosity 2"
 - `borgmatic_hooks`: Hooks to monitor your backups e.g. with [Healthchecks](https://healthchecks.io/). See [official documentation](https://torsion.org/borgmatic/docs/how-to/monitor-your-backups/) for more.
 - `borgmatic_timer`: If the variable is set, a timer is installed. A choice must be made between `cron` and `systemd`.
 - `borgmatic_relocated_repo_access_is_ok`: Bypass Borg error about a repository that has been moved. Defaults to `false`
+- `borgmatic_unknown_unencrypted_repo_access_is_ok`: Bypass Borg error about a previously unknown unencrypted repository. Defaults to `false`
 - `borgmatic_store_atime`: Store atime into archive. Defaults to `true`
 - `borgmatic_store_ctime`: Store ctime into archive. Defaults to `true`
 - `borgmatic_version`: Force a specific borgmatic version to be installed

defaults/main.yml

@@ -7,6 +7,7 @@ borg_encryption_passcommand: false
 borg_lock_wait_time: 5
 borg_ssh_key_type: "ed25519"
 borg_ssh_key_name: "id_{{ borg_ssh_key_type }}"
+borg_ssh_key_comment: ''
 borg_ssh_key_file_path: "{{ backup_user_info.home }}/.ssh/{{ borg_ssh_key_name }}"
 borg_ssh_command: false
 borg_remote_path: false
@@ -21,6 +22,7 @@ borgmatic_timer_cron_name: "borgmatic"
 borgmatic_timer: cron
 borgmatic_timer_hour: "{{ range(0, 5) | random(seed=inventory_hostname) }}"
 borgmatic_timer_minute: "{{ range(0, 59) | random(seed=inventory_hostname) }}"
+borgmatic_timer_flags: ""
 borg_install_method: "pip"
 borg_require_epel: "{{ ansible_os_family == 'RedHat' and ansible_distribution != 'Fedora' }}"
 
@@ -41,9 +43,12 @@ borgmatic_check_last: 3
 borgmatic_store_atime: true
 borgmatic_store_ctime: true
 borgmatic_relocated_repo_access_is_ok: false
+borgmatic_unknown_unencrypted_repo_access_is_ok: false
 borgmatic_version: ">=1.7.11"
 
 borg_venv_path: "/opt/borgmatic"
 borg_user: "root"
 borg_group: "root"
+backup_user_info:
+  home: "/home/{{ borg_user }}"
 ...

meta/argument_specs.yml

@@ -25,7 +25,7 @@ argument_specs:
       borg_venv_path:
         type: str
         required: false
-        description:  Path to store the venv for borg(backup) and borgmatic.
+        description: Path to store the venv for borg(backup) and borgmatic.
       borg_install_method:
         type: str
         required: false
@@ -36,6 +36,7 @@ argument_specs:
           overwrite the borg_distro_packages variable to contain your distributions package names
           required to install borgmatic.
           Note that many distributions ship outdated versions of borgbackup and borgmatic; use at your own risk.
+          Set to none to disable installation management.
       borgmatic_config_name:
         type: str
         required: false
@@ -50,7 +51,7 @@ argument_specs:
         default: root
         description: Name of the Group to create Backups (Service Account)
       borg_source_directories:
-        type: List
+        type: list
         default: "/etc/hostname"
         required: false
         description: List of local folders to back up.
@@ -59,7 +60,7 @@ argument_specs:
         required: false
         description: Don't cross file-system boundaries.
       borg_repository:
-        type: List
+        type: str
         required: true
         description: |
           Full path to repository.
@@ -75,11 +76,11 @@ argument_specs:
         required: false
         description: Store ctime into archive.
       borg_exclude_patterns:
-        type: List
+        type: list
         required: false
         description: Any paths matching these patterns are excluded from backups. Globs and tildes are expanded.
       borg_exclude_from:
-        type: List
+        type: list
         required: false
         description: Read exclude patterns from one or more separate named files, one pattern per line.
       borg_remote_path:
@@ -114,37 +115,43 @@ argument_specs:
       borgmatic_relocated_repo_access_is_ok:
         type: bool
         description: Bypass Borg error about a repository that has been moved.
+      borgmatic_unknown_unencrypted_repo_access_is_ok:
+        type: bool
+        description: Bypass Borg error about a previously unknown unencrypted repository.
       borg_retention_policy:
-        keep_secondly:
-          type: int
-          required: false
-          description: Number of secondly archives to keep.
-        keep_minutely:
-          type: int
-          required: false
-          description: Number of minutely archives to keep.
-        keep_hourly:
-          type: int
-          required: false
-          description: Number of hourly archives to keep.
-        keep_daily:
-          type: int
-          required: false
-          description: Number of daily archives to keep.
-        keep_weekly:
-          type: int
-          required: false
-          description: Number of weekly archives to keep.
-        keep_monthly:
-          type: int
-          required: false
-          description: Number of monthly archives to keep.
-        keep_yearly:
-          type: int
-          required: false
-          description: Number of yearly archives to keep.
+        type: dict
+        description: Define the pruning policy
+        options:
+          keep_secondly:
+            type: int
+            required: false
+            description: Number of secondly archives to keep.
+          keep_minutely:
+            type: int
+            required: false
+            description: Number of minutely archives to keep.
+          keep_hourly:
+            type: int
+            required: false
+            description: Number of hourly archives to keep.
+          keep_daily:
+            type: int
+            required: false
+            description: Number of daily archives to keep.
+          keep_weekly:
+            type: int
+            required: false
+            description: Number of weekly archives to keep.
+          keep_monthly:
+            type: int
+            required: false
+            description: Number of monthly archives to keep.
+          keep_yearly:
+            type: int
+            required: false
+            description: Number of yearly archives to keep.
       borgmatic_checks:
-        type: List
+        type: list
         required: false
         description: |
           List of one or more consistency checks to run
@@ -172,6 +179,22 @@ argument_specs:
         type: str
         required: false
         description: If the variable is set, a timer is installed. A choice must be made between "cron" and "systemd".
+      borgmatic_timer_hour:
+        type: str
+        required: false
+        description: Hour when regular create and prune cron/systemd-timer job will run.
+      borgmatic_timer_minute:
+        type: str
+        required: false
+        description: Minute when regular create and prune cron/systemd-timer job will run.
+      borgmatic_timer_flags:
+        type: str
+        required: false
+        description: Flags to pass to borgmatic cron/systemd-timer job, like "--log-file /path/to/file.log --log-file-verbosity 2"
+      borgmatic_version:
+        type: str
+        required: false
+        description: Borgmatic version to install. Defaults to 'latest'
       borg_ssh_key_type:
         type: str
         required: false
@@ -180,3 +203,7 @@ argument_specs:
         type: str
         required: false
         description: Name of the SSH public and private key
+      borg_ssh_key_comment:
+        type: str
+        required: false
+        description: Comment added to the SSH public key.

meta/main.yml

@@ -15,9 +15,7 @@ galaxy_info:
         - all
     - name: Ubuntu
       versions:
-        - trusty
-        - xenial
-        - bionic
+        - all
     - name: ArchLinux
       versions:
         - all

molecule/default/converge.yml

@@ -5,11 +5,13 @@
     - name: Set ssh server package name for non-Archlinux ansible_os_family
       set_fact:
         openssh_package: "openssh-server"
+        pip3_extra_args: ""
       when: ansible_os_family != "Archlinux"
 
-    - name: Set ssh server package name for Archlinux ansible_os_family
+    - name: Set ssh server package name and pip3 argument for Archlinux ansible_os_family
       set_fact:
         openssh_package: "openssh"
+        pip3_extra_args: "--break-system-packages"
       when: ansible_os_family == "Archlinux"
 
     - name: Install openssh
@@ -17,6 +19,17 @@
         name: "{{ openssh_package }}"
         state: present
 
+    - name: Enable EPEL for yamllint
+      package:
+        name: epel-release
+        state: present
+      when: ansible_os_family == 'RedHat' and ansible_distribution != 'Fedora'
+
+    - name: Install yamllint
+      package:
+        name: yamllint
+        state: present
+
   roles:
     - role: borgbase.ansible_role_borgbackup
       borg_install_method: pip
@@ -40,9 +53,3 @@
         - name: users
           hostname: database1.example.org
           port: 5433
-
-  post_tasks:
-  - name: Install yamllint for checking config file
-    pip:
-      name: yamllint
-      executable: pip3

molecule/default/molecule.yml

@@ -8,10 +8,10 @@ platforms:
     image: archlinux:latest
   - name: almalinux-9
     image: almalinux:9
-  - name: fedora-latest
-    image: fedora:latest
-  - name: debian-bullseye
-    image: debian:bullseye
+  # - name: fedora-latest
+  #   image: fedora:latest
+  - name: debian-bookworm
+    image: debian:bookworm
   - name: ubuntu-latest
     image: ubuntu:latest
 provisioner:

tasks/00_assert.yml

@@ -0,0 +1,9 @@
+---
+- name: Ensure legacy hooks aren't used
+  ansible.builtin.assert:
+    that:
+      - borgmatic_failure_command is undefined
+      - borgmatic_before_backup_command is undefined
+      - borgmatic_after_backup_command is undefined
+    msg: Please use the new borgmatic_hooks variable instead of individual before/after/failure hooks.
+...

tasks/01_install.yml

@@ -1,14 +1,7 @@
 ---
 - name: Install borgbackup
+  when: borg_install_method != "none"
   block:
-    - name: Ensure legacy hooks aren't used
-      ansible.builtin.assert:
-        that:
-          - borgmatic_failure_command is undefined
-          - borgmatic_before_backup_command is undefined
-          - borgmatic_after_backup_command is undefined
-        msg: Please use the new borgmatic_hooks variable instead of individual before/after/failure hooks.
-
     - name: Include OS-specific variables
       include_vars: "{{ item }}"
       with_first_found:

tasks/03_create_key.yml

@@ -16,6 +16,7 @@
         type: "{{ borg_ssh_key_type }}"
         owner: "{{ borg_user }}"
         group: "{{ borg_group }}"
+        comment: "{{ borg_ssh_key_comment }}"
 
     - name: Read SSH key
       ansible.builtin.slurp:

tasks/noauto_create_timer_cron.yml

@@ -13,7 +13,7 @@
         minute: "{{ borgmatic_timer_minute }}"
         user: "{{ borg_user }}"
         cron_file: "{{ borgmatic_timer_cron_name }}"
-        job: "borgmatic -c /etc/borgmatic/{{ borgmatic_config_name }}"
+        job: "borgmatic -c /etc/borgmatic/{{ borgmatic_config_name }} {{ borgmatic_timer_flags }}"
 
     - name: Ensure separate check cron job is absent
       cron:
@@ -26,6 +26,6 @@
     user: "{{ borg_user }}"
     cron_file: "{{ borgmatic_timer_cron_name }}"
     name: PATH
-    env: yes
+    env: true
     value: /usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 ...

tasks/noauto_create_timer_systemd.yml

@@ -6,11 +6,13 @@
     state: absent
   check_mode: true
   register: cron_file_exists
+  ignore_errors: true
 
 - name: Ensure no Borgmatic Cron file exists.
   ansible.builtin.assert:
     that:
       - not cron_file_exists.changed
+      - not cron_file_exists.failed or "Failed to find" in cron_file_exists.msg
     fail_msg: Found an existing Borgmatic Cron job. Please remove before using Systemd timer.
 
 - name: Create borgbackup timer
@@ -59,5 +61,7 @@
         - name: Show hints
           when: "'backup_init_repo' not in ansible_run_tags"
           ansible.builtin.debug:
-            msg: "Attention: Since the repo was not initialized automatically, the systemd service (borgmatic.service) and the timer (borgmatic.timer) are not activated."
+            msg: >-
+              Attention: Since the repo was not initialized automatically,
+              the systemd service (borgmatic.service) and the timer (borgmatic.timer) are not activated.
 ...

tasks/noauto_install_package.yml

@@ -4,14 +4,14 @@
     - name: Check if EPEL repo is enabled, if installation from distro is requested
       when: borg_require_epel
       block:
-      - name: Get list of installed packages
-        ansible.builtin.package_facts:
-          manager: auto
-      - name: Ensure EPEL is enabled
-        ansible.builtin.assert:
-          that:
-            - "'epel-release' in ansible_facts.packages"
-          fail_msg: Need EPEL repo to install via distro package.
+        - name: Get list of installed packages
+          ansible.builtin.package_facts:
+            manager: auto
+        - name: Ensure EPEL is enabled
+          ansible.builtin.assert:
+            that:
+              - "'epel-release' in ansible_facts.packages"
+            fail_msg: Need EPEL repo to install via distro package.
 
     - name: Install borgmatic and borg via distribution package manager
       ansible.builtin.package:

tasks/noauto_install_pip.yml

@@ -1,6 +1,12 @@
 ---
 - name: Install Borg and Borgmatic via pip
   block:
+    - name: Ensure the crb repository is enabled for RedHat (needed for xxhash)
+      community.general.dnf_config_manager:
+        name: crb
+        state: enabled
+      when: ansible_os_family == 'RedHat' and ansible_distribution != 'Fedora'
+
     - name: Install build dependencies
       ansible.builtin.package:
         name: "{{ borg_pip_packages }}"

templates/borgmatic.service.j2

@@ -12,7 +12,7 @@ ConditionACPower=true
 [Service]
 Type=oneshot
 User={{ borg_user }}
-ExecStart=borgmatic -c /etc/borgmatic/{{ borgmatic_config_name }}
+ExecStart=borgmatic -c /etc/borgmatic/{{ borgmatic_config_name }} {{ borgmatic_timer_flags }}
 
 # Source: https://projects.torsion.org/borgmatic-collective/borgmatic/raw/branch/master/sample/systemd/borgmatic.service
 # Security settings for systemd running as root, optional but recommended to improve security. You

templates/config.yaml.j2

@@ -1,4 +1,4 @@
-#jinja2: lstrip_blocks: "True", trim_blocks: "True"
+#jinja2: lstrip_blocks: True, trim_blocks: True
 ---
 # Managed by Ansible, please don't edit manually
 
@@ -19,10 +19,10 @@ location:
     repositories:
 {% if borg_repository is iterable and (borg_repository is not string and borg_repository is not mapping) %}
   {% for repo in borg_repository %}
-        - {{ repo }}
+        - path: {{ repo }}
   {% endfor %}
 {% elif borg_repository is defined and borg_repository is string %}
-        - {{ borg_repository }}
+        - path: {{ borg_repository }}
 {% endif %}
 
     # Store atime into archive.
@@ -66,8 +66,10 @@ location:
 # https://borgbackup.readthedocs.io/en/stable/usage/general.html#environment-variables for
 # details.
 storage:
+{% if borg_encryption_passphrase %}
     encryption_passphrase: {{ borg_encryption_passphrase }}
 
+{% endif %}
     # The standard output of this command is used to unlock the encryption key. Only
     # use on repositories that were initialized with passcommand/repokey encryption.
     # Note that if both encryption_passcommand and encryption_passphrase are set,
@@ -80,7 +82,7 @@ storage:
     # Type of compression to use when creating archives. See
     # https://borgbackup.readthedocs.org/en/stable/usage.html#borg-create for details.
     # Defaults to no compression.
-    compression: auto,zstd
+    compression: {{ borg_compression|default('auto,zstd') }}
 
     # Remote network upload rate limit in kiBytes/second.
 {% if borg_remote_rate_limit %}
@@ -110,6 +112,9 @@ storage:
     # Bypass Borg error about a repository that has been moved.
     relocated_repo_access_is_ok: {{ borgmatic_relocated_repo_access_is_ok }}
 
+    # Bypass Borg error about a previously unknown unencrypted repository.
+    unknown_unencrypted_repo_access_is_ok: {{ borgmatic_unknown_unencrypted_repo_access_is_ok }}
+
 # Retention policy for how many backups to keep in each category. See
 # https://borgbackup.readthedocs.org/en/stable/usage.html#borg-prune for details.
 # At least one of the "keep" options is required for pruning to work.
@@ -176,5 +181,5 @@ consistency:
 hooks:
 {% for hook in borgmatic_hooks %}
     {{ hook }}:
-        {{ borgmatic_hooks[hook] | to_nice_yaml(indent=2) | trim | indent(8) }}
+{{ borgmatic_hooks[hook] | to_nice_yaml(indent=4) | indent(8, first=true) }}
 {% endfor %}

vars/Archlinux.yml

@@ -5,10 +5,16 @@ borg_dep_packages:
 borg_cron_package: cronie
 
 borg_pip_packages:
+  - acl
   - gcc
+  - lz4
+  - openssl
   - pkgconfig
   - python-pip
   - python-setuptools
+  - xxhash
+  - xz
+  - zstd
 
 borg_distro_packages:
   - borg

vars/Debian.yml

@@ -8,6 +8,9 @@ borg_pip_packages:
   - libssl-dev
   - libacl1-dev
   - libacl1
+  - liblz4-dev
+  - libzstd-dev
+  - libxxhash-dev
   - build-essential
   - python3-setuptools
   - python3-dev

vars/Fedora.yml

@@ -5,16 +5,21 @@ borg_dep_packages:
 borg_cron_package: cronie
 
 borg_pip_packages:
-  - libacl-devel
-  - libacl
   - gcc
   - gcc-c++
+  - libacl
+  - libacl-devel
+  - libzstd-devel
+  - lz4-devel
   - openssl-devel
+  - openssl-devel
+  - python3-cython
+  # - python3-devel
   - python3-pip
-  - python3-wheel
-  - python3-devel
   - python3-setuptools
-  - python3-Cython
+  - python3-wheel
+  - xxhash
+  - xxhash-devel
 
 borg_distro_packages:
   - borgbackup

vars/RedHat-10.yml

@@ -0,0 +1,28 @@
+---
+borg_dep_packages:
+  - openssh-clients
+
+borg_cron_package: cronie
+
+borg_pip_packages:
+  - gcc
+  - gcc-c++
+  - libacl
+  - libacl-devel
+  - libzstd-devel
+  - lz4-devel
+  - openssl-devel
+  # - python3-devel
+  - python3-pip
+  - python3-setuptools
+  - xxhash
+  - xxhash-devel
+  # - python3-virtualenv
+  # - python3-wheel
+
+borg_distro_packages:
+  - borgbackup
+  - borgmatic
+
+python_bin: python3
+pip_bin: pip3

vars/RedHat-9.yml

@@ -5,16 +5,20 @@ borg_dep_packages:
 borg_cron_package: cronie
 
 borg_pip_packages:
-  - libacl-devel
-  - libacl
   - gcc
   - gcc-c++
+  - libacl
+  - libacl-devel
+  - libzstd-devel
+  - lz4-devel
   - openssl-devel
+  # - python3-devel
   - python3-pip
-  # - python3-wheel
-  - python3-devel
   - python3-setuptools
+  - xxhash
+  - xxhash-devel
   # - python3-virtualenv
+  # - python3-wheel
 
 borg_distro_packages:
   - borgbackup