# daily DB dumps into {{ backup_dump_dir }}
# read-only rsync access for the backup host's pull key (user `backup`)
- name: Resolve the backup pull public key from the backup host
  when: aurbis_backup_pubkey is not defined
  block:
    - name: Read the pull public key
      slurp:
        src: "{{ hostvars[groups['backup'][0]].backup_key_path }}.pub"
      delegate_to: "{{ groups['backup'][0] }}"
      register: _pull_pubkey
    - name: Set the pull pubkey fact
      set_fact:
        aurbis_backup_pubkey: "{{ _pull_pubkey.content | b64decode | trim }}"

- name: Install database dump script
  template:
    src: "backup/aurbis-dump-{{ inventory_hostname }}.sh.j2"
    dest: /usr/local/bin/aurbis-dump
    mode: "0750"

- name: Install dump service and timer
  copy:
    src: "backup/{{ item }}"
    dest: /etc/systemd/system/
    mode: "0644"
  with_items:
    - aurbis-dump.service
    - aurbis-dump.timer

- name: Enable dump timer
  systemd:
    name: aurbis-dump.timer
    enabled: yes
    state: started
    daemon_reload: yes

- name: Install read-only rsync wrapper for the backup user
  copy:
    src: backup/backup-rsync-shell
    dest: /usr/local/bin/backup-rsync-shell
    mode: "0755"

- name: Allow backup user to run read-only rsync as root
  community.general.sudoers:
    name: backup-rsync
    state: present
    user: backup
    commands: /usr/bin/rsync --server --sender *

- name: Authorize the backup host's pull key (forced read-only rsync)
  ansible.posix.authorized_key:
    user: backup
    state: present
    key: "{{ aurbis_backup_pubkey }}"
    key_options: 'command="/usr/local/bin/backup-rsync-shell",restrict'