feat(rabe_backup): create local user and configure authorized_keys and sudo rules

galaxy.yml

@@ -1,4 +1,4 @@
 ---
 namespace: radiorabe
 name: common
 version: 0.0.0
@@ -14,7 +14,8 @@
   - common
   - infrastructure
   - tools
-dependencies: {}
+dependencies:
+  "ansible.posix": ">=2.1.0"
 repository: https://github.com/radiorabe/ansible-collection-common
 documentation: https://github.com/radiorabe/ansible-collection-common/blob/main/README.md
 homepage: https://github.com/radiorabe/ansible-collection-common

roles/rabe_backup/README.md

@@ -4,7 +4,7 @@ This role configures a host to be integrated with the **radiorabe backup solutio
 
 It is responsible for:
 
-1. Optionally configuring an SSH known host entry for secure, password-less backup operations.
+1. Optionally creating a local user including an SSH authorized_keys entry and sudo rule for secure, password-less backup operations.
 2. Creating the system-wide include/exclude configuration files for the backup agent.
 
 This role is part of the overall backup infrastructure detailed here:
@@ -18,8 +18,8 @@ None
 
 | Variable | Default Value | Description |
 | :--- | :--- | :--- |
-| `rabe_backup_ssh_user` | `''` (empty string) | The **username** of the account whose known_hosts file will be modified (e.g., `root` or `backup_user`). |
-| `rabe_backup_ssh_known_host_key` | `''` (empty string) | The **SSH public key entry** to add. Must be a single string in the standard `known_hosts` format (e.g., `hostname,ip_address key_type KEY_CONTENT...`). |
+| `rabe_backup_ssh_user` | `''` (empty string) | The **username** of the account who will be created and whose authorized_keys file will be modified (e.g., `root` or `backup_user`). |
+| `rabe_backup_ssh_public_key` | `''` (empty string) | The **SSH public key** to add to the user's authorized_keys file. Must be a single string in the standard `authorized_keys` format (e.g., `ssh_rsa AAAAB3NzaC1y...`). |
 | `rabe_backup_include_paths` | `[]` (empty list) | An **array of absolute file/directory paths** to be included. Written to `/etc/rabe-backup.include`. The file is only created if this list is not empty. |
 | `rabe_backup_exclude_paths` | `[]` (empty list) | An **array of absolute file/directory paths** to be excluded. Written to `/etc/rabe-backup.exclude`. The file is only created if this list is not empty. |
 
@@ -31,9 +31,9 @@ None
   roles:
     - role: rabe_backup
       vars:
-        # 1. Optional SSH known_hosts config
+        # 1. Optional SSH local user and authorized_keys config
         rabe_backup_ssh_user: backup_operator
-        rabe_backup_ssh_known_host_key: "192.168.1.10 ssh-rsa AAAA...your.backup.server.key.here...FQ=="
+        rabe_backup_ssh_public_key: "ssh-rsa AAAA...your.backup.server.key.here...FQ== user@backup"
 
         # 2. Backup Include/Exclude Paths
         rabe_backup_include_paths:

roles/rabe_backup/defaults/main.yml

@@ -1,14 +1,14 @@
 ---
 # defaults for radiorabe.common.rabe_backup
 
-# --- SSH Known Hosts Configuration ---
-# The username of the account whose known_hosts file will be modified.
+# --- SSH Authorized Keys Configuration ---
+# The username of the account who will be created and whose authorized_keys file will be modified.
 # The task is skipped if this value is an empty string.
 rabe_backup_ssh_user: ""
 
-# The public key entry to add. Must be in known_hosts format (e.g., 'host.example.com,192.0.2.1 ssh-rsa AAAA...').
+# The public key entry to add. Must be in authorized_keys format (e.g., 'ssh_rsa AAAAB3NzaC1y...').
 # The task is skipped if this value is an empty string.
-rabe_backup_ssh_known_host_key: ""
+rabe_backup_ssh_public_key: ""
 
 # --- Backup Include/Exclude Configuration ---
 # Array of paths (one path per list item) to be written to /etc/rabe-backup.include.

roles/rabe_backup/tasks/main.yml

@@ -1,15 +1,27 @@
 ---
 # tasks file for radiorabe.common.rabe_backup
 
-- name: Add specified SSH public key to user's known_hosts
-  ansible.builtin.known_hosts:
+- name: Create specified backup user
+  ansible.builtin.user:
     name: "{{ rabe_backup_ssh_user }}"
-    key: "{{ rabe_backup_ssh_known_host_key }}"
-    state: present
+    system: true
+  when: rabe_backup_ssh_user is defined and rabe_backup_ssh_user | length > 0
+
+- name: Add specified SSH public key to user's authorized_keys
+  ansible.posix.authorized_key:
+    user: "{{ rabe_backup_ssh_user }}"
+    key: "{{ rabe_backup_ssh_public_key }}"
   # This task is only executed if both the username and the key are defined
   when:
     - rabe_backup_ssh_user is defined and rabe_backup_ssh_user | length > 0
-    - rabe_backup_ssh_known_host_key is defined and rabe_backup_ssh_known_host_key | length > 0
+    - rabe_backup_ssh_public_key is defined and rabe_backup_ssh_public_key | length > 0
+
+- name: Configure sudo rule for backup user
+  community.general.sudoers:
+    name: sudo-rsync-backup
+    user: "{{ rabe_backup_ssh_user }}"
+    commands: /bin/rsync
+  when: rabe_backup_ssh_user is defined and rabe_backup_ssh_user | length > 0
 
 - name: Create /etc/rabe-backup.include file from array
   ansible.builtin.copy: