jakub 54e111338d Encrypt borg repos with repokey-blake2 + shared passphrase ...

borg_passphrase is required (Semaphore secret, same across hosts).
The role writes it to /etc/borgmatic/passphrase (0600 root) and
configures borgmatic to use BORG_PASSCOMMAND=cat /etc/borgmatic/passphrase,
and runs `borg init --encryption=repokey-blake2` with BORG_PASSPHRASE in
the env. no_log on the tasks that touch the passphrase.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-15 21:58:14 +02:00

..

backup

Encrypt borg repos with repokey-blake2 + shared passphrase

2026-05-15 21:58:14 +02:00

manage_ssh_keys/tasks

Add backup role and manage_ssh_keys role

2026-05-15 18:38:11 +02:00