---
- name: Pin borgmatic
  template:
    src: "{{ item.src }}"
    dest: "{{ item.dest }}"
    owner: root
    group: root
    mode: u=rw,g=r,o=
  loop:
    - src: apt/list.j2
      dest: /etc/apt/sources.list.d/bullseye.list
    - src: apt/preferences.j2
      dest: /etc/apt/preferences.d/borgmatic-bullseye
  when:
    - ansible_distribution == "Debian"
    - ansible_distribution_major_version | int <= 10

- name: Don't pin borgmatic if we are on bullseye
  file:
    path: "/etc/apt/{{ item }}"
    state: absent
  loop:
    - sources.list.d/bullseye.list
    - preferences.d/borgmatic-bullseye
  when:
    - ansible_distribution == "Debian"
    - ansible_distribution_release == "bullseye"

- name: Install borgmatic
  apt:
    name: borgmatic
  register: apt_result
  retries: 3
  until: apt_result is succeeded

- name: Create /etc/borgbackup
  file:
    path: /etc/borgbackup
    state: directory
    owner: root
    group: root
    mode: u=rwx,g=rx,o=

- name: Create SSH key
  openssh_keypair:
    path: "/etc/borgbackup/id_remote"
    type: rsa
    owner: root
    group: root
    mode: u=r,g=r,o=
  register: ssh_key

- name: Add public key to remote
  delegate_to: "{{ borg_server_host }}"
  become: true
  authorized_key:
    exclusive: false
    user: "{{ borg_server_user }}"
    key: "{{ ssh_key.public_key }}"
    key_options: >-
      command="borg serve --restrict-to-path {{ borg_host_dir }},
      no-agent-forwarding,
      no-port-forwarding,
      no-pty,
      no-user-rc,
      no-X11-forwarding
  vars:
    borg_host_dir: "{{ borg_server_base_dir }}/{{ ansible_fqdn }}"

- name: Add borgmatic configuration file
  become: true
  template:
    src: borgmatic.conf.j2
    dest: /etc/borgmatic/config.yaml
    owner: root
    group: root
    mode: u=rw,g=r,o=

- name: Install timer and service for borgmatic
  template:
    src: "{{ item }}.j2"
    dest: "/etc/systemd/system/{{ item }}"
    owner: root
    group: root
    mode: u=rw,g=r,o=
  loop:
    - borgmatic.timer
    - borgmatic.service
  notify:
    - Run systemd daemon-reload

- name: Start and enable borgmatic timer
  systemd:
    name: borgmatic.timer
    state: started
    enabled: true

- name: Start and enable borgmatic service
  systemd:
    name: borgmatic.service
    state: started
    enabled: true

- include_role:
    name: update_motd
  vars:
    key: 10-borgmatic
    message: Borgmatic (client) est installé dans /etc/borgmatic/config.yaml.
...