Merge branch 'master' into fetlab

2018-09-20 11:29:28 +02:00
parent ebab2cc7ab f1ef6eec30
commit 4cb3cc75e6
72 changed files with 4356 additions and 86 deletions
--- a/doc/ariane.md
+++ b/doc/ariane.md
@@ -6,6 +6,39 @@
 |**H2**|01 /dev/sdb `6TB` <br> `WD-WX21D36PPLPH`|05  |09  |13  |
 |**H3**|02 /dev/sdc `6TB` <br> `WD-WX21D36PP0K1`|06  |10  |14  |
 |**H4**|03 /dev/sdd `6TB` <br> `WD-WXB1HB4MJCMM`|07  |11  |15  |
 ## Debian setup install steps
 ```
 Boot Image Debian Netinstall on USB stick, Advanced Options->Expert Install
 Language: English, Location: other->Europe->Austria
 Locale: en_US.UTF-8, Additional Locale: de_AT.UTF-8, System Locale: en_US.UTF-8
 Keyboard: German
 Detect and mount CD-ROM, Load installer components: no extra
 auf KISTL statische IP 192.168.86.7/24 für ariane.fet.htu.tuwien.ac.at einrichten
 Detect network hardware, Configure Network: enp8s0: Hostname: ariane, IP 192.168.86.7/24 domain fet.htu.tuwien.ac.at
 Setup Users and Passwords: shadow, user petra
 Configure the clock: NTP Server: tutimea.tuwien.ac.at
 Detect disks, partition disks: manual
 RAID1 md0 with both SSDs https://blog.sleeplessbeastie.eu/2013/10/04/how-to-configure-software-raid1-during-installation-process/
 /dev/nvmeXn1p1 32GB primary Volume für / in btrfs 32GB
 /dev/nvmeXn1p5 1.5 GB logical Volume
 /dev/nvmeXn1p6 1.5 GB logical Volume
 /dev/nvmeXn1p7 1.5 GB logical Volume
 /dev/nvmeXn1p8 1.5 GB logical Volume
 /dev/nvmeXn1p9 90  GB logical Volume
 ZFS RAIDZ-2 on is already on 4 x 6TB disks = 12TB 0 spares
 partition1 ariane-root btrfs noatime, discard
 Generic Kernel
 Mirror: gd.tuwien.ac.at, allow backported
 install with ssh server and standard sys utilities
 Install Grub on /dev/nvme0n1 (to removable media path)
 Install Grub on /dev/nvme1n1
 reboot, log in as root
 edit /etc/ssh/sshd_config set PermitRootlogin to yes
 service sshd reload
 ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
 ssh-copy-id root@ariane from client
 edit /etc/ssh/sshd_config set PermitRootlogin to Prohibit-Password
 ```
 ## Install ZFS
 ```shell
 apt-get install zfsutils-linux
@@ -67,10 +100,14 @@ mv /var/log/* /ssd/var/log/
 zfs set mountpoint=/var/log ssd/var/log
 mv /var/lib/lxc/* /ssd/var/lxc/
 zfs set mountpoint=/var/lib/lxc ssd/var/lxc
 zfs create -o com.sun:auto-snapshot=false zv1/sojus
 zfs create -o com.sun:auto-snapshot=false zv1/daten/Scans
 ```
 ### Set dataset quota
 ```shell
 zfs set quota=1T zv1/homes zv1/daten zv1/fotos
 zfs set quota=3T zv1/sojus
 zfs set quota=5G zv1/daten/Scans
 ```
 ### If intend using ACL someday
 ```shell
@@ -129,3 +166,9 @@ mdadm --misc --detail /dev/md0
 echo check > /sys/block/md0/md/sync_action
 watch -n 0.1 cat /proc/mdstat
 ```
 ## Shutdown System
 ```shell
 # stop all LXC containers
 zfs_mount.sh unmount
 halt -p
 ```
--- a/doc/configs/ariane_mbr_nvme0n1.txt
+++ b/doc/configs/ariane_mbr_nvme0n1.txt
@@ -0,0 +1,15 @@
 Disk /dev/nvme0n1: 119.2 GiB, 128035676160 bytes, 250069680 sectors
 Units: sectors of 1 * 512 = 512 bytes
 Sector size (logical/physical): 512 bytes / 512 bytes
 I/O size (minimum/optimal): 512 bytes / 512 bytes
 Disklabel type: dos
 Disk identifier: 0x21183a98
 Device         Boot    Start       End   Sectors  Size Id Type
 /dev/nvme0n1p1          2048  62500863  62498816 29.8G fd Linux raid autodetect
 /dev/nvme0n1p2      62502910 250068991 187566082 89.4G  5 Extended
 /dev/nvme0n1p5      62504960  65435647   2930688  1.4G 83 Linux
 /dev/nvme0n1p6      65437696  68368383   2930688  1.4G 83 Linux
 /dev/nvme0n1p7      68370432  71301119   2930688  1.4G 83 Linux
 /dev/nvme0n1p8      71303168  74233855   2930688  1.4G 83 Linux
 /dev/nvme0n1p9      74235904 250068991 175833088 83.9G 83 Linux
--- a/doc/configs/ariane_mbr_nvme1n1.txt
+++ b/doc/configs/ariane_mbr_nvme1n1.txt
@@ -0,0 +1,16 @@
 Disk /dev/nvme1n1: 119.2 GiB, 128035676160 bytes, 250069680 sectors
 Units: sectors of 1 * 512 = 512 bytes
 Sector size (logical/physical): 512 bytes / 512 bytes
 I/O size (minimum/optimal): 512 bytes / 512 bytes
 Disklabel type: dos
 Disk identifier: 0x35c808a6
 Device         Boot    Start       End   Sectors  Size Id Type
 /dev/nvme1n1p1          2048  62500863  62498816 29.8G fd Linux raid autodetect
 /dev/nvme1n1p2      62502910 250068991 187566082 89.4G  5 Extended
 /dev/nvme1n1p5      62504960  65435647   2930688  1.4G 83 Linux
 /dev/nvme1n1p6      65437696  68368383   2930688  1.4G 83 Linux
 /dev/nvme1n1p7      68370432  71301119   2930688  1.4G 83 Linux
 /dev/nvme1n1p8      71303168  74233855   2930688  1.4G 83 Linux
 /dev/nvme1n1p9      74235904 250068991 175833088 83.9G 83 Linux
--- a/doc/configs/ariane_mbr_zv1.txt
+++ b/doc/configs/ariane_mbr_zv1.txt
@@ -0,0 +1,9 @@
 Disk /dev/sdc: 5.5 TiB, 6001175126016 bytes, 11721045168 sectors
 Units: sectors of 1 * 512 = 512 bytes
 Sector size (logical/physical): 512 bytes / 4096 bytes
 I/O size (minimum/optimal): 4096 bytes / 4096 bytes
 Disklabel type: gpt
 Disk identifier: D2B76C08-E0D8-42AC-A0D5-F3A14EA584DF
 Device     Start         End     Sectors  Size Type
 /dev/sdc1   2048 11721045134 11721043087  5.5T Solaris /usr & Apple ZFS
--- a/doc/configs/kistl-pfSense-backup.xml
+++ b/doc/configs/kistl-pfSense-backup.xml
--- a/doc/configs/miruk-pfSense-backup.xml
+++ b/doc/configs/miruk-pfSense-backup.xml
--- a/doc/configs/wlan-OpenWrt-backup.tar.gz
+++ b/doc/configs/wlan-OpenWrt-backup.tar.gz
--- a/doc/kistl.md
+++ b/doc/kistl.md
@@ -0,0 +1,3 @@
 # kistl
 ## Current config
 See [config file](configs/kistl-pfSense-backup.xml)
--- a/doc/lxc.md
+++ b/doc/lxc.md
@@ -0,0 +1,11 @@
 # LXC container
 ## edit config
 ```shell
 vi /var/lib/lxc/lxc-container-01/config
 ```
 ## manage container
 ```shell
 lxc-start -n lxc-container-01
 lxc-attach -n lxc-container-01
 lxc-stop -n lxc-container-01
 ```
--- a/doc/miruk.md
+++ b/doc/miruk.md
@@ -0,0 +1,3 @@
 # miruk
 ## Current config
 See [config file](configs/miruk-pfSense-backup.xml)
--- a/doc/sojus.md
+++ b/doc/sojus.md
@@ -0,0 +1,15 @@
 # sojus
 ## create big backup locally
 ```shell
 cryptsetup luksOpen /dev/disk/by-id/ata-<ID>-part1 ata-<ID>-part1
 zpool import
 zpool import lab
 zfs create -o com.sun:auto-snapshot=false lab/backup
 borg init -e none /lab/backup/ariane.fet.htu.tuwien.ac.at
 ./borg create --show-rc --verbose --stats backup@sojus:system::ariane-{now} /zv1/daten /zv1/fotos /zv1/homes
 zpool export lab
 cryptsetup luksClose ata-<ID>-part1
 sync
 hdparm -y /dev/disk/by-id/ata-
 hdparm -C /dev/disk/by-id/ata-
 ```
--- a/doc/wlan.md
+++ b/doc/wlan.md
@@ -0,0 +1,3 @@
 # wlan
 ## Current config
 See [config file](configs/wlan-OpenWrt-backup.tar.gz)
--- a/group_vars/all
+++ b/group_vars/all
@@ -29,9 +29,6 @@ common_locales:
  - name: 'de_AT.UTF-8'
    state: "present"
 # apt-get common config
 common_apt: True
 common_apt_repositories:
  - "deb http://cdn.debian.net/debian/ {{ ansible_distribution_release }} main contrib non-free"
  - "deb http://cdn.debian.net/debian/ {{ ansible_distribution_release }}-backports main contrib non-free"
@@ -40,10 +37,10 @@ common_apt_repositories:
 common_vim_default: False
 common_openssh_keys_root:
-  - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzkK6ENya4mKcoG9iuMaodMpifeCgZK56zVF1zxyZhLtUyBx//qsLCXEdBNiGJY57Yp4l0PJKk9B4hpCFKuz6H622l84SOHzXhmFQUXWe/L6x4kRfQJvhBCNMi9brfR0n6AwX59RNRsbUeUjb7RuhCrzpbW0iWYjv/H9rjeyfY5Ne9dUUeBQDcsM1O7XfZJWwA5nxEGjbDB7l4/K43DoqaqzHOEOoETmHGfugO7A5QwhRmblu90pLD4+DOPv/4LGBRNpS8FyRzYrEJm7yUyF7nDzR+0xlLCapU4pKhmIFfSv4afsuBFvLb6Rgln5wUt2KIPh/qnqSP9jZGovYOadC0yb70dec7nnfwXTmqwzdwXtBlo3UzbPwt0iJG9fhYCw83Bkt/GpOsIW2fcxZhJ8CUeBw3Ox71lkeozb49oRMeHzUpYckrFt1FGxUWuHHykCrOXcxso0MRfKjl9RPUc+O5oQDG1KAoTd9doB3jygVr68wYVc/4kTTsXUlMIBMOUiek8XygQ7sV6Et6FpzvLvdf/iL1FMXAluRgUWJvKqe4IBPyWu2KyDF+2ZDMse3WhQYlYgNRqGCwfxOJGWtkvVO0L4YGJrLXKhY4yw2H+pQOHaugfGO8IYPV/vbPi+dB9OV89Zonu2iVjjDFFXI0xE7WSXCV3RQyed26Bq9BBO9DDQ== damadmai@fet.at"
+  - key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCzkK6ENya4mKcoG9iuMaodMpifeCgZK56zVF1zxyZhLtUyBx//qsLCXEdBNiGJY57Yp4l0PJKk9B4hpCFKuz6H622l84SOHzXhmFQUXWe/L6x4kRfQJvhBCNMi9brfR0n6AwX59RNRsbUeUjb7RuhCrzpbW0iWYjv/H9rjeyfY5Ne9dUUeBQDcsM1O7XfZJWwA5nxEGjbDB7l4/K43DoqaqzHOEOoETmHGfugO7A5QwhRmblu90pLD4+DOPv/4LGBRNpS8FyRzYrEJm7yUyF7nDzR+0xlLCapU4pKhmIFfSv4afsuBFvLb6Rgln5wUt2KIPh/qnqSP9jZGovYOadC0yb70dec7nnfwXTmqwzdwXtBlo3UzbPwt0iJG9fhYCw83Bkt/GpOsIW2fcxZhJ8CUeBw3Ox71lkeozb49oRMeHzUpYckrFt1FGxUWuHHykCrOXcxso0MRfKjl9RPUc+O5oQDG1KAoTd9doB3jygVr68wYVc/4kTTsXUlMIBMOUiek8XygQ7sV6Et6FpzvLvdf/iL1FMXAluRgUWJvKqe4IBPyWu2KyDF+2ZDMse3WhQYlYgNRqGCwfxOJGWtkvVO0L4YGJrLXKhY4yw2H+pQOHaugfGO8IYPV/vbPi+dB9OV89Zonu2iVjjDFFXI0xE7WSXCV3RQyed26Bq9BBO9DDQ== damadmai@fet.at"
-  - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmv/aixvhRzeQiD3XABD448WHW2sHSX5wj5TkqKmHG3MekovCjacEDwAEdH+3MzXzbQXCD8NOHxlvRsqfzsaIZw6al+i7hd7xeYzRAITeXAod/eQNJY71Czh1xt/rtfjgVrwFKe6kUo+RqUUBxOXjKNtCROxvsa/gxTSJD4xz/TGOTM7EbRfkOGBh3j/xmdBinURTACwKwHCR4SUnpAA7usY/QQGW22Nqczvj9SW1Un0TnYpMm7jAghGo7pvwInTerbbA2OQ07QEp9T/mAbPUks5QGEw1lwMZgEtl0EZrKxDoWjssGPw5ZA6RzwIggjuEN1zzE+pn9jWL+9sd2Tihr pet@fet.at"
+  - key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCmv/aixvhRzeQiD3XABD448WHW2sHSX5wj5TkqKmHG3MekovCjacEDwAEdH+3MzXzbQXCD8NOHxlvRsqfzsaIZw6al+i7hd7xeYzRAITeXAod/eQNJY71Czh1xt/rtfjgVrwFKe6kUo+RqUUBxOXjKNtCROxvsa/gxTSJD4xz/TGOTM7EbRfkOGBh3j/xmdBinURTACwKwHCR4SUnpAA7usY/QQGW22Nqczvj9SW1Un0TnYpMm7jAghGo7pvwInTerbbA2OQ07QEp9T/mAbPUks5QGEw1lwMZgEtl0EZrKxDoWjssGPw5ZA6RzwIggjuEN1zzE+pn9jWL+9sd2Tihr pet@fet.at"
-  - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEer+2Q3/bSJv2SpaGo8tjkQdSw/Kqoyy3XZ2RrtEqwzGozfvjyrZ0jd2Vy6LJ37o3n34brfVOvzeBaiSzc+5ciNgRVohaMydM6ADSGvZ9S2BGod1KonKfTbultWA1+BzJAjn7ZTjLlPJmceITYlh5uAnHrWQgZNPipMHLbKnSMUUd7AbkBy/nhg/ad5dO6e9TOXmEY+cNMCcA20R1i/O9nA1LIgXfnx1WKtW40gOf5YioHnhOMo8rNP5WlzZ1Lf5SiMJgxeT0covc3pq+hAHa+Y6KKdeO5oQ36RMi5FJUk2txQHGQtAjLMg0dv+bJgepIakM5wxekk9oY0J8inZOMh0mRH86KMH3SDwXt2xPomXfkGKeHVkM5VO6qfv8CzX/FjMoTTFGVaKDEPngbA8BIrPD7++gicdcnkmYOJLXgBDuJhhpis/Yp8F+F1tMBDT9LRLNvM18BXpekoFJNwTWJOAR8gktsiYP3VMt6oN1Y5lStvzv6MkhaEa0WGqjQoOJsQuI1roVHwlQhyWM/igCeO0Egb7qz/qPJHRRCgNfVjDO/rtFK09EjmG1bQrgOP7dJv0E+3scxilnoIED6ocCpKNVpc/okehgHwC+QdIpWrn5fPrXJt/hifguCn7KziWfQne8eIxaQOWBaZLdcY7HmgtQmOi3KRlKy+ORXtj/+MQ== hans@fet.at"
+  - key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDEer+2Q3/bSJv2SpaGo8tjkQdSw/Kqoyy3XZ2RrtEqwzGozfvjyrZ0jd2Vy6LJ37o3n34brfVOvzeBaiSzc+5ciNgRVohaMydM6ADSGvZ9S2BGod1KonKfTbultWA1+BzJAjn7ZTjLlPJmceITYlh5uAnHrWQgZNPipMHLbKnSMUUd7AbkBy/nhg/ad5dO6e9TOXmEY+cNMCcA20R1i/O9nA1LIgXfnx1WKtW40gOf5YioHnhOMo8rNP5WlzZ1Lf5SiMJgxeT0covc3pq+hAHa+Y6KKdeO5oQ36RMi5FJUk2txQHGQtAjLMg0dv+bJgepIakM5wxekk9oY0J8inZOMh0mRH86KMH3SDwXt2xPomXfkGKeHVkM5VO6qfv8CzX/FjMoTTFGVaKDEPngbA8BIrPD7++gicdcnkmYOJLXgBDuJhhpis/Yp8F+F1tMBDT9LRLNvM18BXpekoFJNwTWJOAR8gktsiYP3VMt6oN1Y5lStvzv6MkhaEa0WGqjQoOJsQuI1roVHwlQhyWM/igCeO0Egb7qz/qPJHRRCgNfVjDO/rtFK09EjmG1bQrgOP7dJv0E+3scxilnoIED6ocCpKNVpc/okehgHwC+QdIpWrn5fPrXJt/hifguCn7KziWfQne8eIxaQOWBaZLdcY7HmgtQmOi3KRlKy+ORXtj/+MQ== hans@fet.at"
-  - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZAVxkHZYqjgCBcfHy0yggdVALZKoQbJP1TJAEYgLIAWFQ0ZPMGDaidOQiTzFTE0i35MUlQB6Rc+pTYnW/+h9rzktWbU/8RNirQve2XR5TWiRIUa13p31Xgjyw05O0uF3LEL/SmZruMHy25ncDXGF+xC2VllIttC+fLHJWLXIbWVujHdOA69fBqOonQrcPTsg1l4QQv6ZAxwVgCsbeOccZkdpoT0BJk03nflW+SGsKthTYX2VMGJlc/4QjArfZ2hTykr0I/lSA6E9FkFSLl65ejovGxCp1oXn484DlyajoXqJY7IOD86izXqkQSq4w4bLKEdrfQOnfGKe1XmxzFdk92SNEW41RXokNQ16xOBZzO1ZHkXd6hx0Pj6aBvUbs3PlCn4q764LKIcjSk7ADgeC5OBA4xgRxyZt9vuP93o7jl3vvqLWevsFa0j8orxC0D3cO5SMPbowW9LqrtqHynC0WltrtLT5+Q2tBSavP615NOu+bfcakgiWN8otv41ST+2hWka8qNptOxTRj/h7+MMOyi9bh1vjgB1KkOZYotJtFdXKFiYz+buIKwguWZWEni9uTRMiEsu84x8aJwdptPO0UIgZGroyUZJcWlUkwrkdE5T4cg9zP14M6zmogAYEI7oRX56FyspRVlA7J6VF/mcZ1z6ufH+97cle613gPKUVkpw== andis@fet.at"
+  - key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZAVxkHZYqjgCBcfHy0yggdVALZKoQbJP1TJAEYgLIAWFQ0ZPMGDaidOQiTzFTE0i35MUlQB6Rc+pTYnW/+h9rzktWbU/8RNirQve2XR5TWiRIUa13p31Xgjyw05O0uF3LEL/SmZruMHy25ncDXGF+xC2VllIttC+fLHJWLXIbWVujHdOA69fBqOonQrcPTsg1l4QQv6ZAxwVgCsbeOccZkdpoT0BJk03nflW+SGsKthTYX2VMGJlc/4QjArfZ2hTykr0I/lSA6E9FkFSLl65ejovGxCp1oXn484DlyajoXqJY7IOD86izXqkQSq4w4bLKEdrfQOnfGKe1XmxzFdk92SNEW41RXokNQ16xOBZzO1ZHkXd6hx0Pj6aBvUbs3PlCn4q764LKIcjSk7ADgeC5OBA4xgRxyZt9vuP93o7jl3vvqLWevsFa0j8orxC0D3cO5SMPbowW9LqrtqHynC0WltrtLT5+Q2tBSavP615NOu+bfcakgiWN8otv41ST+2hWka8qNptOxTRj/h7+MMOyi9bh1vjgB1KkOZYotJtFdXKFiYz+buIKwguWZWEni9uTRMiEsu84x8aJwdptPO0UIgZGroyUZJcWlUkwrkdE5T4cg9zP14M6zmogAYEI7oRX56FyspRVlA7J6VF/mcZ1z6ufH+97cle613gPKUVkpw== andis@fet.at"
-  - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKrEdkD1Oecw++r77MVrga1e20FA+e/O37rhMc0etS5MvlbsAHd6Ftx2SIXVtwDnHDzyUAOJb8WlYPdG5r/QJYtXgVMGZrZ31UFdlAZq3K8ytczKkcMgnEEOWYSSyQRJlEW5LkZ9tD0hv1myIg5iw6Vpuqe6YFSkdDHtGxf0lnLAfi1XKwu7b7tARJz7teOAjaFzXumvsZlFx9BdufMW32uu7BSYWjSGcrEzMyyB/5C3kU/d5Q1ZTNK6tceopFr/K1lKBzvj85safD5BH8NpjvLe1QkzHu+C0AVxYNtqGHI5oWJbcR+UOwelBeEM/On+/Xq0ZIVmiLmFx03Qun8t1n berni@fet.at"
+  - key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDKrEdkD1Oecw++r77MVrga1e20FA+e/O37rhMc0etS5MvlbsAHd6Ftx2SIXVtwDnHDzyUAOJb8WlYPdG5r/QJYtXgVMGZrZ31UFdlAZq3K8ytczKkcMgnEEOWYSSyQRJlEW5LkZ9tD0hv1myIg5iw6Vpuqe6YFSkdDHtGxf0lnLAfi1XKwu7b7tARJz7teOAjaFzXumvsZlFx9BdufMW32uu7BSYWjSGcrEzMyyB/5C3kU/d5Q1ZTNK6tceopFr/K1lKBzvj85safD5BH8NpjvLe1QkzHu+C0AVxYNtqGHI5oWJbcR+UOwelBeEM/On+/Xq0ZIVmiLmFx03Qun8t1n berni@fet.at"
-  - 'no-pty,no-agent-forwarding,no-X11-forwarding,command="shutdown -h +1" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCiI41+XkobMT0K8ZrHdCeomdGAIRMZbdX1VjGe5OWa72rcaDFmBtK7MxD5xPZEdSaDkn+Nrpwv5/j10MccvkAOI/tx6PIxcgDF52FnHLMMVrXRM3cnkm9CrBi4kCN0D2fpbDLhknJhiqftIcPdct/a9foZQwkWOzGUN2Rk0mCw2QzkGyWHNxOMzMjV0gpfAWPv6Jg+JKDl5EHf2xJTeJ/l0TG6O0lsc5YY/7cqjRJJzTVFDo1Gy+qNgff0mbPrhcbWepG5R1tjkdT++f8uuoVkBUamwkjwDpH2y57sdESEPB0C5ES2cglOp2X3MMN7EnUBHYU3mMiYU0wV+b7Q3oKmQuG86a2D+yEp+0+WFaUY/TMCNpslGOtTBrNLshMIX/bnrx/aF9DApl9L/kUIlSxwwBNiPIl4VVU1p5Zzj/YAPvRl0kAKjosOZgl108JeRUbhQSGVrcODyhaIMQv4BAzHnV0kii7jNACHhqBR36eo3N6HX7GkbnU1YadZRcrxrpE9z9mrXuqWxzl4Cmz1yHb1JTwsnQQ2Dy0trIklQjEmLxvG8zpxHLV3EQmtIMK/g2Mk6VTdz9HZnwYLU7Mj/uZk0DWhTZ5Eyj6QAbcw2gLPLEUmdQhkHSoQKxHY0at3OjGFGydyc/3n7B7d578uxVBrp04uhTbW7SDi6mYGCkvCRQ== nut ups shutdown'
+  - key: 'no-pty,no-agent-forwarding,no-X11-forwarding,command="shutdown -h +1" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCiI41+XkobMT0K8ZrHdCeomdGAIRMZbdX1VjGe5OWa72rcaDFmBtK7MxD5xPZEdSaDkn+Nrpwv5/j10MccvkAOI/tx6PIxcgDF52FnHLMMVrXRM3cnkm9CrBi4kCN0D2fpbDLhknJhiqftIcPdct/a9foZQwkWOzGUN2Rk0mCw2QzkGyWHNxOMzMjV0gpfAWPv6Jg+JKDl5EHf2xJTeJ/l0TG6O0lsc5YY/7cqjRJJzTVFDo1Gy+qNgff0mbPrhcbWepG5R1tjkdT++f8uuoVkBUamwkjwDpH2y57sdESEPB0C5ES2cglOp2X3MMN7EnUBHYU3mMiYU0wV+b7Q3oKmQuG86a2D+yEp+0+WFaUY/TMCNpslGOtTBrNLshMIX/bnrx/aF9DApl9L/kUIlSxwwBNiPIl4VVU1p5Zzj/YAPvRl0kAKjosOZgl108JeRUbhQSGVrcODyhaIMQv4BAzHnV0kii7jNACHhqBR36eo3N6HX7GkbnU1YadZRcrxrpE9z9mrXuqWxzl4Cmz1yHb1JTwsnQQ2Dy0trIklQjEmLxvG8zpxHLV3EQmtIMK/g2Mk6VTdz9HZnwYLU7Mj/uZk0DWhTZ5Eyj6QAbcw2gLPLEUmdQhkHSoQKxHY0at3OjGFGydyc/3n7B7d578uxVBrp04uhTbW7SDi6mYGCkvCRQ== nut ups shutdown'
-
+    state: present
--- a/group_vars/fet_hosts
+++ b/group_vars/fet_hosts
@@ -24,9 +24,11 @@ common_basic_packages:
  - python3-apt
  - python3-pycurl
  # extra
-  - lshw
+  - cgroupfs-mount
  - gdisk
  - cryptsetup
  - fuse
  - gdisk
  - lshw
  - nvme-cli
 common_sysctl: True
--- a/group_vars/fet_lxc_void
+++ b/group_vars/fet_lxc_void
@@ -1,2 +1,19 @@
 ---
 common_apt: False
 common_xbps: True
 common_basic_packages:
  - curl
  - ncurses-term
  - etckeeper
  - git
  - htop
  - logrotate
  - ncdu
  - rsync
  - strace
  - sudo
  - screen
  - tmux
  - tree
  - vim
  - zsh
--- a/host_vars/ariane
+++ b/host_vars/ariane
@@ -2,6 +2,7 @@
 inventory_hostname: ariane.fet.htu.tuwien.ac.at
 inventory_hostname_short: ariane
 common_interfaces: interfaces_ariane.j2
 common_iptables_v4: "iptables_ariane_v4.j2"
 common_iptables_v6: "iptables_ariane_v6.j2"
@@ -33,6 +34,28 @@ lxc:
      - lxc.network.hwaddr = 2e:6d:b6:07:15:01
      - lxc.pts = 6
  - name: progress
    revision: "01"
    template: voidlinux
    config:
      - lxc.network.type = veth
      - lxc.network.hwaddr = 2e:6d:b6:07:19:01
      - lxc.network.link = br0
      - lxc.network.flags = up
      - lxc.pts = 6
      - lxc.mount.entry = /zv1/daten/Scans /var/lib/lxc/lxc-progress-01/rootfs/mnt/scans none bind,create=dir 0 0
  - name: sojus
    revision: "01"
    template: voidlinux
    config:
      - lxc.network.type = veth
      - lxc.network.hwaddr = 2e:6d:b6:07:17:01
      - lxc.network.link = br0
      - lxc.network.flags = up
      - lxc.pts = 6
      - lxc.mount.entry = /zv1/sojus /var/lib/lxc/lxc-sojus-01/rootfs/home/backup/repos none bind,create=dir 0 0
  - name: proteus
    revision: "01"
    template: debian
--- a/host_vars/backup01
+++ b/host_vars/backup01
@@ -1 +0,0 @@
 inventory_hostname_short: backup01
--- a/host_vars/baroness
+++ b/host_vars/baroness
@@ -0,0 +1,42 @@
 inventory_hostname: baroness.fet.htu.tuwien.ac.at
 inventory_hostname_short: baroness
 borgbackup_binary_version: "1.1.6"
 borgbackup_binary_platform: "armv6"
 borgbackup_binary_uri: "https://borg.bauerj.eu/borg-{{ borgbackup_binary_version }}-{{ borgbackup_binary_platform }}"
 borgbackup_encryption_mode: "none"
 borgbackup_client_backup_server: sojus
 borgbackup_create_jobs:
  - name: system
    options: "--lock-wait 1800"
    day: "*"
    hour: "*"                                                   # default value = 1
    minute: 0                                                   # default value = 0
    random_minute: 59                                           # default value : ignore randomization
    directories:
      - "/home/pi/baroness"
    excludes: []
 borgbackup_prune_enabled: yes
 borgbackup_prune_jobs:
  - name: system
    prune_options: "--lock-wait 1800 --keep-daily=750 --keep-weekly=52 --keep-monthly=24 --keep-yearly=-1"
    day: "*"
    hour: 12                                                     # default value = 1
    minute: 0                                                    # default value = 0
    random_hour: 5                                               # default value : ignore randomization
    random_minute: 59                                            # default value : ignore randomization
 borgbackup_check_enabled: yes
 borgbackup_check_jobs:
  - name: system
    check_options: "--lock-wait 28800"
    day: 1
    hour: 12                                                     # default value = 1
    minute: 0                                                    # default value = 0
    random_hour: 5                                               # default value : ignore randomization
    random_minute: 59                                            # default value : ignore randomization
    random_day: 27                                               # default value : ignore randomization
--- a/host_vars/lxc-betam-01
+++ b/host_vars/lxc-betam-01
--- a/host_vars/buran
+++ b/host_vars/buran
@@ -0,0 +1,44 @@
 inventory_hostname: buran.fet.htu.tuwien.ac.at
 inventory_hostname_short: buran
 borgbackup_install_from_repo: False
 borgbackup_binary_platform: "borg-linux32"
 borgbackup_encryption_mode: "none"
 borgbackup_client_backup_server: sojus
 borgbackup_create_jobs:
  - name: system
    options: "--lock-wait 7200"
    day: "*"
    hour: 0                                                     # default value = 1
    minute: 0                                                   # default value = 0
    random_hour: 5                                              # default value : ignore randomization
    random_minute: 59                                           # default value : ignore randomization
    directories:
      - "/var/lib/cyrus"
      - "/var/spool/cyrus/mail"
      - "/var/spool/sieve"
    excludes: []
 borgbackup_prune_enabled: yes
 borgbackup_prune_jobs:
  - name: system
    prune_options: "--lock-wait 7200 --keep-daily=7 --keep-weekly=4 --keep-monthly=12 --keep-yearly=-1"
    day: "*"
    hour: 12                                                     # default value = 1
    minute: 0                                                    # default value = 0
    random_hour: 5                                               # default value : ignore randomization
    random_minute: 59                                            # default value : ignore randomization
 borgbackup_check_enabled: yes
 borgbackup_check_jobs:
  - name: system
    check_options: "--lock-wait 28800"
    day: 1
    hour: 12                                                     # default value = 1
    minute: 0                                                    # default value = 0
    random_hour: 5                                               # default value : ignore randomization
    random_minute: 59                                            # default value : ignore randomization
    random_day: 27                                               # default value : ignore randomization
--- a/host_vars/lxc-laika-01
+++ b/host_vars/lxc-laika-01
--- a/host_vars/maria-storage
+++ b/host_vars/maria-storage
@@ -0,0 +1,42 @@
 inventory_hostname: maria-storage.fet.htu.tuwien.ac.at
 inventory_hostname_short: maria-storage
 borgbackup_install_from_repo: False
 borgbackup_encryption_mode: "none"
 borgbackup_client_backup_server: sojus
 borgbackup_create_jobs:
  - name: system
    options: "--lock-wait 7200"
    day: "*"
    hour: 0                                                     # default value = 1
    minute: 0                                                   # default value = 0
    random_hour: 5                                              # default value : ignore randomization
    random_minute: 59                                           # default value : ignore randomization
    directories:
      - "/var/lib/mysql"
      - "/srv/save"
    excludes: []
 borgbackup_prune_enabled: yes
 borgbackup_prune_jobs:
  - name: system
    prune_options: "--lock-wait 7200 --keep-daily=7 --keep-weekly=4 --keep-monthly=12 --keep-yearly=-1"
    day: "*"
    hour: 12                                                     # default value = 1
    minute: 0                                                    # default value = 0
    random_hour: 5                                               # default value : ignore randomization
    random_minute: 59                                            # default value : ignore randomization
 borgbackup_check_enabled: yes
 borgbackup_check_jobs:
  - name: system
    check_options: "--lock-wait 28800"
    day: 1
    hour: 12                                                     # default value = 1
    minute: 0                                                    # default value = 0
    random_hour: 5                                               # default value : ignore randomization
    random_minute: 59                                            # default value : ignore randomization
    random_day: 27                                               # default value : ignore randomization
--- a/host_vars/nauka
+++ b/host_vars/nauka
@@ -0,0 +1,42 @@
 inventory_hostname: nauka.fet.htu.tuwien.ac.at
 inventory_hostname_short: nauka
 borgbackup_install_from_repo: False
 borgbackup_encryption_mode: "none"
 borgbackup_client_backup_server: sojus
 borgbackup_create_jobs:
  - name: system
    options: "--lock-wait 7200"
    day: "*"
    hour: 0                                                     # default value = 1
    minute: 0                                                   # default value = 0
    random_hour: 5                                              # default value : ignore randomization
    random_minute: 59                                           # default value : ignore randomization
    directories:
      - "/var/lib/mysql"
      - "/var/www"
    excludes: []
 borgbackup_prune_enabled: yes
 borgbackup_prune_jobs:
  - name: system
    prune_options: "--lock-wait 7200 --keep-daily=7 --keep-weekly=4 --keep-monthly=12 --keep-yearly=-1"
    day: "*"
    hour: 12                                                     # default value = 1
    minute: 0                                                    # default value = 0
    random_hour: 5                                               # default value : ignore randomization
    random_minute: 59                                            # default value : ignore randomization
 borgbackup_check_enabled: yes
 borgbackup_check_jobs:
  - name: system
    check_options: "--lock-wait 28800"
    day: 1
    hour: 12                                                     # default value = 1
    minute: 0                                                    # default value = 0
    random_hour: 5                                               # default value : ignore randomization
    random_minute: 59                                            # default value : ignore randomization
    random_day: 27                                               # default value : ignore randomization
--- a/host_vars/lxc-pet-01
+++ b/host_vars/lxc-pet-01
--- a/host_vars/progress
+++ b/host_vars/progress
@@ -0,0 +1,6 @@
 inventory_hostname: progress.fet.htu.tuwien.ac.at
 inventory_hostname_short: progress
 common_iptables_v4: "iptables_progress_v4.j2"
 common_iptables_v6: "iptables_progress_v6.j2"
 printer_ip: 192.168.86.14
--- a/host_vars/lxc-proteus-01
+++ b/host_vars/lxc-proteus-01
--- a/host_vars/sojus
+++ b/host_vars/sojus
@@ -0,0 +1,7 @@
 inventory_hostname: sojus.fet.htu.tuwien.ac.at
 inventory_hostname_short: sojus
 borgbackup_install_from_repo: True
 borgbackup_binary: "/usr/bin/borg"
 borgbackup_encryption_mode: "none"
--- a/host_vars/lxc-zyklon-01
+++ b/host_vars/lxc-zyklon-01
--- a/hosts/production
+++ b/hosts/production
@@ -13,5 +13,15 @@ all:
    fet_lxc_void:
      hosts:
        zyklon:
        sojus:
        progress:
    fet_qemu:
      hosts:
        maria-storage:
        buran:
        nauka:
    fet_pi:
      hosts:
        baroness:
  vars:
    ansible_python_interpreter=/usr/bin/python3
--- a/roles/backup/defaults/main.yml
+++ b/roles/backup/defaults/main.yml
@@ -1,2 +0,0 @@
 ---
 backup_borg: True
--- a/roles/backup/tasks/borg.yml
+++ b/roles/backup/tasks/borg.yml
@@ -1,21 +0,0 @@
 ---
 - name: install borg
  package: name="borgbackup" state=present
 - name: create repositories
  file:
    path: "{{item.path}}"
    state: directory
  with_items: "{{backup.repositories}}"
 - name: init borg repositories
  command: "borg init {{item.path}} --encryption=none"
  args:
    creates: "{{item.path}}/README"
  with_items: "{{backup.repositories}}"
 - name: create READMES
  template:
    src=borg_README.j2
    dest="{{item.path}}/README"
  with_items: "{{backup.repositories}}"
--- a/roles/backup/tasks/main.yml
+++ b/roles/backup/tasks/main.yml
@@ -1,4 +0,0 @@
 ---
 - import_tasks: borg.yml
  when: backup_borg
  tags: ['backup', 'borg']
--- a/roles/backup/templates/borg_README.j2
+++ b/roles/backup/templates/borg_README.j2
@@ -1,2 +0,0 @@
 This is a generate FET borg repository.
 Name: {{item.name}}
--- a/roles/backupclient/defaults/main.yml
+++ b/roles/backupclient/defaults/main.yml
@@ -1,2 +0,0 @@
 ---
 backup_borg: True
--- a/roles/backupclient/tasks/borg.yml
+++ b/roles/backupclient/tasks/borg.yml
@@ -1,27 +0,0 @@
 ---
 - name: install borg
  package: name="borgbackup" state=present
 - name: create backup user
  user:
    name: borg_backup
    comment: "BackupUser für BORG Backup"
    group: root
    generate_ssh_key: yes
    ssh_key_bits: 4096
    ssh_key_file: .ssh/id_rsa
 - name: fetch pubickey
  shell: "cat /home/borg_backup/.ssh/id_rsa.pub"
  register: id_rsa_pub
  changed_when: false
 - name: Add authorized key to borg backup servers
  authorized_key:
    user: "root"
    key: "{{id_rsa_pub.stdout}}"
    key_options: 'command="borg serve --restrict-to-path /srv/rep1"'
  delegate_to: "{{item}}"
  with_items: "{{groups['backup']}}"
  when: id_rsa_pub.stdout is defined
--- a/roles/backupclient/tasks/main.yml
+++ b/roles/backupclient/tasks/main.yml
@@ -1,4 +0,0 @@
 ---
 - import_tasks: borg.yml
  when: backup_borg
  tags: ['backup', 'borg']
--- a/roles/borg_client/.travis.yml
+++ b/roles/borg_client/.travis.yml
@@ -0,0 +1,29 @@
 ---
 language: python
 python: "2.7"
 # Use the new container infrastructure
 sudo: false
 # Install ansible
 addons:
  apt:
    packages:
    - python-pip
 install:
  # Install ansible
  - pip install ansible
  # Check ansible version
  - ansible --version
  # Create ansible.cfg with correct roles_path
  - printf '[defaults]\nroles_path=../' >ansible.cfg
 script:
  # Basic role syntax check
  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
 notifications:
  webhooks: https://galaxy.ansible.com/api/v1/notifications/
--- a/roles/borg_client/LICENSE
+++ b/roles/borg_client/LICENSE
@@ -0,0 +1,201 @@
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/
   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
   1. Definitions.
      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.
      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.
      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.
      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.
      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.
      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.
      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).
      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.
      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."
      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.
   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.
   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.
   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:
      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and
      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and
      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and
      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.
      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.
   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.
   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.
   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.
   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.
   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.
   END OF TERMS AND CONDITIONS
   APPENDIX: How to apply the Apache License to your work.
      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "{}"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.
   Copyright {yyyy} {name of copyright owner}
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at
       http://www.apache.org/licenses/LICENSE-2.0
   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
--- a/roles/borg_client/README.md
+++ b/roles/borg_client/README.md
@@ -0,0 +1,59 @@
 Borgbackup
 ==========
 Ansible [Borgbackup](https://borgbackup.readthedocs.io/en/stable/) role.
 Features:
 * Repository or binary installation
 * Schedules regular backup jobs
 * Schedules regular prune jobs to keep backup windows clean
 * Flexible configuration to list backup targets
 Role Variables
 --------------
 see `defaults/main.yml`
 Example Playbook
 ----------------
    - hosts: all
      roles:
        - role: SphericalElephant.borgbackup
          borgbackup_client: True
          borgbackup_client_backup_server: backup01.example.com
          borgbackup_create_jobs:
            - name: system
              day: "*"
              hour: "0"
              minute: "{{ 59 | random }}"
              directories:
                - /etc
                - /home
                - /var
              excludes:
                - 're:^/var/lib/apt'
                - 're:^/var/[^/]+\/cache/'
          borgbackup_prune_jobs:
            - name: system
              prune_options: "--keep-daily=7 --keep-weekly=4"
              day: "*"
              hour: "8"
              minute: "0"
          borgbackup_check_jobs:
            - name: system
              check_options: "--lock-wait 28800"
              day: "1"
              hour: "12"
              minute: "0"
 You can easily assign client and server attributes from your inventory with something similar to the following:
    borgbackup_client: "{{ (inventory_hostname in groups.borgbackup_server)|ternary(False, True) }}"
    borgbackup_client_backup_server: "{{ groups.borgbackup_server[0] }}"
 License
 -------
 Apache 2.0
--- a/roles/borg_client/defaults/main.yml
+++ b/roles/borg_client/defaults/main.yml
@@ -0,0 +1,77 @@
 ---
 borgbackup_install_from_repo: False
 borgbackup_binary_version: "1.1.6"
 borgbackup_binary_platform: "borg-linux64"
 borgbackup_binary_uri: "https://github.com/borgbackup/borg/releases/download/{{ borgbackup_binary_version }}/{{ borgbackup_binary_platform }}"
 borgbackup_binary: "/usr/local/bin/borg"
 borgbackup_encryption_mode: "none"
 borgbackup_passphrase: "yoursecret"
 borgbackup_server_user: "backup"
 borgbackup_server_group: "backup"
 borgbackup_server_home: "/home/backup"
 borgbackup_server_pool: "{{ borgbackup_server_home }}/repos"
 borgbackup_client_ssh_key_type: '{{ "ed25519"
                            if ("ssh-ed25519" in borgbackup_register_key_types.stdout_lines)
                            else "rsa" }}'
 borgbackup_client_ssh_key_file: "/root/.ssh/id_{{ borgbackup_client_ssh_key_type }}-backup"
 borgbackup_client_ssh_key_comment: 'root@{{ ansible_hostname }} generated by Ansible'
 borgbackup_client_scripts_dir: "/etc/borg"
 borgbackup_client_lastlog_dir: "/var/log/borg"
 # backup server IP or FQDN used during ansible installation AND backup operation.
 borgbackup_client_backup_server:
 # if defined, IP or FQDN used on backup operation. Usefull in case of LAN-free backup
 #borgbackup_client_backup_server_lanfreebackup:
 # you have to set at least a "create" job.
 # "prune" and "checks" jobs are optionnal, but you should use it too.
 borgbackup_create_jobs:
 # borgbackup jobs examples :
 #borgbackup_create_jobs:
 #  - name: system
 #    options: "--lock-wait 7200 --compression lzma"
 #    day: "*"
 #    hour: 0                                                     # default value = 1
 #    minute: 0                                                   # default value = 0
 #    random_hour: 5                                              # default value : ignore randomization
 #    random_minute: 59                                           # default value : ignore randomization
 #    directories:
 #      - "/etc/"
 #      - "/home"
 #    excludes: []
 borgbackup_prune_enabled: yes
 #borgbackup_prune_jobs:
 #  - name: system
 #    prune_options: "--lock-wait 7200 --keep-daily=7 --keep-weekly=4 --keep-monthly=12 --keep-yearly=-1"
 #    day: "*"
 #    hour: 12                                                     # default value = 1
 #    minute: 0                                                    # default value = 0
 #    random_hour: 5                                               # default value : ignore randomization
 #    random_minute: 59                                            # default value : ignore randomization
 borgbackup_check_enabled: yes
 #borgbackup_check_jobs:
 #  - name: system
 #    check_options: "--lock-wait 28800"
 #    day: 1
 #    hour: 12                                                     # default value = 1
 #    minute: 0                                                    # default value = 0
 #    random_hour: 5                                               # default value : ignore randomization
 #    random_minute: 59                                            # default value : ignore randomization
 #    random_day: 27                                               # default value : ignore randomization
 # about random :
 # TL;DR : if 'random_hour' is set, then 'hour' will be set by a random value within range 'hour' up to 'hour+random_hour'
 # purpose is to set indempotent random crontab values. Usefull when many jobs are croned toward a small number of repository servers.
 # random_hour : if defined, a indempotent random value is computed between 0 and the value specified.
 # Then, the crontab hour will be addition of hour and random_hour.
 # a modulo 24 is applied in order to ensure valid hour are specified.
 # random_minute and random_day works the same way.
--- a/roles/borg_client/meta/main.yml
+++ b/roles/borg_client/meta/main.yml
@@ -0,0 +1,20 @@
 galaxy_info:
  author: Farhad Shahbazi
  description: Borgbackup
  company: Spherical Elephant GmbH
  license: Apache
  min_ansible_version: 2.1
  platforms:
  - name: Ubuntu
    versions:
    - all
  - name: Debian
    versions:
    - jessie
    - sid
    - stretch
  - name: Archlinux
  galaxy_tags:
  - backup
 dependencies: []
--- a/roles/borg_client/tasks/borgbackup_client.yml
+++ b/roles/borg_client/tasks/borgbackup_client.yml
@@ -0,0 +1,191 @@
 ---
 - name: check available SSH key types
  shell: ssh -Q key 2>/dev/null || echo "ssh-rsa"
  register: borgbackup_register_key_types
  changed_when: False
  check_mode: no
 - name: generate backup ssh-key
  user:
    name: root
    ssh_key_file: "{{ borgbackup_client_ssh_key_file }}"
    ssh_key_type: "{{ borgbackup_client_ssh_key_type }}"
    ssh_key_comment: "{{ borgbackup_client_ssh_key_comment }}"
    ssh_key_bits: 4096
    generate_ssh_key: yes
 - name: fetch backup ssh-pubkey
  command: "cat {{ borgbackup_client_ssh_key_file }}.pub"
  check_mode: no
  register: borgbackup_client_ssh_pubkey_file
  changed_when: False
 - name: add ssh-pubkey to backup server
  delegate_to: "{{ borgbackup_client_backup_server }}"
  # Start the delegate from the ansible master to avoid distributing more keys
  connection: local
  authorized_key:
    user: "{{ borgbackup_server_user }}"
    key: "{{ borgbackup_client_ssh_pubkey_file.stdout }}"
    key_options: 'command="cd {{ borgbackup_server_pool }}/{{ inventory_hostname }};borg serve --restrict-to-path {{ borgbackup_server_pool }}/{{ inventory_hostname }}",restrict'
 - name: create repo path for host
  delegate_to: "{{ borgbackup_client_backup_server }}"
  # Start the delegate from the ansible master to avoid distributing more keys
  connection: local
  file:
    path: "{{ borgbackup_server_pool }}/{{ inventory_hostname }}"
    owner: "{{ borgbackup_server_user }}"
    group: "{{ borgbackup_server_group }}"
    mode: 0700
    state: directory
 - name: backup scripts dir
  file:
    path: "{{ borgbackup_client_scripts_dir }}"
    owner: root
    group: root
    mode: 0750
    state: directory
 - name: backup supervision lastlog dir
  file:
    path: "{{ borgbackup_client_lastlog_dir }}"
    owner: root
    group: root
    mode: 0755
    state: directory
 - name: check if the repositories already exist
  command: "{{ borgbackup_binary }} list {{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}"
  environment:
    - BORG_RSH: "ssh -o StrictHostKeyChecking=no -i {{ borgbackup_client_ssh_key_file }}"
    - BORG_PASSPHRASE: "{{ borgbackup_passphrase }}"
  with_items: "{{ borgbackup_create_jobs }}"
  register: list_repos
  failed_when: False
  changed_when: False
  check_mode: no
 - name: initialize empty list of initialized repositories
  set_fact:
    initialized_repos: []
 - name: store only initialized repositories in the list
  set_fact:
    initialized_repos: "{{ initialized_repos }} + [ '{{ item.item.name }}' ]"
  with_items: "{{ list_repos.results }}"
  when: item.rc == 0
 - name: initialize repositories
  command: "{{ borgbackup_binary }} init --encryption {{ borgbackup_encryption_mode }} {{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}"
  environment:
    - BORG_RSH: "ssh -o StrictHostKeyChecking=no -i {{ borgbackup_client_ssh_key_file }}"
    - BORG_PASSPHRASE: "{{ borgbackup_passphrase }}"
  with_items: "{{ borgbackup_create_jobs }}"
  register: borgbackup_initialize_result
  failed_when: (borgbackup_initialize_result.rc != 0) and (borgbackup_initialize_result.stderr != "") and ('already exists' not in borgbackup_initialize_result.stderr)
  when: item.name not in initialized_repos
 - name: generate filename for create / prune / check scripts
  set_fact:
    create_suffix_script_filename: "create_{{ borgbackup_client_backup_server.split('.')[0] }}"
    prune_suffix_script_filename: "prune_{{ borgbackup_client_backup_server.split('.')[0] }}"
    check_suffix_script_filename: "check_{{ borgbackup_client_backup_server.split('.')[0] }}"
 #
 # borg create scripts
 #
 - name: deploy borg create scripts
  template:
    dest: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.sh"
    src: create_job.sh.j2
    owner: root
    group: root
    mode: 0700
  with_items: "{{ borgbackup_create_jobs }}"
 - name: schedule borg create scripts on cron
  cron:
    name: "borg backup {{ item.name }}"
    user: root
    job: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.sh 2>&1 | /usr/bin/logger -t borgbackup"
    day: "{{ (item.day | default(1)) + (item.random_day | random(seed=item.name + check_suffix_script_filename + ansible_host))%28 if item.random_day is defined else item.day | default('*') }}"
    hour: "{{ (item.hour | default(1)) + (item.random_hour | random(seed=item.name + create_suffix_script_filename + ansible_host))%24 if item.random_hour is defined else item.hour | default(1) }}"
    minute: "{{ (item.minute | default(0)) + (item.random_minute | random(seed=ansible_host + item.name + create_suffix_script_filename))%60 if item.random_minute is defined else item.minute | default(0) }}"
    state: present
    cron_file: "borgbackup_{{ item.name }}_{{ create_suffix_script_filename }}"
  with_items: "{{ borgbackup_create_jobs }}"
 - name: deploy borg create fake logs, when no log yet
  shell: echo -ne "FAKE LOG\nterminating with success status, rc 0\n" | tee "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.lastlog"
  args:
    chdir: "{{ borgbackup_client_lastlog_dir }}"
    creates: "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.lastlog"
  with_items: "{{ borgbackup_create_jobs }}"
 #
 # borg prune scripts
 #
 - name: deploy borg prune scripts
  template:
    dest: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.sh"
    src: prune_job.sh.j2
    owner: root
    group: root
    mode: 0700
  with_items: "{{ borgbackup_prune_jobs }}"
  when: borgbackup_prune_enabled
 - name: schedule borg prune scripts on cron
  cron:
    name: "borg prune {{ item.name }}"
    user: root
    job: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.sh 2>&1 | /usr/bin/logger -t borgbackup"
    day: "{{ (item.day | default(1)) + (item.random_day | random(seed=item.name + check_suffix_script_filename + ansible_host))%28 if item.random_day is defined else item.day | default('*') }}"
    hour: "{{ (item.hour | default(1)) + (item.random_hour | random(seed=item.name + prune_suffix_script_filename + ansible_host))%24 if item.random_hour is defined else item.hour | default(2) }}"
    minute: "{{ (item.minute | default(0)) + (item.random_minute | random(seed=ansible_host + item.name + prune_suffix_script_filename))%60 if item.random_minute is defined else item.minute | default(0) }}"
    state: present
    cron_file: "borgbackup_{{ item.name }}_{{ prune_suffix_script_filename }}"
  with_items: "{{ borgbackup_prune_jobs }}"
  when: borgbackup_prune_enabled
 - name: deploy borg prune fake logs, when no log yet
  shell: echo -ne "FAKE LOG\nterminating with success status, rc 0\n" | tee "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.lastlog"
  args:
    chdir: "{{ borgbackup_client_lastlog_dir }}"
    creates: "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.lastlog"
  with_items: "{{ borgbackup_prune_jobs }}"
 #
 # borg check scripts
 #
 - name: deploy borg check scripts
  template:
    dest: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.sh"
    src: check_job.sh.j2
    owner: root
    group: root
    mode: 0700
  with_items: "{{ borgbackup_check_jobs }}"
  when: borgbackup_check_enabled
 - name: schedule borg check scripts on cron
  cron:
    name: "borg check {{ item.name }}"
    user: root
    job: "{{ borgbackup_client_scripts_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.sh 2>&1 | /usr/bin/logger -t borgbackup"
    day: "{{ (item.day | default(1)) + (item.random_day | random(seed=item.name + check_suffix_script_filename + ansible_host))%28 if item.random_day is defined else item.day | default(1) }}"
    hour: "{{ (item.hour | default(1)) + (item.random_hour | random(seed=item.name + check_suffix_script_filename + ansible_host))%24 if item.random_hour is defined else item.hour | default(3) }}"
    minute: "{{ (item.minute | default(0)) + (item.random_minute | random(seed=ansible_host + item.name + check_suffix_script_filename))%60 if item.random_minute is defined else item.minute | default(0) }}"
    state: present
    cron_file: "borgbackup_{{ item.name }}_{{ check_suffix_script_filename }}"
  with_items: "{{ borgbackup_check_jobs }}"
  when: borgbackup_check_enabled
 - name: deploy borg check fake logs, when no log yet
  shell: echo -ne "FAKE LOG\nterminating with success status, rc 0\n" | tee "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.lastlog"
  args:
    chdir: "{{ borgbackup_client_lastlog_dir }}"
    creates: "{{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.lastlog"
  with_items: "{{ borgbackup_check_jobs }}"
--- a/roles/borg_client/tasks/borgbackup_install.yml
+++ b/roles/borg_client/tasks/borgbackup_install.yml
@@ -0,0 +1,21 @@
 ---
 - name: borgbackup - download borg binary
  get_url:
    url: "{{ borgbackup_binary_uri }}"
    dest: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
    mode: "755"
  when: not borgbackup_install_from_repo
 - name: borgbackup - link install
  file:
    src: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
    dest: "{{ borgbackup_binary }}"
    state: link
    force: yes
  when: not borgbackup_install_from_repo
 - name: borgbackup - install borgbackup
  package:
    name: borg
    state: latest
  when: borgbackup_install_from_repo
--- a/roles/borg_client/tasks/main.yml
+++ b/roles/borg_client/tasks/main.yml
@@ -0,0 +1,6 @@
 ---
 - import_tasks: borgbackup_install.yml
  tags: [ borg ]
 - import_tasks: borgbackup_client.yml
  tags: [ borg ]
--- a/roles/borg_client/templates/check_job.sh.j2
+++ b/roles/borg_client/templates/check_job.sh.j2
@@ -0,0 +1,14 @@
 #!/bin/sh
 set -e
 export BORG_RSH="ssh -i {{ borgbackup_client_ssh_key_file }}"
 export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"
 REPOSITORY={{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}
 {{ borgbackup_binary }} check --show-rc --verbose \
  {{ item.check_options }} \
  $REPOSITORY \
  2>&1 | tee {{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ check_suffix_script_filename }}.lastlog \
  | /usr/bin/logger -t borgbackup_check_{{ item.name }}_{{ borgbackup_client_backup_server }}
--- a/roles/borg_client/templates/create_job.sh.j2
+++ b/roles/borg_client/templates/create_job.sh.j2
@@ -0,0 +1,18 @@
 #!/bin/sh
 set -e
 export BORG_RSH="ssh -i {{ borgbackup_client_ssh_key_file }}"
 export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"
 REPOSITORY={{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}
 {{ borgbackup_binary }} create --show-rc --verbose --stats \
  {{ item.options | default('--compression zlib,6') }} \
  $REPOSITORY::{{ ansible_hostname }}-$(date +%Y-%m-%d_%H-%M) \
  {{ item.directories | join(' ') }} \
  {% for e in item.excludes %}
  --exclude '{{ e }}' \
  {% endfor %}
  2>&1 | tee {{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ create_suffix_script_filename }}.lastlog \
  | /usr/bin/logger -t borgbackup_backup_{{ item.name }}_{{ borgbackup_client_backup_server }}
--- a/roles/borg_client/templates/prune_job.sh.j2
+++ b/roles/borg_client/templates/prune_job.sh.j2
@@ -0,0 +1,14 @@
 #!/bin/sh
 set -e
 export BORG_RSH="ssh -i {{ borgbackup_client_ssh_key_file }}"
 export BORG_PASSPHRASE="{{ borgbackup_passphrase }}"
 REPOSITORY={{ borgbackup_server_user }}@{{ borgbackup_client_backup_server_lanfreebackup | default(borgbackup_client_backup_server) }}:{{ item.name }}
 {{ borgbackup_binary }} prune --show-rc --verbose --stats \
  {{ item.prune_options }} \
  $REPOSITORY \
  2>&1 | tee {{ borgbackup_client_lastlog_dir }}/{{ item.name }}_{{ prune_suffix_script_filename }}.lastlog \
  | /usr/bin/logger -t borgbackup_prune_{{ item.name }}_{{ borgbackup_client_backup_server }}
--- a/roles/borg_server/.travis.yml
+++ b/roles/borg_server/.travis.yml
@@ -0,0 +1,29 @@
 ---
 language: python
 python: "2.7"
 # Use the new container infrastructure
 sudo: false
 # Install ansible
 addons:
  apt:
    packages:
    - python-pip
 install:
  # Install ansible
  - pip install ansible
  # Check ansible version
  - ansible --version
  # Create ansible.cfg with correct roles_path
  - printf '[defaults]\nroles_path=../' >ansible.cfg
 script:
  # Basic role syntax check
  - ansible-playbook tests/test.yml -i tests/inventory --syntax-check
 notifications:
  webhooks: https://galaxy.ansible.com/api/v1/notifications/
--- a/roles/borg_server/LICENSE
+++ b/roles/borg_server/LICENSE
@@ -0,0 +1,201 @@
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/
   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
   1. Definitions.
      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.
      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.
      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.
      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.
      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.
      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.
      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).
      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.
      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."
      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.
   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.
   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.
   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:
      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and
      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and
      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and
      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.
      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.
   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.
   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.
   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.
   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.
   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.
   END OF TERMS AND CONDITIONS
   APPENDIX: How to apply the Apache License to your work.
      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "{}"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.
   Copyright {yyyy} {name of copyright owner}
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at
       http://www.apache.org/licenses/LICENSE-2.0
   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
--- a/roles/borg_server/README.md
+++ b/roles/borg_server/README.md
@@ -0,0 +1,59 @@
 Borgbackup
 ==========
 Ansible [Borgbackup](https://borgbackup.readthedocs.io/en/stable/) role.
 Features:
 * Repository or binary installation
 * Schedules regular backup jobs
 * Schedules regular prune jobs to keep backup windows clean
 * Flexible configuration to list backup targets
 Role Variables
 --------------
 see `defaults/main.yml`
 Example Playbook
 ----------------
    - hosts: all
      roles:
        - role: SphericalElephant.borgbackup
          borgbackup_client: True
          borgbackup_client_backup_server: backup01.example.com
          borgbackup_create_jobs:
            - name: system
              day: "*"
              hour: "0"
              minute: "{{ 59 | random }}"
              directories:
                - /etc
                - /home
                - /var
              excludes:
                - 're:^/var/lib/apt'
                - 're:^/var/[^/]+\/cache/'
          borgbackup_prune_jobs:
            - name: system
              prune_options: "--keep-daily=7 --keep-weekly=4"
              day: "*"
              hour: "8"
              minute: "0"
          borgbackup_check_jobs:
            - name: system
              check_options: "--lock-wait 28800"
              day: "1"
              hour: "12"
              minute: "0"
 You can easily assign client and server attributes from your inventory with something similar to the following:
    borgbackup_client: "{{ (inventory_hostname in groups.borgbackup_server)|ternary(False, True) }}"
    borgbackup_client_backup_server: "{{ groups.borgbackup_server[0] }}"
 License
 -------
 Apache 2.0
--- a/roles/borg_server/defaults/main.yml
+++ b/roles/borg_server/defaults/main.yml
@@ -0,0 +1,14 @@
 ---
 borgbackup_install_from_repo: False
 borgbackup_binary_version: "1.1.6"
 borgbackup_binary_platform: "borg-linux64"
 borgbackup_binary_uri: "https://github.com/borgbackup/borg/releases/download/{{ borgbackup_binary_version }}/{{ borgbackup_binary_platform }}"
 borgbackup_binary: "/usr/local/bin/borg"
 borgbackup_server_user: "backup"
 borgbackup_server_group: "backup"
 borgbackup_server_home: "/home/backup"
 borgbackup_server_pool: "{{ borgbackup_server_home }}/repos"
 borgbackup_encryption_mode: "none"
 borgbackup_passphrase: "yoursecret"
--- a/roles/borg_server/meta/main.yml
+++ b/roles/borg_server/meta/main.yml
@@ -0,0 +1,20 @@
 galaxy_info:
  author: Farhad Shahbazi
  description: Borgbackup
  company: Spherical Elephant GmbH
  license: Apache
  min_ansible_version: 2.1
  platforms:
  - name: Ubuntu
    versions:
    - all
  - name: Debian
    versions:
    - jessie
    - sid
    - stretch
  - name: Archlinux
  galaxy_tags:
  - backup
 dependencies: []
--- a/roles/borg_server/tasks/borgbackup_install.yml
+++ b/roles/borg_server/tasks/borgbackup_install.yml
@@ -0,0 +1,21 @@
 ---
 - name: borgbackup - download borg binary
  get_url:
    url: "{{ borgbackup_binary_uri }}"
    dest: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
    mode: "755"
  when: not borgbackup_install_from_repo
 - name: borgbackup - link install
  file:
    src: "{{ borgbackup_binary }}-{{ borgbackup_binary_version }}"
    dest: "{{ borgbackup_binary }}"
    state: link
    force: yes
  when: not borgbackup_install_from_repo
 - name: borgbackup - install borgbackup
  package:
    name: borg
    state: latest
  when: borgbackup_install_from_repo
--- a/roles/borg_server/tasks/borgbackup_server.yml
+++ b/roles/borg_server/tasks/borgbackup_server.yml
@@ -0,0 +1,40 @@
 ---
 - name: borg_server - create group
  group:
    name: "{{ borgbackup_server_group }}"
    state: present
 - name: borg_server - create user
  user:
    name: "{{ borgbackup_server_user }}"
    group: "{{ borgbackup_server_group }}"
    groups:
    home: "{{ borgbackup_server_home }}"
    createhome: yes
    shell: /bin/bash
    state: present
 - name: borg_server - manage permissions
  file:
    path: "{{ item }}"
    owner: "{{ borgbackup_server_user }}"
    group: "{{ borgbackup_server_group }}"
    mode: 0700
    state: directory
  with_items:
    - "{{ borgbackup_server_home }}"
    - "{{ borgbackup_server_home }}/.ssh"
    - "{{ borgbackup_server_pool }}"
 - name : borg_server - create authorized_keys
  stat:
    path: "{{ borgbackup_server_home }}/.ssh/authorized_keys"
  register: authorized_keys
 - name: borg_server - manage permissions for authorized_keys
  file:
    path: "{{ borgbackup_server_home }}/.ssh/authorized_keys"
    owner: "{{ borgbackup_server_user }}"
    group: "{{ borgbackup_server_group }}"
    mode: 0600
    state: '{{ "file" if  authorized_keys.stat.exists else "touch" }}'
--- a/roles/borg_server/tasks/main.yml
+++ b/roles/borg_server/tasks/main.yml
@@ -0,0 +1,6 @@
 ---
 - import_tasks: borgbackup_install.yml
  tags: [ borg ]
 - import_tasks: borgbackup_server.yml
  tags: [ borg ]
--- a/roles/common
+++ b/roles/common
--- a/roles/gitea/templates/gitea.conf.j2
+++ b/roles/gitea/templates/gitea.conf.j2
@@ -1,3 +1,5 @@
 # {{ ansible_managed }}
 ; App name that shows on every page title
 APP_NAME = FET-Gitea
 ; Change it if you run locally
--- a/roles/maria-storage/handlers/main.yml
+++ b/roles/maria-storage/handlers/main.yml
@@ -0,0 +1,6 @@
 ---
 - name: reload nfs
  service: name=nfs-kernel-server enabled=yes state=reloaded
 - name: restart mariadb
  service: name=mysql enabled=yes state=restarted
--- a/roles/maria-storage/tasks/main.yml
+++ b/roles/maria-storage/tasks/main.yml
@@ -0,0 +1,6 @@
 ---
 - import_tasks: nfs.yml
  tags: [ maria-storage, nfs ]
 - import_tasks: mariadb.yml
  tags: [ maria-storage, mariadb ]
--- a/roles/maria-storage/tasks/mariadb.yml
+++ b/roles/maria-storage/tasks/mariadb.yml
@@ -0,0 +1,7 @@
 ---
 - name: mariadb - install mariadb-server
  package: name=mariadb-server
 - name: mariadb - config /etc/mysql/my.cnf
  template: dest=/etc/mysql/my.cnf src=my.cnf.j2 owner=root group=root mode=0644
  notify: restart mariadb
--- a/roles/maria-storage/tasks/nfs.yml
+++ b/roles/maria-storage/tasks/nfs.yml
@@ -0,0 +1,7 @@
 ---
 - name: mariadb - install nfs-kernel-server
  package: name=nfs-kernel-server
 - name: mariadb - nfs /etc/exports
  template: dest=/etc/exports src=exports.j2 owner=root group=root mode=0644
  notify: reload nfs
--- a/roles/maria-storage/templates/exports.j2
+++ b/roles/maria-storage/templates/exports.j2
@@ -0,0 +1,5 @@
 # {{ ansible_managed }}
 /srv/save/fetsite_production_1  192.168.95.0/24(rw,sync,acl,insecure,no_subtree_check)
 /srv/save/web_doc       192.168.95.0/24(rw,sync,acl,insecure,no_subtree_check)
 /srv/save/git_repo      192.168.95.0/24(rw,sync,acl,insecure,no_subtree_check)
--- a/roles/maria-storage/templates/my.cnf.j2
+++ b/roles/maria-storage/templates/my.cnf.j2
@@ -0,0 +1,129 @@
 # {{ ansible_managed }}
 #
 # The MySQL database server configuration file.
 #
 # You can copy this to one of:
 # - "/etc/mysql/my.cnf" to set global options,
 # - "~/.my.cnf" to set user-specific options.
 #
 # One can use all long options that the program supports.
 # Run program with --help to get a list of available options and with
 # --print-defaults to see which it would actually understand and use.
 #
 # For explanations see
 # http://dev.mysql.com/doc/mysql/en/server-system-variables.html
 # This will be passed to all mysql clients
 # It has been reported that passwords should be enclosed with ticks/quotes
 # escpecially if they contain "#" chars...
 # Remember to edit /etc/mysql/debian.cnf when changing the socket location.
 [client]
 port		= 3306
 socket		= /var/run/mysqld/mysqld.sock
 # Here is entries for some specific programs
 # The following values assume you have at least 32M ram
 # This was formally known as [safe_mysqld]. Both versions are currently parsed.
 [mysqld_safe]
 socket		= /var/run/mysqld/mysqld.sock
 nice		= 0
 [mysqld]
 #
 # * Basic Settings
 #
 user		= mysql
 pid-file	= /var/run/mysqld/mysqld.pid
 socket		= /var/run/mysqld/mysqld.sock
 port		= 3306
 basedir		= /usr
 datadir		= /var/lib/mysql
 tmpdir		= /tmp
 lc-messages-dir	= /usr/share/mysql
 skip-external-locking
 #
 # Instead of skip-networking the default is now to listen only on
 # localhost which is more compatible and is not less secure.
 bind-address		= 0.0.0.0
 #
 # * Fine Tuning
 #
 key_buffer		= 16M
 max_allowed_packet	= 16M
 thread_stack		= 192K
 thread_cache_size       = 8
 # This replaces the startup script and checks MyISAM tables if needed
 # the first time they are touched
 myisam-recover         = BACKUP
 #max_connections        = 100
 #table_cache            = 64
 #thread_concurrency     = 10
 #
 # * Query Cache Configuration
 #
 query_cache_limit	= 1M
 query_cache_size        = 16M
 #
 # * Logging and Replication
 #
 # Both location gets rotated by the cronjob.
 # Be aware that this log type is a performance killer.
 # As of 5.1 you can enable the log at runtime!
 #general_log_file        = /var/log/mysql/mysql.log
 #general_log             = 1
 #
 # Error log - should be very few entries.
 #
 log_error = /var/log/mysql/error.log
 #
 # Here you can see queries with especially long duration
 #slow_query_log_file = /var/log/mysql/mysql-slow.log
 #slow_query_log      = 1
 #long_query_time = 2
 #log_queries_not_using_indexes
 #
 # The following can be used as easy to replay backup logs or for replication.
 # note: if you are setting up a replication slave, see README.Debian about
 #       other settings you may need to change.
 #server-id		= 1
 #log_bin			= /var/log/mysql/mysql-bin.log
 expire_logs_days	= 10
 max_binlog_size         = 100M
 #binlog_do_db		= include_database_name
 #binlog_ignore_db	= include_database_name
 #
 # * InnoDB
 #
 # InnoDB is enabled by default with a 10MB datafile in /var/lib/mysql/.
 # Read the manual for more InnoDB related options. There are many!
 #
 # * Security Features
 #
 # Read the manual, too, if you want chroot!
 # chroot = /var/lib/mysql/
 #
 # For generating SSL certificates I recommend the OpenSSL GUI "tinyca".
 #
 # ssl-ca=/etc/mysql/cacert.pem
 # ssl-cert=/etc/mysql/server-cert.pem
 # ssl-key=/etc/mysql/server-key.pem
 [mysqldump]
 quick
 quote-names
 max_allowed_packet	= 16M
 [mysql]
 #no-auto-rehash	# faster start of mysql but no tab completition
 [isamchk]
 key_buffer		= 16M
 #
 # * IMPORTANT: Additional settings that can override those from this file!
 #   The files must end with '.cnf', otherwise they'll be ignored.
 #
 !includedir /etc/mysql/conf.d/
--- a/roles/scans/defaults/main.yml
+++ b/roles/scans/defaults/main.yml
@@ -0,0 +1,4 @@
 ---
 samba_users:
  - name: dell
    smbpasswd: delloscanner
--- a/roles/scans/handlers/main.yml
+++ b/roles/scans/handlers/main.yml
@@ -0,0 +1,3 @@
 ---
 - name: restart samba
   service: name=smbd enabled=yes state=restarted
--- a/roles/scans/tasks/main.yml
+++ b/roles/scans/tasks/main.yml
@@ -0,0 +1,3 @@
 ---
 - import_tasks: samba.yml
  tags: [ samba ]
--- a/roles/scans/tasks/samba.yml
+++ b/roles/scans/tasks/samba.yml
@@ -0,0 +1,20 @@
 ---
 - name: samba - install
  package: name={{ item }}
  with_items:
  - samba
 - name: samba - /etc/smb.conf
  template: dest=/etc/smb.conf src=smb.conf.j2 owner=root group=root mode=0644
  notify: restart samba
 - name: samba - create users group
  group: name=users gid=2000
 - name: samba - add smb users
  user: "name={{ item['name'] }} shell=/bin/false group=users"
  with_items: '{{ samba_users }}'
 - name: samba - set smbpasswds
  shell: "(echo {{ item['smbpasswd'] }}; echo {{ item['smbpasswd'] }}) | smbpasswd -s -a {{ item['name'] }}"
  with_items: '{{ samba_users }}'
--- a/roles/scans/templates/smb.conf.j2
+++ b/roles/scans/templates/smb.conf.j2
@@ -0,0 +1,26 @@
 # {{ ansible_managed }}
 [global]
   workgroup = WORKGROUP
   server string = PROGRESS
   security = user
   hosts allow = 192.168.86.14
   log file = /var/log/samba/%m.log
   max log size = 500
   dns proxy = no
   load printers = no
   printing = bsd
   printcap name = /dev/null
   disable spoolss = yes
 [scans]
   comment = scans
   path = /mnt/scans
   valid users = dell
   public = no
   browseable = yes
   writeable = yes
--- a/site.yml
+++ b/site.yml
@@ -34,22 +34,36 @@
  roles:
  - gitea
- hosts: backup
+- hosts: sojus
  roles:
-  - backup
+  - borg_server
- hosts: backupclient
+- hosts: maria-storage
  roles:
-  - backupclient
+#  - maria-storage
  - borg_client
- hosts: ruby
+- hosts: baroness
  become: True
  roles:
-  - rvm1-ansible
+  - borg_client
 - hosts: test_common
  become: True
 - hosts: fetlab
  roles:
  - fetlab
 - hosts: buran
  roles:
  - borg_client
 - hosts: nauka
  roles:
  - borg_client
 - hosts: progress
  roles:
  - scans
 #- hosts: ruby
 #  become: True
 #  roles:
 #  - rvm1-ansible
--- a/templates/interfaces_ariane.j2
+++ b/templates/interfaces_ariane.j2
@@ -0,0 +1,19 @@
 # {{ ansible_managed }}
 source /etc/network/interfaces.d/*
 auto lo
 iface lo inet loopback
 allow-hotplug enp8s0
 iface enp8s0 inet dhcp
 auto br0
 iface br0 inet dhcp
    bridge_ports enp9s0
    bridge_fd 0
    bridge_maxwait 0
 dns-nameservers 192.168.86.1
 #dns-nameservers 192.168.86.1 10.0.3.1
 #dns-nameserver 10.0.3.1
--- a/templates/iptables_progress_v4.j2
+++ b/templates/iptables_progress_v4.j2
@@ -0,0 +1,18 @@
 # {{ ansible_managed }}
 *filter
 :INPUT DROP [0:0]
 :FORWARD DROP [0:0]
 :OUTPUT ACCEPT [0:0]
 -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
 -A INPUT -p icmp -j ACCEPT
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 -A INPUT -i lo -j ACCEPT
 -A INPUT -p udp -m udp -s {{ printer_ip }}/32 --dport 137 -j ACCEPT
 -A INPUT -p udp -m udp -s {{ printer_ip }}/32 --dport 138 -j ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp -s {{ printer_ip }}/32 --dport 139 -j ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp -s {{ printer_ip }}/32 --dport 445 -j ACCEPT
 -A INPUT -p tcp -j REJECT --reject-with tcp-reset
 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
 -A INPUT -j REJECT --reject-with icmp-proto-unreachable
 COMMIT
--- a/templates/iptables_progress_v6.j2
+++ b/templates/iptables_progress_v6.j2
@@ -0,0 +1,12 @@
 # {{ ansible_managed }}
 *filter
 :INPUT DROP [0:0]
 :FORWARD DROP [0:0]
 :OUTPUT ACCEPT [0:0]
 -A INPUT -p tcp --syn -j DROP
 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
 -A INPUT -p ipv6-icmp -j ACCEPT
 -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 -A INPUT -i lo -j ACCEPT
 COMMIT
		`@@ -1,2 +0,0 @@`
			`This is a generate FET borg repository.`
			`Name: {{item.name}}`