---
- name: "✅ Ensure backup home directory exists"
  ansible.builtin.file:
    path: "{{ USER_BACKUP_HOME }}"
    state: directory
    owner: backup
    group: backup
    mode: "0700"

- name: "📁 create {{ USER_BACKUP_WRAPPER_DST }}"
  ansible.builtin.template: # nocheck: stack-host-template (per-host backup user wrapper, lives in backup home on every backed-up host)
    src: "ssh-wrapper.sh.j2"
    dest: "{{ USER_BACKUP_WRAPPER_DST }}"
    owner: backup
    group: backup
    mode: "0700"

- name: "✏️ Write authorized_keys for 'backup' via shared user role (wrapped)"
  ansible.builtin.include_role:
    name: user
  vars:
    user_key: "backup"
    user_config: >-
      {{
        lookup('users', 'backup', {})
        | combine(
            {
              'authorized_keys': (
                lookup('users', 'backup', {}).authorized_keys
                | default([])
                | map('regex_replace', '^', 'command="' ~ USER_BACKUP_WRAPPER_DST ~ '" ')
                | list
              )
            },
            recursive=True
          )
      }}