---
# POSIX ACLs granting the backup user rwx (group/other none) with inheritance.
# Included only where the caller's probe proved setfacl works: NFS and a zpool
# with acltype=off both reject it with "Operation not supported", and the
# chown backup:backup + 0700 in the caller already enforce the same
# backup-only posture there.
- name: 🔐 Grant ACL rwx on backups root to backup user
  ansible.posix.acl:
    path: "{{ DIR_BACKUPS }}"
    entity: backup
    etype: user
    permissions: rwx
    state: present

- name: 🔧 Set default ACL (inherit) for backup user under backups root
  ansible.posix.acl:
    path: "{{ DIR_BACKUPS }}"
    entity: backup
    etype: user
    permissions: rwx
    default: true
    state: present

- name: 🔐 Default ACL for backup user (inherit)
  ansible.posix.acl:
    path: "{{ DIR_BACKUPS }}"
    etype: user
    entity: backup
    permissions: rwx
    default: true
    state: present

- name: 🔐 Default ACL for group -> none
  ansible.posix.acl:
    path: "{{ DIR_BACKUPS }}"
    etype: group
    permissions: "---"
    default: true
    state: present

- name: 🔐 Default ACL for other -> none
  ansible.posix.acl:
    path: "{{ DIR_BACKUPS }}"
    etype: other
    permissions: "---"
    default: true
    state: present