kevinveenbirkenbachandClaude Opus 5
508bc5adac
A templated script is opaque to every tool that reads shell. shellcheck parses Jinja as syntax errors, the repository's own .sh guards skip the file because it is not a .sh, and nothing can execute it to test it: what runs on the host never exists in the repository, so a defect in the rendered half is found by deploying it. The lint reports any *.sh.j2 under roles and points at the static slot sys-service already resolves, files/shell/script.sh, with the values passed as ExecStart arguments or Environment entries the way this repository's python scripts already take them. None of the seven templates present meets the bar the marker is for, which is a script whose shape is generated rather than its values. Each is grandfathered with a marker naming what it interpolates, because converting a deployed script to argv changes what runs on the host. The guard exists to stop the next one. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
User for Backup Provider
Description
This role sets up a dedicated backup user (backup) for performing secure backup operations. It creates the user, configures a restricted SSH environment with a custom authorized_keys template and an SSH wrapper script, and grants necessary sudo rights for executing rsync. This configuration helps ensure controlled and secure access specifically for backup processes.
Overview
The role is a critical component in a secure backup scheme. By isolating backup operations to a dedicated user, it minimizes the risk of unauthorized actions. The role configures the SSH environment so that only specific, allowed commands can be executed, and it sets up passwordless sudo rights for rsync, ensuring smooth and secure backup operations.
Cosmos
The diagram places User for Backup Provider in the Infinito.Nexus cosmos: the components it deploys (capabilities), the central services it consumes (dependencies), and its outward reach (federation and bridged external networks).
flowchart LR
subgraph role [user-backup 💻]
svc_backup["backup"]
end
Solid 1:1 edges are fixed relationships; dashed 0..1 edges are conditional (enabled only in matching deployments); red 0..0 edges are turned off in this role. Node markers show the role's deploy modes (💻 host, 🐳 compose, 🐝 swarm); ❌ marks a service that is explicitly turned off, and ⚙️ an Ansible role dependency declared in meta/main.yml.
Purpose
The purpose of this role is to enhance the security of your backup system by providing a dedicated user with strict command restrictions. This controlled environment limits the potential damage from a compromised backup account while still allowing efficient backup operations.
Features
- User Creation: Creates a dedicated
backupuser with a home directory. - SSH Environment Setup: Establishes a secure
.sshdirectory and deploys a restrictedauthorized_keysfile via a Jinja2 template. - SSH Wrapper Script: Implements a custom SSH wrapper that logs and filters incoming SSH commands, enforcing security policies.
- Sudo Configuration: Grants passwordless sudo rights for rsync, enabling secure and automated backup transfers.
- Integration: Supports seamless integration with your backup infrastructure by limiting the backup user's permissions to only the required commands.
Other Resources
For more details on how the role works and advanced configuration options, please see the related references below:
- Ansible Playbooks Lookups
- Restrict SSH to rsync
- SSH Command Restrictions via authorized_keys
- Rsync and sudo integration
Credits
Implemented by Kevin Veen-Birkenbach. Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).