kevinveenbirkenbachandClaude Opus 5
7bc12e55f3
aceb5295efmoved Cosmos, Quick Setup and Credits out of the committed role READMEs and into the documentation build's own scratch checkout, so a committed copy can no longer go stale when the metadata moves. Merging feature/designer (ebad39422c) took origin/main's side of those files, which still carries them, and reinstated all 290 along with the cosmos make target and its i8cos alias. tests/lint/ansible/roles/test_readme.py hard-fails on a committed copy, and the reinstated Credits block credited one person with two URLs, which tripped the credits-attribution lint as well. Stripped with the repository's own fence-aware parser against MANAGED_SECTIONS, not with a line filter: the Cosmos block holds a mermaid fence a naive filter would cut through. The result is byte-identical toaceb5295effor every README that carries no prose change since. The cosmos target wrote the forbidden section straight back into the checkout, so it goes with them. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2.2 KiB
User for Backup Provider
Description
This role sets up a dedicated backup user (backup) for performing secure backup operations. It creates the user, configures a restricted SSH environment with a custom authorized_keys template and an SSH wrapper script, and grants necessary sudo rights for executing rsync. This configuration helps ensure controlled and secure access specifically for backup processes.
Overview
The role is a critical component in a secure backup scheme. By isolating backup operations to a dedicated user, it minimizes the risk of unauthorized actions. The role configures the SSH environment so that only specific, allowed commands can be executed, and it sets up passwordless sudo rights for rsync, ensuring smooth and secure backup operations.
Purpose
The purpose of this role is to enhance the security of your backup system by providing a dedicated user with strict command restrictions. This controlled environment limits the potential damage from a compromised backup account while still allowing efficient backup operations.
Features
- User Creation: Creates a dedicated
backupuser with a home directory. - SSH Environment Setup: Establishes a secure
.sshdirectory and deploys a restrictedauthorized_keysfile via a Jinja2 template. - SSH Wrapper Script: Implements a custom SSH wrapper that logs and filters incoming SSH commands, enforcing security policies.
- Sudo Configuration: Grants passwordless sudo rights for rsync, enabling secure and automated backup transfers.
- Integration: Supports seamless integration with your backup infrastructure by limiting the backup user's permissions to only the required commands.
Other Resources
For more details on how the role works and advanced configuration options, please see the related references below: