---
- name: create backup SSH key directory
  become: true
  ansible.builtin.file:
    path: /etc/ssh/backup_keys
    state: directory
    owner: root
    group: root
    mode: 0700

- name: deploy {{ backup_name }} backup SSH key
  become: true
  ansible.builtin.copy:
    content: "{{ ssh_key_content }}"
    dest: "{{ ssh_key_path }}"
    owner: root
    group: root
    mode: 0600
    setype: ssh_home_t

- name: template {{ backup_name }} backup script
  become: true
  ansible.builtin.template:
    src: nextcloud/cloud-backup.sh.j2
    dest: "{{ script_path }}"
    owner: root
    group: root
    mode: 0755
    setype: bin_t

# Shared by every backup instance. Rendered once per include; the second and
# later renders are no-ops.
- name: template nextcloud backup alert script
  become: true
  ansible.builtin.template:
    src: nextcloud/nextcloud-backup-alert.sh.j2
    dest: /usr/local/bin/nextcloud-backup-alert.sh
    owner: root
    group: root
    mode: 0755
    setype: bin_t

- name: template nextcloud backup failure handler unit
  become: true
  ansible.builtin.template:
    src: nextcloud/nextcloud-backup-failed@.service.j2
    dest: /etc/systemd/system/nextcloud-backup-failed@.service
    owner: root
    group: root
    mode: 0644

- name: template {{ backup_name }} backup systemd service
  become: true
  ansible.builtin.template:
    src: nextcloud/cloud-backup.service.j2
    dest: "/etc/systemd/system/{{ backup_name }}-backup.service"
    owner: root
    group: root
    mode: 0644
  vars:
    instance_name: "{{ backup_name }}"

- name: template {{ backup_name }} backup systemd timer
  become: true
  ansible.builtin.template:
    src: nextcloud/cloud-backup.timer.j2
    dest: "/etc/systemd/system/{{ backup_name }}-backup.timer"
    owner: root
    group: root
    mode: 0644
  vars:
    instance_name: "{{ backup_name }}"

- name: enable and start {{ backup_name }} backup timer
  become: true
  ansible.builtin.systemd:
    name: "{{ backup_name }}-backup.timer"
    enabled: true
    state: started
    daemon_reload: true