add export service

tasks/main.yml

@@ -3,9 +3,6 @@
     backup_backend: "{% if backups.mode in ['standalone-restic', 'hypervisor-restic'] %}restic{% else %}False{% endif %}"
     backup_executor: "{% if backups.mode in ['vm-via-hypervisor'] %}False{% else %}True{% endif %}"
 
-- debug:
-    var: backup_backend
-
 - name: create config folder
   file:
     path: /etc/backup-client/
@@ -17,6 +14,10 @@
 - name: setup hosts that actualy run backup code (not vms for example)
   when: backup_executor
   block:
+  - name: generate ssh key
+    community.crypto.openssh_keypair:
+      path: /etc/backup-client/id_ed25519
+      type: ed25519
   - name: create retention file
     copy:
       dest: /etc/backup-client/retention.env
@@ -48,6 +49,7 @@
       - backup-full
       - backup-cronjob
       - backup-check
+      - backup-export
       - status-email-root
     template:
       src: "{{ item }}.j2"
@@ -63,6 +65,7 @@
       - backup-check
       - backup-retention
       - backup-run
+      - backup-export
       - status-email-root@
     template:
       src: "{{ item }}.service.j2"
@@ -79,6 +82,7 @@
       - check
       - retention
       - run
+      - export
     template:
       src: "timer.j2"
       dest: "/etc/systemd/system/backup-{{ item }}.timer"
@@ -116,9 +120,15 @@
       mode: 0600
       content: "{{ backups.include_files|filterEnabled|join('\n') }}"
   - name: create repo key for restic
-    command: "dd if=/dev/urandom of=/etc/backup-client/restic.key bs=1k count=16"
+    shell: "umask 177; dd if=/dev/urandom of=/etc/backup-client/restic.key bs=1k count=16"
     args:
       creates: "/etc/backup-client/restic.key"
+  - name: set repo key permissions
+    file:
+      path: /etc/backup-client/restic.key
+      owner: root
+      group: root
+      mode: 0600
   - name: create restic env file
     copy:
       dest: /etc/backup-client/restic.env