allow access to backups through sftp in ro mode

inventories/group_vars/all/main.yml

@@ -19,13 +19,9 @@ storage_box_host: storage.pirateparty.be
 storage_box_username: "{{ vault_storage_box_username }}"
 storage_box_password: "{{ vault_storage_box_password }}"
 
-borg_passphrase: "{{ vault_borg_passphrase }}"
-
 # Add SSH keys in playbooks/files/ssh/<username>/
 users:
 - name: hgo
 - name: tierce
-- name: backup
-  groups: []
 
 acme_email: it@pirateparty.be

inventories/host_vars/mastodon.pirateparty.be/main.yml

@@ -11,7 +11,8 @@ borgmatic_config:
       - "{{ mastodon_home }}/elasticsearch"
       - "{{ mastodon_home }}/redis"
   storage:
-    encryption_passphrase: "{{ borg_passphrase }}"
+    umask: "{{ borg_umask }}"
+    encryption_passphrase: "{{ vault_borg_passphrase }}"
     compression: zlib,7
   retention:
     keep_hourly: 24

inventories/host_vars/wiki.pirateparty.be/main.yml

@@ -6,7 +6,8 @@ borgmatic_config:
     repositories:
       - "{{ borg_repository }}"
   storage:
-    encryption_passphrase: "{{ borg_passphrase }}"
+    umask: "{{ borg_umask }}"
+    encryption_passphrase: "{{ vault_borg_passphrase }}"
     compression: zlib,7
   retention:
     keep_hourly: 24