ldap-server: Run backups as root and share them via sftp

roles/ldap-server/tasks/main.yml

@@ -31,13 +31,20 @@
     follow: false
   when: ldap_datadir != "/srv/ldap"
 
+- import_role:
+    name: sftpuser
+  vars:
+    chroot: /export/backup
+    user: backup
+    publickeys: "{{ backup_publickeys }}"
+
 - name: create backup directory
   file:
     path: /export/backup
     state: directory
     mode: 0750
-    owner: ldap
-    group: ldap
+    owner: root
+    group: backup
 - name: link backup directory
   file:
     path: /srv/backup
@@ -59,7 +66,7 @@
     job: /usr/local/sbin/ldap-backup
     hour: "0"
     minute: "10"
-    user: ldap
+    user: root
 
 - name: copy spn helper script
   copy: