---
- name: Create group
  ansible.builtin.group:
    name: backup
    system: true

- name: Create user
  ansible.builtin.user:
    name: backup
    comment: Service backup
    createhome: false
    group: backup
    home: /var/empty
    shell: /sbin/nologin
    system: true

- name: Create authorized_keys
  ansible.builtin.copy:
    dest: /etc/ssh/authorized_keys.backup
    src: ../files/ssh/backup.pub
    mode: "0640"
    owner: root
    group: backup

- name: Configure sshd chroot
  ansible.builtin.blockinfile:
    path: /etc/ssh/sshd_config
    block: |
      Match User backup
        ChrootDirectory {{ sftpuser_chroot }}
        ForceCommand internal-sftp
        AuthorizedKeysFile /etc/ssh/authorized_keys.backup
    marker: "# {mark} ANSIBLE MANAGED BLOCK (user backup)"
    validate: "sshd -t -f %s"
  notify: Restart sshd