update

authorized_keys/atc-db01

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/atc-db01" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDolLw3D8LkumFYZQaiD6XrWY692rsKzek+bbuu4+k2Nq+Obm3ZZiKqrPsbKBCXbTIk/HFehL9k+DpgSQo+Xw6eUTjk3XioETX/UF9kZVJPh6iGYAH+FkWZ+i4KJFW0uIz4fv81u48MkYo8NBSxnT2LT9w45E3HUczm5PsN+JawQIfPNdVO0cwbDeaFhCJmZJFLDn0A3T7iGm1CmEfRiALUdzmoq5KXpFIlRLe20tyCjfEA7W0/s3YuZaASYIlCfsuVtH617Qkl3s+68OHmhFwD8KEWRBzZkXQ57Jj/8eukAhPyimQWlOWk88tFwax6F63xYFt+S1IugSIkoHrPeOVsyFzf7QthYb80sjIk4m6FnePQ9YVjfjdLt1naDawZYige1/af5dw8cjNHa42ztW36mjemRXXAWodWoOwuyi3pbd+L+NPEq5kQlQaRjdBCzZNkEGscb9snNTBkCrIp6t8PxUdzN9IZRG0hBNenZizKCMubSV1rb9Taw2ZEjwzP34oQzy/4rrXQ2mM2ZM00RmFkyp7VnXrul5t6m29XM5i3Wyf2hvmDK4gAyxvTHraLHTX6aaxue8uKLcFjyd6Vu5oWxtIrc6pXUrREP9dD7E5sqQSBc3GQc35hmfYQVYbDCR9EIxhzn4gHK1mNaDevLiUbIlvO7p5I4RVu/dSPZlVdIw== 

authorized_keys/atc-db01.dell-atc.lan

@@ -1 +0,0 @@
-command="borg serve --restrict-to-path /var/borg/atc-db01.dell-atc.lan" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDolLw3D8LkumFYZQaiD6XrWY692rsKzek+bbuu4+k2Nq+Obm3ZZiKqrPsbKBCXbTIk/HFehL9k+DpgSQo+Xw6eUTjk3XioETX/UF9kZVJPh6iGYAH+FkWZ+i4KJFW0uIz4fv81u48MkYo8NBSxnT2LT9w45E3HUczm5PsN+JawQIfPNdVO0cwbDeaFhCJmZJFLDn0A3T7iGm1CmEfRiALUdzmoq5KXpFIlRLe20tyCjfEA7W0/s3YuZaASYIlCfsuVtH617Qkl3s+68OHmhFwD8KEWRBzZkXQ57Jj/8eukAhPyimQWlOWk88tFwax6F63xYFt+S1IugSIkoHrPeOVsyFzf7QthYb80sjIk4m6FnePQ9YVjfjdLt1naDawZYige1/af5dw8cjNHa42ztW36mjemRXXAWodWoOwuyi3pbd+L+NPEq5kQlQaRjdBCzZNkEGscb9snNTBkCrIp6t8PxUdzN9IZRG0hBNenZizKCMubSV1rb9Taw2ZEjwzP34oQzy/4rrXQ2mM2ZM00RmFkyp7VnXrul5t6m29XM5i3Wyf2hvmDK4gAyxvTHraLHTX6aaxue8uKLcFjyd6Vu5oWxtIrc6pXUrREP9dD7E5sqQSBc3GQc35hmfYQVYbDCR9EIxhzn4gHK1mNaDevLiUbIlvO7p5I4RVu/dSPZlVdIw== 

authorized_keys/atc-docker01

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/atc-docker01" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQClDrplpfAMxQJByLR0lSVDpuJeXKoexJwj3oiea16ixtllJFpD+aozi5HQfhckw/ynI5AMFCt69b1EVR9YkS1lTqku5rAAWen1tQuaR4afkxuLXr/3T11mQHz6nxy9/rTfZyxGZA32AuGav9bmdjrCz/y7AKT1OnXaol8b6XPfxHgxvRl779gLaVz3s0xbzo4v9diPcdTy4NSNsOjynJaGj6ReMV6qFIxbZeW3gX18TcMw8pwsD4Qog1LRr6hzU96aV04Y6lkxeuYiVEQlcrdTrlrelPSFu9gtOCMJ7ZMA1JFx2sYf5o8+b1v+hqekOK/1+8TuflThFkHga35u4jwwCYKKm+E0HwcF90n3lXTWunhum02N/C8z2DHaqqykaNeb5WxKQ62SXYFskPlsD8/bXHeGuQS+RuqvXnHg0M8LpsQql9rmG+Eps180tfpY9ozBYe0kaI9TurTXWwwmAyyz5kjgfJmR4UYNjlYkE9VGuA7/JT0OR6sYoD2DVLpH1VznvqhK904JZ/8Hbuwnr3TzAJCF/aRc9EEtiUOG9q6BwPQpDv87WLnSJYElpktAu7q0UXdvWLKckC7Bp6osNtiZUuiT3oLIy5sms+8nv/PWPWY51mbXXEuvE2hhL6A8X9tjp4GUCaPOfKMriHmSirvc/cnwhr5giiZXcsqM0Eu/ow== 

authorized_keys/atc-docker01.dell-atc.lan

@@ -1 +0,0 @@
-command="borg serve --restrict-to-path /var/borg/atc-docker01.dell-atc.lan" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQClDrplpfAMxQJByLR0lSVDpuJeXKoexJwj3oiea16ixtllJFpD+aozi5HQfhckw/ynI5AMFCt69b1EVR9YkS1lTqku5rAAWen1tQuaR4afkxuLXr/3T11mQHz6nxy9/rTfZyxGZA32AuGav9bmdjrCz/y7AKT1OnXaol8b6XPfxHgxvRl779gLaVz3s0xbzo4v9diPcdTy4NSNsOjynJaGj6ReMV6qFIxbZeW3gX18TcMw8pwsD4Qog1LRr6hzU96aV04Y6lkxeuYiVEQlcrdTrlrelPSFu9gtOCMJ7ZMA1JFx2sYf5o8+b1v+hqekOK/1+8TuflThFkHga35u4jwwCYKKm+E0HwcF90n3lXTWunhum02N/C8z2DHaqqykaNeb5WxKQ62SXYFskPlsD8/bXHeGuQS+RuqvXnHg0M8LpsQql9rmG+Eps180tfpY9ozBYe0kaI9TurTXWwwmAyyz5kjgfJmR4UYNjlYkE9VGuA7/JT0OR6sYoD2DVLpH1VznvqhK904JZ/8Hbuwnr3TzAJCF/aRc9EEtiUOG9q6BwPQpDv87WLnSJYElpktAu7q0UXdvWLKckC7Bp6osNtiZUuiT3oLIy5sms+8nv/PWPWY51mbXXEuvE2hhL6A8X9tjp4GUCaPOfKMriHmSirvc/cnwhr5giiZXcsqM0Eu/ow== 

authorized_keys/atc-docker02

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/atc-docker02" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeoG+ZXWY7WFXVVbTGY/1I9aRXFT0gjFAvvB/ke1SV2ia4sbrLlcGLfH/jeM5xoYeUkSxvJenmhppaRDbjlGUO2VJPufWwbIkjKdTdxuHGs86ccLdScOafJt+HQK+ii6NGuWLSKOF1eNqaxLQUN7ySZY68Ny1Diqj59KJ/fue/37BSMF8XBRCwWjrpBBG+hiHcVBO84xYLWy1fnuIEi/Ui3PxL2dmOpAmHJKrsVVDnuUyKpkZAUL/fZeQ7fiejVpSYGg3PNaa5lcqwKt0ZEHEFH9qxkzfkYCax5ztxl3xFVlkeiFv3BSr0kbfacq3kOrFPwayTfsUgiZ10XsZc3p/91DWU43kfuTpb6o3pIo0u2hhSo18tWUbtvejtVNB0SUWG1Wg7WPT2wM7jqmv8ScJk9Zzrnii4bLq4uyO2Qg5jFv8D5OeyYAgQggTcE/CBrGlQ9SjqzIyFp03hX0cY1SN0DgdIHGAXRVKy9Uh6IiRkQLyDf0Xz8d2EnEtwRwuyi1bjjLoD54cqWICDV0yMdPL/tJKv7fxjJvjMZvNdqsKi3rOmz0kyBP5p9KPZhbm7VT1uCDhhv06ngERQgTOyvs1JUuej3qass/DPuLnbmyN4jZl6NcF/kPxKcl8uc6xN1QS+sCwnaPrNmbP0+0S4SUKQDlwBynAVm1NC2EqoqhZ+oQ== 

authorized_keys/atc-docker02.dell-atc.lan

@@ -1 +0,0 @@
-command="borg serve --restrict-to-path /var/borg/atc-docker02.dell-atc.lan" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeoG+ZXWY7WFXVVbTGY/1I9aRXFT0gjFAvvB/ke1SV2ia4sbrLlcGLfH/jeM5xoYeUkSxvJenmhppaRDbjlGUO2VJPufWwbIkjKdTdxuHGs86ccLdScOafJt+HQK+ii6NGuWLSKOF1eNqaxLQUN7ySZY68Ny1Diqj59KJ/fue/37BSMF8XBRCwWjrpBBG+hiHcVBO84xYLWy1fnuIEi/Ui3PxL2dmOpAmHJKrsVVDnuUyKpkZAUL/fZeQ7fiejVpSYGg3PNaa5lcqwKt0ZEHEFH9qxkzfkYCax5ztxl3xFVlkeiFv3BSr0kbfacq3kOrFPwayTfsUgiZ10XsZc3p/91DWU43kfuTpb6o3pIo0u2hhSo18tWUbtvejtVNB0SUWG1Wg7WPT2wM7jqmv8ScJk9Zzrnii4bLq4uyO2Qg5jFv8D5OeyYAgQggTcE/CBrGlQ9SjqzIyFp03hX0cY1SN0DgdIHGAXRVKy9Uh6IiRkQLyDf0Xz8d2EnEtwRwuyi1bjjLoD54cqWICDV0yMdPL/tJKv7fxjJvjMZvNdqsKi3rOmz0kyBP5p9KPZhbm7VT1uCDhhv06ngERQgTOyvs1JUuej3qass/DPuLnbmyN4jZl6NcF/kPxKcl8uc6xN1QS+sCwnaPrNmbP0+0S4SUKQDlwBynAVm1NC2EqoqhZ+oQ== 

authorized_keys/atc-gpu

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/atc-gpu" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCKxrcDCGxzDa2fA/AERqGdjb2B/QYUpDRXDRfS5Gf0uyLdj6a4pRC0KyrvICwWaCIvllsubh7IAZXiZvr3KpZ5xct+cmEKo82mpULFS5K3hRqiQPaEXscU0dsD3MrDG1hQDp4ftlGZZ+1hYuW51e3k1PT8ILLYcZB44H4l3Ui+F+Zibc6o16B7FaAOT4YXhmj9Wjgqu58nC/ugt6CLiUdjGlZonKRJKeDcSmHSJPs/KCM0Sj1Zs5ROUNOgsCPSDFBQhFKF2rmA8d7MeHVpcesErvubUyl7NBo2ggaISSdPlUsmxj+RSxh3YcINPJxMCQW+dl3BC9jGLZZaAl7QaPD2Xg+lX9X9O80C86DvPt+1uq0RCd91ttT+i39O2/79G5I0mBSIzVtj1BYjlEJnGghbfmbvMy2Jm2CQAYxSP+1dSDSNU+Ap/b1jOJAP2BzJxeH10GzOghTRDdKyvz+AywthPpgugLFIvMQy+E+goeP+Mc8wvjqcB8/VyzmGavDzYiWfbbE75Oe63TwqLV11JkXiVcqNy18MdPPncgns1nKnKhMHdTSAf6pvtmW/HQS0onFNPY58l8U1SluIGxcklBXYdP3qNKU2c/5rAaIyIwbua1wZs1wijVK+8KOP549tc58J3AVvV8RHXduacel0nxtgWpySBwFcSROQiiR/q5w1aw== 

authorized_keys/atc-gpu-bart

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/atc-gpu-bart" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCrMrYRn9i4rW2AKdRniP4GVUaAJ1vw1RZLBGS7qYq68aqcH6/3QtEkfUUs+ZKkzRcy7jGOsn/n5QHe+tQTycEUDznx20UtSpB1ArwltWHOuJNAmtxBaR5gxfOGgjHgxyiOSEW0qXV0+hIfHNZRKOpxlj2M3zlCbd+osegW3WeUXZpkPttjwUIxxGkvYxmAt7Au4VegVxu+gTVrDrc5z/iV7JUtSBwjpVXE/giVYW2Nu6z/9ZP6/SXn9/misn+PAGEWlDFO1BRCoB3fMIkDIooCdz+rcZ1zReYzKamFtTKlKBWQHzgRV7CAka4HNodjtxwEys1CRjtkpUuZR1WNmEQrrhl/Y+Jh+aVmA4Fbz/NAY4DR3ivGApxv3j3e2ucHOPEA6dH/Nacxzshs8V23dNFZgxTd8eTiMqR74dpNHov9y9RiwbE5qSTxTgoy87yyosgR1MVzPlVeb5MYnpOASLtd/EdDlpY8gM3r7wWKkelhEDwAofoe9DoSRvmPBaS+GFSFkblwRlcrymrZgzZVT9rPGclS9JEBfzwp8TGlq1fr7BoAvA8yuw478GfbwxkSn7YmT7CtlIkyS1U6cWTy/kYG7HFY1T2ryW25XAHJbrXS4xyXiSEKcegu/r/y4/FVIK7NYU0FEGfPLfAnSTFP9fiMsoEcHo4xdzORf8Y3Yl6RtQ== 

authorized_keys/atc-gpu-bart.dell-atc.lan

@@ -1 +0,0 @@
-command="borg serve --restrict-to-path /var/borg/atc-gpu-bart.dell-atc.lan" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCrMrYRn9i4rW2AKdRniP4GVUaAJ1vw1RZLBGS7qYq68aqcH6/3QtEkfUUs+ZKkzRcy7jGOsn/n5QHe+tQTycEUDznx20UtSpB1ArwltWHOuJNAmtxBaR5gxfOGgjHgxyiOSEW0qXV0+hIfHNZRKOpxlj2M3zlCbd+osegW3WeUXZpkPttjwUIxxGkvYxmAt7Au4VegVxu+gTVrDrc5z/iV7JUtSBwjpVXE/giVYW2Nu6z/9ZP6/SXn9/misn+PAGEWlDFO1BRCoB3fMIkDIooCdz+rcZ1zReYzKamFtTKlKBWQHzgRV7CAka4HNodjtxwEys1CRjtkpUuZR1WNmEQrrhl/Y+Jh+aVmA4Fbz/NAY4DR3ivGApxv3j3e2ucHOPEA6dH/Nacxzshs8V23dNFZgxTd8eTiMqR74dpNHov9y9RiwbE5qSTxTgoy87yyosgR1MVzPlVeb5MYnpOASLtd/EdDlpY8gM3r7wWKkelhEDwAofoe9DoSRvmPBaS+GFSFkblwRlcrymrZgzZVT9rPGclS9JEBfzwp8TGlq1fr7BoAvA8yuw478GfbwxkSn7YmT7CtlIkyS1U6cWTy/kYG7HFY1T2ryW25XAHJbrXS4xyXiSEKcegu/r/y4/FVIK7NYU0FEGfPLfAnSTFP9fiMsoEcHo4xdzORf8Y3Yl6RtQ== 

authorized_keys/atc-gpu-prod

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/atc-gpu-prod" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC5mb+rLagxVQNs3tjsT28dpFwPgBo0fcD4puXkemn6Oc5WhHlq4TNIDrLQNLxQMwZsIH+cWEJ2qUPEgJ1t46kzHdKplKMpuDepY34KnrtKB1nu/N+Al+zf/lN6+f98vJOQOviLIrLJ5+dGxfHDzxnijHX5ZZPUPsJNNT8pg+cpu4cExN1NeCV/PGZqlpsSnrSUeY4v5+igSWmec723XJR+eU8NagYuoPqJQuDSaw+uD0KWleZilZ7+QHMgu6seDOFT1Gobvsk+hPw53CPHF6d7iHgj06Anb0X7XhBMpO7p+unJ0ykWXyFVcNWsV9R6naal+kArmGen7J7LxcRLma+zpCRW1LItKfgnWUVrc6Cc2UZ7gJseu0ekoIVF71F3oaJeSBYmR0jYFl2hl+hgkQCa4m6auAH50wNtq/afdwUFcESIWO9pC73iGLxlkEkuvcS/WhSM+CmRnBIonHIlPnr9bFuObPJzsgZIFPCUtWqFlZHoAAY/lNLJBBxYCaJw1n8r0hD/RuHjOt2tCwf4T1QNZ7Vtieio3WfM6kRbcBiaqgbwCWZnhDjTGBzsgZbv9wbQKiZWNB2T7alfqcqM0dYy/c/apM8uteqoDsQ+ogVblMu3jWyZz40DsbUFXua6Rp7Y+NxA4bgJa0xUbygF2BNSrJlju+Qo/naJYgXQz6l1GQ== 

authorized_keys/atc-mgt01

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/atc-mgt01" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCkvGaWb4zIg2oJqXSJwFETaMlJZmJbA+2/Ej411J5napb1vr0t7vobDtuo70u8z77w9UnZg2ES9lwJvYUaCxeTj1dsDRP7KJOGJayBVxrjjI7QY7OpF1TzP7BF8YPDWvx21RQq7dHWMofPl3z66KHTLQTBMiKjscX/V+/J3FN3o9z1aqxQ7Qj7DQfVtpvacufWChg0+uZRS2/r58M5dcWMssMiPLNh0NQJQZuP5aNy0Wj7VXJYQPdCwbdIvZnEVxucKisoHvYzoJYp196Wj71MUHkLo+eJnJcnivn5JGEpJGe7lxplHq+D1HhOeQU0yiHvjYX8QYwqc9Nw4Sb2Oknxu54dS8qbPtIIePsFU8bTpuIdxY+UUN6i+Z455ElbT1tDPMJI2A9iAxXJGHIdnH9/dUZNzMS7oFQ8Itf8dihSQWbs5H297nNN/f48RPsE+hJmBK49tq0fqjXJZ3dz9AzD8TQXMaAr72Vhk9lyomrWq5empBCFuz+6myMOaMXj2XrVbEi2MRiIYE56UWGqCIFCHo0BswrPh9T/GxAO8P3CfebjWCFOLl+v+w13MvX8KummEI8nfiiFO8AdvrWEbGXJE1x7BY9BDa0jt68AIakKHFtWLU0ghwks2w4kTsfoYtlFZ52oSU5uDLezddgmkob7fyEuhysKi84xcTVoPJasMw== 

authorized_keys/atc-mgt01.dell-atc.lan

@@ -1 +0,0 @@
-command="borg serve --restrict-to-path /var/borg/atc-mgt01.dell-atc.lan" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCkvGaWb4zIg2oJqXSJwFETaMlJZmJbA+2/Ej411J5napb1vr0t7vobDtuo70u8z77w9UnZg2ES9lwJvYUaCxeTj1dsDRP7KJOGJayBVxrjjI7QY7OpF1TzP7BF8YPDWvx21RQq7dHWMofPl3z66KHTLQTBMiKjscX/V+/J3FN3o9z1aqxQ7Qj7DQfVtpvacufWChg0+uZRS2/r58M5dcWMssMiPLNh0NQJQZuP5aNy0Wj7VXJYQPdCwbdIvZnEVxucKisoHvYzoJYp196Wj71MUHkLo+eJnJcnivn5JGEpJGe7lxplHq+D1HhOeQU0yiHvjYX8QYwqc9Nw4Sb2Oknxu54dS8qbPtIIePsFU8bTpuIdxY+UUN6i+Z455ElbT1tDPMJI2A9iAxXJGHIdnH9/dUZNzMS7oFQ8Itf8dihSQWbs5H297nNN/f48RPsE+hJmBK49tq0fqjXJZ3dz9AzD8TQXMaAr72Vhk9lyomrWq5empBCFuz+6myMOaMXj2XrVbEi2MRiIYE56UWGqCIFCHo0BswrPh9T/GxAO8P3CfebjWCFOLl+v+w13MvX8KummEI8nfiiFO8AdvrWEbGXJE1x7BY9BDa0jt68AIakKHFtWLU0ghwks2w4kTsfoYtlFZ52oSU5uDLezddgmkob7fyEuhysKi84xcTVoPJasMw== 

authorized_keys/atc-nas

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/atc-nas" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCztrJY5vfwxT0frOoiuLQ+XBXcuGNf5Vq9jopQV4jUIFvBjVoLQON5GOpNLQxnceLP9kURAWlMCIPyLcSPqdljpEAUfNQ6iaqIPghQ2V1m9oYkQiWOFeZtUsTlRlKqecMT0HEguDQeFxuiTLouyENIPthmqEtozf1g75MXLHcqt7HUt9oqGa9XRTD4973OulrQeo2ezXI+G2XnwRCk4WjlKUVJn/di2/XFYiMSZIR6wOkauHKbqkJG8N16okGWdrLGioVfqiBGX1eoXsL/stbVVaYILL6cYYXBtPrW84OvsoVgNEjgErXpHSsyIZfobZaXW3rmGBYyUddsuDLGQnPpV3Z03L082depRXdmz9XxmvbficD4ZYSGuHVIIApjZKCgDghb3enETtsH7Izi+ExJZ6GuIyiMJ0VQ3FM911K33SesWYvU9aGWvv6oXZclrG7Sw0sPclLHwjtABEC6lP/M541qGHJ0OoqFOLlYa6mFSWrjdTQz2sjcy1axtRnUKu/XlWO3C3DsVbcZtPFNkL37sKGnuSxkAE3jxHAVh5A19/RUNy1OC/mhaO4aHI+DPijxCvj0ZBGiPH5srRB/SBqUaf1fiL8oa/8Rum/tV29GUFNecyRQAY0GUBpOsMe71sdjWqetMJtav/wm120SQIcsIm7YuUvbt9J0ELbvINWNiw== 

authorized_keys/atc-nas.dell-atc.lan

@@ -1 +0,0 @@
-command="borg serve --restrict-to-path /var/borg/atc-nas.dell-atc.lan" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCztrJY5vfwxT0frOoiuLQ+XBXcuGNf5Vq9jopQV4jUIFvBjVoLQON5GOpNLQxnceLP9kURAWlMCIPyLcSPqdljpEAUfNQ6iaqIPghQ2V1m9oYkQiWOFeZtUsTlRlKqecMT0HEguDQeFxuiTLouyENIPthmqEtozf1g75MXLHcqt7HUt9oqGa9XRTD4973OulrQeo2ezXI+G2XnwRCk4WjlKUVJn/di2/XFYiMSZIR6wOkauHKbqkJG8N16okGWdrLGioVfqiBGX1eoXsL/stbVVaYILL6cYYXBtPrW84OvsoVgNEjgErXpHSsyIZfobZaXW3rmGBYyUddsuDLGQnPpV3Z03L082depRXdmz9XxmvbficD4ZYSGuHVIIApjZKCgDghb3enETtsH7Izi+ExJZ6GuIyiMJ0VQ3FM911K33SesWYvU9aGWvv6oXZclrG7Sw0sPclLHwjtABEC6lP/M541qGHJ0OoqFOLlYa6mFSWrjdTQz2sjcy1axtRnUKu/XlWO3C3DsVbcZtPFNkL37sKGnuSxkAE3jxHAVh5A19/RUNy1OC/mhaO4aHI+DPijxCvj0ZBGiPH5srRB/SBqUaf1fiL8oa/8Rum/tV29GUFNecyRQAY0GUBpOsMe71sdjWqetMJtav/wm120SQIcsIm7YuUvbt9J0ELbvINWNiw== 

authorized_keys/db01

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/db01" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC9ynhZ3U2WVVsfjzg1OwF3lUQsS5XDtEJyMzBXrAAcHh4pdyuJFmAG54Eu4uxkRZ2yHUlmU+LpYI2WNlbyPBMLIyKRuv1WEufO61gFotIPCP2IQyk2E6YF4rumuOaynR3HrEWrxrBRb5J4gfwYR/Cw8csCpiPuY/Qut5hxh/QL/sgaXDq7i9Us7afCYl4EluEbi4LmMn3F4DgI8BSd8CwM4/b3QGyvdQUuC47XYnQZDGCvmu65RZeEVIuXzlx5ZPDBFWC0VM9SEmjGWnB0hdN54LoYzI0gAwzCSOIuSj76jxpv3Mdl+jBaOhNjcY7im0XZn8dVamAydJCNtDuSpn/IsxibIwIK7jSoktSpcZU4nbexhwZzyH0cKcG3RRMcpRaR2C9bBhFa4c4+JkjciJgnRSGR6jVjUCnUuOZX4WO6vR0veSrKEKFGxHyZUFAYY0f9rfZCUo6DoDaLkvTGpzEqfz4nCIgxV4zn1vjBhn3ZHZk/UPq3HBzA6faL06FUS0CtvFK5GdhNslhlpqQvSwKqF6YO/doVYgzmgmIFOAVOJ7pWz6MTJSTozZEARCnRHjoMNVMGCn3rN/Ql1iWIMMHM93LOsxcMFpyJ2/XT2B9N5tFrckhr0es87AMOMj2C4CLQorhrNnRmVYt7iwo/Bav3BYnoIAPsqwwjqmOuEPqlpw== 

authorized_keys/dns1

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/dns1" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeN4KcTtDX5RQBImkAWD4zj5gDPgxwjy+T/Pv6lgHd0SxsTJmbB4Y/WHC4W8bJkR2b5BV4lBDLq7YS/HL334mPoJ4Fyc9nClA+pW95Fidqt5+rHLHzCgrBZsc14U6K2HbdDuKj0VaFjtvJC151TX72fG4GpLYSDzlWdq+rptefPN9vhg0roxlfDC34wGMNIR99iuWH+b/BjlC8KgbrKDHTL4snKNH6fKQ4vsm9t5ShLue+sQIpx9c9WP4JTXhCkoEbBwEaiK9Tc4oFCAQ9z2T+JYyO0mBR9Agocw63F0uE4EmsWvqfnirgH/Oor+IuDU17ccHRqut2z/PegXsj44LUKjIm7esAtP1V1FC1j795NWAl6ln8F4ANItrpgL+H7HjgsEjX29GF4riEGeMud6zVmYEH53CgWNiFDJFsXnatnb/jfs0XVfuFN6//g+RaMe/gaQRcTVjCh930N7mYiOSxwHm1I0PUU/SoS7kCyi66IpviIskeMxGoFN5D3Hrs3ZmxSDBPQx20usXw/Pkj7NTiRWySOg8ZtQSeRFH4iiIX40Eg7s4iGvNFCaBkhxVTHlvGPDp6eQkdoeuuZ+ZwN2zWNC4S2Ugqn/OPspTw49colm9MeyWojnB4AuT81YBySQwIDB4AgTybtKerEeSNEw3w1YxDwsa11xWN1a1QY+oxrw== 

authorized_keys/dns2

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/dns2" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDiWay+JCBebK+E5XTy3H4Z0kgGv+v+bzki4mtlNR9krQ6pGbDAo36KJxxMkebBw2peuTriQXM3FIvi3ewEa0Aotc8K6VbPu/N9RaBM4zH3BQnHpjR2Zf9y7Q/62zT+oqX7KKFGZrA73lc+PkAwpDxJOJ6TrYH3IhAXuUAVmu+JJ1tId6MSyEYIm7P4iAhcqYZR0LUKHv+DTSsQKz7oj6+zgmt3UfyXV78PJPUlroDm48h0TX60mFOoCmIsPYfWlBCQJSiw50o3bvIisZFhY7mmHhR4TwSC1o1KJD5om/Ckj4fznzJIC3JjFv64Lg1eMZvU49tBvImhrxl1cDDJi6K5QXN5JsXRND9wVfnnCq6zz3vKl6wGFkKWWAOMagMsPcR6/FzwpuowO0O9H53cJ+8jnLhK94MidX64M80qU7prjREAHsoPWsDe5it7EGO3vUmEHrdsNU/drvOZN5gnGsjPIqHv1Fcc52m6jJqXpApnMxsfJN5kKwt50BVMnv4dxEly4VZtpXKDCHGPgXtOd/ynZ/8eVmB7xH3SmVkX6a+txnyl05Oa0musTm6iWJD2Lcm8bZuMULxpoy0kmmplaoviUq5K7nhjscDjUJzFd+EZcMBZFwEromnalzTuVfKo2S5l4TtW5C5dHlamV/MZJHkHZQPfQqrd3y69Ubbxo5jatw== 

authorized_keys/haproxy

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/haproxy" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCpoK3aK/YWFufn4JoXr/tAKTag2fQ2VkKka3QKz8MNc2KNKFeZW/oSE/mIpGWrk/M9bRSkq5KbUCzcYYKnqA58WzOq9hHpjubkGRdyOS2AO1MhKr+nWUu78Czz53kmeRLW7pJR+0PJPFWrPx8WNu0eteYRecUYNCfaP5CpWcRBl6/YqH31CbQJ2onaHniGPWNYwrIIW6Z1wuGW9juCekm2YZMtBW5w78odF26IsBvVEKwo9IkFuAyl3vxYksVXX+i2ajhIW4d/C+kyJgWzpvSU0WLxMLWXzTr1AcNu7mimxYUNfz7To+1VZfsQsEG3s+dRC2m3PgonMkmsOp8eNn6foXGkp2UVVDoH21OHLlScrgK+Wmfu7e1s88LSW6CTOPafqPYCwndC7Mdj2jswpOUZH3Eq09KVNqnRnBMet6LPDyJVUW2l8AAwwwef6iI3sIqgaygCtkICWmrmWlr7Hj3waJuUc0LMnhIIsWs3WU4SqsTTEOySJV3M56x6e5nU/hsdkp9ba9k91fIYq8J6f/ztDrRVZxGvEc0nKiB0QEj8VT4W5aQ5bi5ENH3DgglJxVB4C46Jjgv/kRqVpUaGTivTRMJ1pLs1iV2lKWgZ2QNmyFWi9dCBalormTAhxT/L3OBSFounaD/nKRKcSc+e/WyvOad/o7ki6CfOmxXmqZF9vQ== 

authorized_keys/proxmox01

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/proxmox01" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCtTxzpE945dVlAU4OsVBa96V+5kjYpTuWCveyE7YtTrrBe/F76VDlRpRLjiSn5tmgg/WLUGEhfk9H1xrVdLEdrqjwE6zbj+W8g05SlXa4e0cGxaGKLO7ju3Q1HjbYo76o9MevNYrn4hyGPBzsfBbLIVlpzE4ybx0F/rDOJDLQiHxJcDO0Z/t0JccBEBgul6gE7F6wys0hUm8KDO7Y3bFc9JB8UMJz7TzY6HEO/4W8lIVf/R9T43q8sCuh+H8rELnYaAmIpbZwrJLRQyTOGA/hlAKGLzkLc2APnXtAvnJWvC00ATcle6llWBlbfNIwnf5jFmsB2a8dFPX4qiUp2Hfzn1h6jaDaHXLg7ua32Tv5H7y0iKqY5v97T6rBQ+tY79hKdd1pb/5BdD9ysw9wjeaV6Y35DWVjWmQPpWS4tXXZG4Etu7+0CVO9rDGaKJo+nFA/ws9jRvbiUGLtjgsF+gPS+AUwEVIsYPhIptO4XI38/jtQEV1i1h+92g2xQ0+J+5cMkJMucI017+B/S1pgrUT6ARCyZp3a7CV0aR/VIZC57ebVQ7VQLv3CVrAnhVc9FvGNnoOdAiM4OeVZMISeLaOsNu6MNzlYwJyg+knukdgAdxLslSRfI3VKp/WKCU/YxqAFxh73KWCSQpaG/GN8Du834WE5dh+6EliTUExdZUtDS4Q== 

authorized_keys/proxmox02

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/proxmox02" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDKLkhaianwtI+08blTCYvFMmzMBJ3pYE03yu8qftpRoblc40Mn3YfkWpcG45taH2qJvEOTqgUg8WRdtgfaqKRgwNtl5CbGyWpqluEzVGcfgpZDqNLuzTQH80Qfswwa5z/KgBsg51sOfycUGNLCnd4ppUysm15BNDh4vYGgMMx178OFjbBf3L4v61k7QCEf91ZFlBZZvUHP/8NNVwM3dDGpMo6TmDGeTPMiMDWb7ioRB9TdiorJyrdFnaXSgDkKwQTZcVpMlD5VFpPP0S2ZDX3VVFFyJmWH2pm2aey22Z7hFA+RrvEgaZHcPv6hZFw4E6Znj2qKLcmtYwa0GhnzwHHb5ZwZ6rthk/EOyW2J+zD69LxhIy1s62VH2budjzv85ttDleAEPa3HtC1UDcBiZex/9Xrwuoz/x2JbJft1Z61145dfcm2WOHCy6F38nkVrFVR7JtReHE8bdZn6LWrNfyJQvXNlilbllHAlKDcbCiUoqXPRG1LMFx1NhCHC8JTRxUPvBjKRLKtH97wRQtPuaDvZ8X1ZwXF0ipzts3HUlS0YhEmvgBwgdqJ4qTJXHRjs+LOibXOkxCC530hYBy2W5Rw39l1HekERXZ8N5D7lIM6eIOsC9wf9pKZhYkr4s6VmJQzAonMX1LTgUGeJXElsZuWML/i67qrs8sPtgi0uY4jUpQ== 

authorized_keys/pve01

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/pve01" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCTmmpIP5GV/u70OX1AdeWSG1AenGv27OuWUaQLxSYbZkngb3OjiuOcgpp6ebWv/oEMFxK9mgE6x2ObY3C6NxSbUg7kJHtYD8Rd2j5kAt5S9sO80+r+wE9U/jInzO/FaA7tQuQV5gnsRPPV63dxEp0GjHcn/pa2AZPfTrVAwoBVtjW0mn83fWUF/zFaUjehxjfE6VlqJZeYYxxdc1ZNk9+ssZD6O6vhiffdj4JNHCwZCjhKvTGeQQLqC6HwXGZH0E6mpMrxQ1FChhXnTa89QIrRp7E39g9fKjVTHALTgVcDiykW+9NHWXDqRJbZ9U9lMZUX7eWDR6C/Aop+jmUEQbecUzhluHzgqhuqqsiu8Gzxw9SKx5IbyzR8ZyWs9alP5X8guxGHVeYorJfTkulq+mucvsp7CbF8etA6lnZPlvePESDhPkJSJtJ2x5+akKcFBLXQgDxqS6jBNKyQ5Ync9MO8LC9ebTdg0uL1YPR4cMfMgW+pDe3VreRiE6TyjNjKO+jLEsO9GVO2BizssGjJLOfvQdxC1tNi2Dx7h5TA8gcfdr3qD4/bflzT3zsX2t6nsSEYWmM9aICshPV9TxWWnzO6xq1zLM2QTUzX4uvjZf3ywspau9CZLhoToA0Bi28ZI5t8gq8sN/i5kSBtwLMWFLOlomVwq0J9QOsN9iF03KQnpw== 

authorized_keys/pve02

@@ -0,0 +1 @@
+command="borg serve --restrict-to-path /var/borg/pve02" ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCrzy/6w95rMG3fbfjLloAHqDve3grrisXoQqBgu74WB0zhWJAOuu/rHIMIxG0WXm/OgW0vQeI3cVEEs6gj+Lus+4HTuzs8IXS73p9i/gq0iEIuVcWgj2nhZ4uQlonPck6+O2Lpo2aDqa5eOcriBMJGCdkUymbtvpQmN7SeYRnj3rjnxcAWy+md3T2gpdcVYxnfcMkIfYqZpY/s+q3bf01cTCxf0lDpaXLO4H6QYuppnlgIHDFhcIsCGEOhJPxm26q7kAzQPhji8dBCpyT4ksFbhhEXapyuWZ9Ct5LUo/yjLmaLVwXy4S2GNEesa0hF7pUbSFzwvexCNKPFDtCvjI5PfFIFCDa6E4RL7r9XeIbZjHTbzBhDr0uPvOCCw+ObmIbzw9gUbN2yY88lcCTCBK1lQSTMInyG0qLX0OVALRcikz1TmjJo8zc9mikdfJVj9GQ0GUNLWb1GRR2DeqN1UnxkQQUnhsuujgr757lwmJQGuG5JYHt5IUGg6ioIilOOBZmyehJ3rvuU6m21hBFqvjp0fXAnhRan6loMFCmA/W4Z+b20fcVI5XS71bfyBy17cLiZPw6Y/cYxE0kYy+bWOEQH4Xk45CIOcf4D+4+lc/j9Jsz6bQX7af3v/NSm4mDxDibHFh3SAdMw3YWeZC6slGeS3JnNP7Ssj/WIUZjcEY+9nw== 

bin/pg-backup

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+cd /tmp
+
+test -d /var/lib/pgsql || exit 0
+
+pgrep postgres &>/dev/null || exit 10
+
+tar -jcvf /var/backups/postgres/postgresql-config.tbz2 /var/lib/pgsql/*/data/*.conf 
+
+/usr/sbin/runuser postgres -l -s /bin/bash -c '/usr/bin/pg_dumpall > /var/backups/postgres/pgdump.sql'
+

bin/r

@@ -1,5 +1,10 @@
 #!/usr/bin/bash
 
+usage() {
+  echo "Usage: $(basename $0) [-d] <host>" >&2
+  echo "  -d    Remove host key from known_hosts before connecting" >&2
+}
+
 DEL=""
 
 deletehost() {

bin/resize_filesystem

@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""Resize an LVM logical volume and its filesystem.
+
+Author: Bart Sjerps
+Date: 2026-07-17
+Generated by opencode
+"""
+import os
+import sys
+import subprocess
+import argparse
+from typing import Optional
+
+
+def die(msg: str) -> None:
+    """Print an error message to stderr and exit with code 2."""
+    print(f"Error: {msg}", file=sys.stderr)
+    sys.exit(2)
+
+
+def run(cmd: list[str], dryrun: bool = False) -> str:
+    """Execute a shell command, returning stdout. Exits on non-zero status."""
+    if dryrun:
+        print(f"[DRY-RUN] {' '.join(cmd)}")
+        return ""
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, check=True)
+    except subprocess.CalledProcessError as e:
+        err = (e.stderr or e.stdout or "").strip()
+        die(f"{' '.join(cmd)} failed: {err or f'exit code {e.returncode}'}")
+    return result.stdout.strip()
+
+
+def resolve_lv(mount: Optional[str] = None, lvname: Optional[str] = None) -> str:
+    """Resolve a mountpoint or LV name to an absolute LVM device path."""
+    if mount:
+        dev = run(["findmnt", "-no", "SOURCE", "--target", mount])
+        if not dev:
+            die(f"No device mounted at {mount}")
+    else:
+        dev = lvname
+
+    if not dev.startswith("/dev/"):
+        dev = f"/dev/{dev}"
+
+    if not run(["lvs", dev]):
+        die(f"{dev} is not an LVM logical volume")
+
+    return dev
+
+
+def detect_fs(dev: str) -> str:
+    """Detect the filesystem type on a block device via blkid."""
+    fstype = run(["blkid", "-o", "value", "-s", "TYPE", dev])
+    if not fstype:
+        die(f"Cannot detect filesystem on {dev}")
+    return fstype
+
+
+def resolve_mount(dev: str, mount: Optional[str] = None) -> str:
+    """Return a mountpoint for a device, using the provided one or looking it up."""
+    if mount:
+        return mount
+
+    mountpoint = run(["findmnt", "-no", "TARGET", "--source", dev])
+    if not mountpoint:
+        die(f"No mountpoint found for {dev}")
+    return mountpoint
+
+
+def lvextend_cmd(size: str, dev: str) -> list[str]:
+    """Build an lvextend command, using -l for extent/percent sizes."""
+    if "%" in size:
+        return ["lvextend", "-l", size, dev]
+    return ["lvextend", "-L", size, dev]
+
+
+def btrfs_resize_size(size: str) -> str:
+    """Map an LVM size spec to a btrfs filesystem resize argument."""
+    if "%" in size:
+        return "max"
+    return size
+
+
+def validate_resize(dev: str, fstype: str, mount: Optional[str] = None) -> Optional[str]:
+    """Validate resize is possible before mutating the LV. Returns mountpoint when needed."""
+    if fstype in ("ext2", "ext3", "ext4"):
+        return None
+    if fstype in ("xfs", "btrfs"):
+        return resolve_mount(dev, mount)
+    die(f"Unsupported filesystem: {fstype}")
+
+
+def do_resize(dev: str, fstype: str, size: str, mount: Optional[str] = None, dryrun: bool = False) -> None:
+    """Extend the LV with lvextend, then resize the filesystem accordingly."""
+    fs_mount = validate_resize(dev, fstype, mount)
+
+    run(lvextend_cmd(size, dev), dryrun=dryrun)
+
+    if fstype in ("ext2", "ext3", "ext4"):
+        run(["resize2fs", dev], dryrun=dryrun)
+    elif fstype == "xfs":
+        run(["xfs_growfs", fs_mount], dryrun=dryrun)
+    elif fstype == "btrfs":
+        run(["btrfs", "filesystem", "resize", btrfs_resize_size(size), fs_mount], dryrun=dryrun)
+
+    if not dryrun:
+        print("Done.")
+
+
+def main() -> None:
+    """Parse args, validate root, then resize LV and filesystem."""
+    parser = argparse.ArgumentParser(description="Resize an LVM logical volume and its filesystem")
+    parser.add_argument("-s", dest="size", required=True, help="New size (e.g. +10G, -5G, 20G, 100%FREE)")
+    group = parser.add_mutually_exclusive_group(required=True)
+    group.add_argument("-m", dest="mount", metavar="MOUNTPOINT", help="Select LV by mountpoint")
+    group.add_argument("-l", dest="lvname", metavar="LVNAME", help="Select LV by name or path (e.g. vg0/data)")
+    parser.add_argument("-n", dest="dryrun", action="store_true", help="Dry-run – print what would be done without executing")
+
+    args = parser.parse_args()
+
+    if os.geteuid() != 0:
+        die("This script must be run as root")
+
+    lvdev = resolve_lv(mount=args.mount, lvname=args.lvname)
+    fstype = detect_fs(lvdev)
+    do_resize(lvdev, fstype, args.size, mount=args.mount, dryrun=args.dryrun)
+
+
+if __name__ == "__main__":
+    main()

config.yml

@@ -6,14 +6,41 @@
     worker_limit: 1024  # Global variable used in the template
 
   tasks:
-    - name: Deploy sssd.conf
+    - name: Root password
-      template:
+      ansible.builtin.import_tasks: tasks/rootpass.yml
-        src: templates/sssd.conf
+
-        dest: /etc/sssd/conf.d/sssd.conf
+    - name: Create Directories
+      file:
+        path: '{{ item.directory }}'
+        state: directory
+        mode: "{{ item.mode | default('0755') }}"
         owner: root
         group: root
-        mode: '0600'
+      loop:
-      notify: Restart sssd  # This triggers the handler only if the file changes
+        - { directory: "/var/backups" }
+        - { directory: "/opt/atclab/bin" }
+        - { directory: "/var/user", mode: "1777" }
+
+    - name: Copy etc configs
+      copy:
+        src: '{{ item.src }}'
+        dest: '{{ item.dest }}'
+        owner: root
+        group: root
+        mode: "{{ item.mode | default('0644') }}"
+      loop:
+        - { src: templates/users.autofs, dest: /etc/auto.master.d/users.autofs }
+        - { src: templates/auto.users, dest: /etc/auto.users }
+        - { src: templates/sssd.conf, dest: /etc/sssd/conf.d/sssd.conf, mode: '0600' }
+
+#     - name: Deploy sssd.conf
+#       template:
+#         src: templates/sssd.conf
+#         dest: /etc/sssd/conf.d/sssd.conf
+#         owner: root
+#         group: root
+#         mode: '0600'
+#       notify: Restart sssd  # This triggers the handler only if the file changes
 
     - name: Deploy ldap.conf
       template:
@@ -45,26 +72,17 @@
         dest: /etc/sudoers.d/sudogroup
         owner: root
         group: root
-        mode: '0644'
+        mode: '0440'
 
-    - name: Root password
+    - name: Deploy gitconfig
-      user:
+      template:
-        name: root
+        src: templates/gitconfig
-        password: "$6$OJEdzUbqfQR72WjX$SFMnDZ0MXM7JfYKPvvN0nJIPetzrWQw/0q360xgR9mwJVwrme4dt9hhtH95yytn8Ln0.0koVCno6vskylJFm5."
+        dest: /etc/gitconfig
-
-    - name: Disable SELinux
-      ansible.builtin.selinux:
-        state: disabled
-
-    - name: Create bin directory
-      file:
-        path: /opt/atclab/bin
-        state: directory
-        mode: '0755'
         owner: root
         group: root
+        mode: '0644'
 
-    - name: Copy etc configs
+    - name: Copy profile configs
       copy:
         src: etc/profile.d/
         dest: /etc/profile.d/
@@ -72,6 +90,17 @@
         group: root
         mode: '0644'
 
+    - name: Copy etc configs
+      copy:
+        src: '{{ item.src }}'
+        dest: '{{ item.dest }}'
+        owner: root
+        group: root
+        mode: '0644'
+      loop:
+        - { src: templates/users.autofs, dest: /etc/auto.master.d/users.autofs }
+        - { src: templates/auto.users, dest: /etc/auto.users }
+
     - name: Copy bin scripts
       copy:
         src: bin/

docker.yml

@@ -50,6 +50,7 @@
         mode: '0644'
       notify: Restart docker
 
+
     - name: Open Firewall port
       firewalld:
         # service: docker-registry
@@ -59,6 +60,15 @@
         immediate: yes
       when: ansible_facts['os_family'] == "RedHat"
 
+    - name: Close Firewall port
+      firewalld:
+        # service: docker-registry
+        port: 2375/tcp
+        permanent: true
+        state: disabled
+        immediate: yes
+      when: ansible_facts['os_family'] == "RedHat"
+
     - name: Create /volumes directory
       file:
         path: /volumes

etc/profile.d/opencode.sh

@@ -0,0 +1,32 @@
+# Redirect XDG data/cache/state to local disk under /var/user/$USER.
+# /var/user must allow users to create their own subdirectory.
+
+# This fixes Opencode on users with home directories on NFS.
+
+
+if [ -n "$USER" ] && [ "$USER" != "root" ]; then
+  LOCAL_BASE="/var/user/$USER"
+
+  test -d $LOCAL_BASE || mkdir $LOCAL_BASE
+
+  if [ ! -d "$LOCAL_BASE" ]; then
+  if mkdir -p \
+      "$LOCAL_BASE/.local/share" \
+      "$LOCAL_BASE/.cache" \
+      "$LOCAL_BASE/.local/state" 2>/dev/null
+  then
+    chmod 700 "$LOCAL_BASE" \
+              "$LOCAL_BASE/.local" \
+              "$LOCAL_BASE/.local/share" \
+              "$LOCAL_BASE/.local/state" \
+              "$LOCAL_BASE/.cache" 2>/dev/null || true
+  fi
+  fi
+
+  if [ -d "$LOCAL_BASE" ]; then
+    export XDG_DATA_HOME="$LOCAL_BASE/.local/share"
+    export XDG_CACHE_HOME="$LOCAL_BASE/.cache"
+    export XDG_STATE_HOME="$LOCAL_BASE/.local/state"
+  fi
+fi
+

gpu.yml

@@ -45,3 +45,6 @@
       # Add:
       # dkms autoinstall -k $(uname -r)
 
+
+# post-install: 
+# dkms install nvidia/580.173.02 -k $(uname -r) 2>&1 && sudo modprobe nvidia

group_vars/all.yml

@@ -30,5 +30,9 @@ common_packages:
   - wget
   - xfsprogs
 
+root_password_hash: "$6$OJEdzUbqfQR72WjX$SFMnDZ0MXM7JfYKPvvN0nJIPetzrWQw/0q360xgR9mwJVwrme4dt9hhtH95yytn8Ln0.0koVCno6vskylJFm5."
+
 proxmox_packages:
   - unattended-upgrades
+  - borgmatic
+  - net-tools

inventory.ini

@@ -2,57 +2,93 @@
 atc-docker01.dell-atc.lan
 atc-docker02.dell-atc.lan
 atc-db01.dell-atc.lan
-# atc-db02.dell-atc.lan
+atc-dns1.dell-atc.lan
 atc-lake01.dell-atc.lan
 atc-elastic01.dell-atc.lan
 atc-kafka01.dell-atc.lan
 atc-portal01.dell-atc.lan
 atc-grafana.dell-atc.lan
-# atc-test01.dell-atc.lan
 atc-mgt01.dell-atc.lan
 atc-gpu-bart.dell-atc.lan
+atc-gpu-dev.dell-atc.lan
 atc-gpu-mo1.dell-atc.lan
+atc-gpu-prod.dell-atc.lan
 atc-nas.dell-atc.lan
+mgt01.dell-fde.lan
+dns1.dell-fde.lan
+dns2.dell-fde.lan
+db01.dell-fde.lan
+haproxy.dell-fde.lan
 
 [proxmox]
 dcp-pve01.dell-atc.lan
 DSS-GPU.dell-atc.lan
 pve2.dell-atc.lan
+proxmox01.dell-fde.lan
+proxmox02.dell-fde.lan
 
 [docker]
-atc-mgt01.dell-atc.lan
+atc-db02.dell-atc.lan
+atc-dns1.dell-atc.lan
 atc-docker01.dell-atc.lan
 atc-docker02.dell-atc.lan
 atc-gpu-bart.dell-atc.lan
-atc-gpu-mo1.dell-atc.lan
+atc-gpu-dev.dell-atc.lan
-# atc-dns1.dell-atc.lan
+atc-gpu-mo2.dell-atc.lan
-# atc-dns2.dell-atc.lan
+atc-gpu-prod.dell-atc.lan
+atc-mgt01.dell-atc.lan
+atc-portal01.dell-atc.lan
+dns1.dell-fde.lan
+dns2.dell-fde.lan
+mgt01.dell-fde.lan
 
 [rhel]
 atc-docker01.dell-atc.lan
 atc-docker02.dell-atc.lan
 atc-mgt01.dell-atc.lan
 atc-gpu-bart.dell-atc.lan
+atc-gpu-mo2.dell-atc.lan
+atc-gpu-dev.dell-atc.lan
+atc-gpu-prod.dell-atc.lan
 atc-nas.dell-atc.lan
-atc-gpu-bart.dell-atc.lan
 atc-backup.dell-atc.lan
-atc-nas.dell-atc.lan
 atc-db01.dell-atc.lan
+dns1.dell-fde.lan
+haproxy.dell-fde.lan
+dns2.dell-fde.lan
+db01.dell-fde.lan
+mgt01.dell-fde.lan
 
 [borg_servers]
 atc-backup.dell-atc.lan
 
 [borg_clients]
+atc-db01.dell-atc.lan
 atc-docker01.dell-atc.lan
 atc-docker02.dell-atc.lan
 atc-gpu-bart.dell-atc.lan
+atc-gpu-prod.dell-atc.lan
 atc-mgt01.dell-atc.lan
 atc-nas.dell-atc.lan
+db01.dell-fde.lan
+dcp-pve01.dell-atc.lan
+dns1.dell-fde.lan
+dns2.dell-fde.lan
+dss-gpu.dell-atc.lan
+haproxy.dell-fde.lan
+pve2.dell-atc.lan
+proxmox01.dell-fde.lan
+proxmox02.dell-fde.lan
+mgt01.dell-fde.lan
+
+[postgres]
 atc-db01.dell-atc.lan
+db01.dell-fde.lan
 
 [nvidia]
 atc-gpu-bart.dell-atc.lan
 atc-gpu-mo1.dell-atc.lan
+atc-gpu-prod.dell-atc.lan
 
 [rocky:children]
 servers

postgres.yml

@@ -0,0 +1,66 @@
+---
+- name: Postgres Servers
+  hosts: postgres
+  pre_tasks:
+    - name: Postgres Repo
+      ansible.builtin.dnf:
+        name: 'https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm'
+        state: present
+        disable_gpg_check: true
+
+    - name: Postgres RPMs
+      ansible.builtin.dnf:
+        name:
+          - postgresql18-server
+          - postgresql18-contrib
+        state: latest
+
+  tasks:
+    - name: Create Database Logical Volume
+      community.general.lvol:
+        vg: data
+        lv: pgdata
+        size: 32G
+
+    - name: Create Database Filesystem
+      community.general.filesystem:
+        fstype: xfs
+        dev: /dev/data/pgdata
+
+    - name: Mount filesystems
+      ansible.posix.mount:
+        path: '/var/lib/pgsql'
+        src: '/dev/data/pgdata'
+        opts: 'noatime'
+        state: mounted
+        fstype: "xfs"
+
+    - name: Open Firewall port
+      firewalld:
+        # service: docker-registry
+        service: postgresql
+        permanent: true
+        state: enabled
+        immediate: yes
+      when: ansible_facts['os_family'] == "RedHat"
+
+    - name: PG Backup directory
+      file:
+        path: '/var/backups/postgres'
+        state: directory
+        mode: '0775'
+        owner: postgres
+        group: postgres
+
+    - name: Backup script
+      copy:
+        src: 'bin/pg-backup'
+        dest: '/usr/local/bin/pg-backup'
+        mode: '0755'
+
+    - name: Setup Postgres backup cron job
+      ansible.builtin.cron:
+        name: "pg-backup"
+        minute: 30
+        hour: 23
+        job: /usr/local/bin/pg-backup

proxmox.yml

@@ -9,3 +9,33 @@
         name: "{{proxmox_packages}}"
         state: present
 
+    - name: Deploy Unattended-upgrades config
+      copy:
+        src: templates/50unattended-upgrades
+        dest: /etc/apt/apt.conf.d/50unattended-upgrades
+        owner: root
+        group: root
+        mode: "0644"
+        backup: true
+
+    - name: Create systemd drop-in directory for apt-daily-upgrade.timer
+      ansible.builtin.file:
+        path: /etc/systemd/system/apt-daily-upgrade.timer.d
+        state: directory
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Override apt-daily-upgrade.timer schedule to run Sundays at 23:00
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/apt-daily-upgrade.timer.d/override.conf
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Timer]
+          OnCalendar=
+          OnCalendar=Sun *-*-* 23:00:00
+          RandomizedDelaySec=0
+          Persistent=false
+

tasks/borgmatic.yml

@@ -4,13 +4,28 @@
     name: "borgmatic"
     state: present
 
+- name: Create directories
+  file:
+    path: '{{ item }}'
+    state: directory
+    owner: root
+    group: root
+    mode: '0750'
+  loop:
+    - '/etc/borgmatic'
+    - '/etc/borgmatic.d'
+
 - name: Deploy borgmatic config
   template:
-    src: templates/borgmatic-system.yaml
+    src: "{{ item.source }}"
-    dest: /etc/borgmatic.d/system.yaml
+    dest: "{{ item.target }}"
     owner: root
     group: root
     mode: '0644'
+  loop:
+    - { source: "templates/borgmatic-system.yaml", target: "/etc/borgmatic.d/system.yaml" }
+    - { source: "templates/borgmatic-data.yaml", target: "/etc/borgmatic.d/data.yaml" }
+
 
 - name: Deploy borgmatic excludes
   template:
@@ -44,7 +59,7 @@
 - name: Pickup authorized_key
   fetch:
     src: /etc/borgmatic/authorized_keys
-    dest: authorized_keys/{{ ansible_fqdn }}
+    dest: authorized_keys/{{ ansible_hostname }}
     flat: yes
 
 - name: Setup Backup Cron Job

tasks/rootpass.yml

@@ -0,0 +1,5 @@
+---
+- name: Root password
+  ansible.builtin.user:
+    name: root
+    password: "{{ root_password_hash }}"

templates/50unattended-upgrades

@@ -0,0 +1,166 @@
+// Unattended-Upgrade::Origins-Pattern controls which packages are
+// upgraded.
+//
+// Lines below have the format "keyword=value,...".  A
+// package will be upgraded only if the values in its metadata match
+// all the supplied keywords in a line.  (In other words, omitted
+// keywords are wild cards.) The keywords originate from the Release
+// file, but several aliases are accepted.  The accepted keywords are:
+//   a,archive,suite (eg, "stable")
+//   c,component     (eg, "main", "contrib", "non-free")
+//   l,label         (eg, "Debian", "Debian-Security")
+//   o,origin        (eg, "Debian", "Unofficial Multimedia Packages")
+//   n,codename      (eg, "jessie", "jessie-updates")
+//     site          (eg, "http.debian.net")
+// The available values on the system are printed by the command
+// "apt-cache policy", and can be debugged by running
+// "unattended-upgrades -d" and looking at the log file.
+//
+// Within lines unattended-upgrades allows 2 macros whose values are
+// derived from /etc/debian_version:
+//   ${distro_id}            Installed origin.
+//   ${distro_codename}      Installed codename (eg, "buster")
+Unattended-Upgrade::Origins-Pattern {
+        // Codename based matching:
+        // This will follow the migration of a release through different
+        // archives (e.g. from testing to stable and later oldstable).
+        // Software will be the latest available for the named release,
+        // but the Debian release itself will not be automatically upgraded.
+        "origin=Debian,codename=${distro_codename}-updates";
+//      "origin=Debian,codename=${distro_codename}-proposed-updates";
+        "origin=Debian,codename=${distro_codename},label=Debian";
+        "origin=Debian,codename=${distro_codename},label=Debian-Security";
+        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
+//      "o=Debian Backports,n=${distro_codename}-backports,l=Debian Backports";
+        "origin=Proxmox,label=Proxmox Debian Repository";
+
+        // Archive or Suite based matching:
+        // Note that this will silently match a different release after
+        // migration to the specified archive (e.g. testing becomes the
+        // new stable).
+//      "o=Debian,a=stable";
+//      "o=Debian,a=stable-updates";
+//      "o=Debian,a=proposed-updates";
+//      "o=Debian Backports,a=stable-backports,l=Debian Backports";
+};
+
+// Python regular expressions, matching packages to exclude from upgrading
+Unattended-Upgrade::Package-Blacklist {
+    // The following matches all packages starting with linux-
+//  "linux-";
+
+    // Use $ to explicitely define the end of a package name. Without
+    // the $, "libc6" would match all of them.
+//  "libc6$";
+//  "libc6-dev$";
+//  "libc6-i686$";
+
+    // Special characters need escaping
+//  "libstdc\+\+6$";
+
+    // The following matches packages like xen-system-amd64, xen-utils-4.1,
+    // xenstore-utils and libxenstore3.0
+//  "(lib)?xen(store)?";
+
+    // For more information about Python regular expressions, see
+    // https://docs.python.org/3/howto/regex.html
+};
+
+// This option allows you to control if on a unclean dpkg exit
+// unattended-upgrades will automatically run 
+//   dpkg --force-confold --configure -a
+// The default is true, to ensure updates keep getting installed
+//Unattended-Upgrade::AutoFixInterruptedDpkg "true";
+
+// Split the upgrade into the smallest possible chunks so that
+// they can be interrupted with SIGTERM. This makes the upgrade
+// a bit slower but it has the benefit that shutdown while an upgrade
+// is running is possible (with a small delay)
+//Unattended-Upgrade::MinimalSteps "true";
+
+// Install all updates when the machine is shutting down
+// instead of doing it in the background while the machine is running.
+// This will (obviously) make shutdown slower.
+// Unattended-upgrades increases logind's InhibitDelayMaxSec to 30s.
+// This allows more time for unattended-upgrades to shut down gracefully
+// or even install a few packages in InstallOnShutdown mode, but is still a
+// big step back from the 30 minutes allowed for InstallOnShutdown previously.
+// Users enabling InstallOnShutdown mode are advised to increase
+// InhibitDelayMaxSec even further, possibly to 30 minutes.
+//Unattended-Upgrade::InstallOnShutdown "false";
+
+// Send email to this address for problems or packages upgrades
+// If empty or unset then no email is sent, make sure that you
+// have a working mail setup on your system. A package that provides
+// 'mailx' must be installed. E.g. "user@example.com"
+//Unattended-Upgrade::Mail "";
+
+// Set this value to one of:
+//    "always", "only-on-error" or "on-change"
+// If this is not set, then any legacy MailOnlyOnError (boolean) value
+// is used to chose between "only-on-error" and "on-change"
+//Unattended-Upgrade::MailReport "on-change";
+
+// Remove unused automatically installed kernel-related packages
+// (kernel images, kernel headers and kernel version locked tools).
+//Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+
+// Do automatic removal of newly unused dependencies after the upgrade
+//Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
+
+// Do automatic removal of unused packages after the upgrade
+// (equivalent to apt-get autoremove)
+//Unattended-Upgrade::Remove-Unused-Dependencies "false";
+
+// Automatically reboot *WITHOUT CONFIRMATION* if
+//  the file /var/run/reboot-required is found after the upgrade
+//Unattended-Upgrade::Automatic-Reboot "false";
+
+// Automatically reboot even if there are users currently logged in
+// when Unattended-Upgrade::Automatic-Reboot is set to true
+//Unattended-Upgrade::Automatic-Reboot-WithUsers "true";
+
+// If automatic reboot is enabled and needed, reboot at the specific
+// time instead of immediately
+//  Default: "now"
+//Unattended-Upgrade::Automatic-Reboot-Time "02:00";
+
+// Use apt bandwidth limit feature, this example limits the download
+// speed to 70kb/sec
+//Acquire::http::Dl-Limit "70";
+
+// Enable logging to syslog. Default is False
+// Unattended-Upgrade::SyslogEnable "false";
+
+// Specify syslog facility. Default is daemon
+// Unattended-Upgrade::SyslogFacility "daemon";
+
+// Download and install upgrades only on AC power
+// (i.e. skip or gracefully stop updates on battery)
+// Unattended-Upgrade::OnlyOnACPower "true";
+
+// Download and install upgrades only on non-metered connection
+// (i.e. skip or gracefully stop updates on a metered connection)
+// Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true";
+
+// Verbose logging
+// Unattended-Upgrade::Verbose "false";
+
+// Print debugging information both in unattended-upgrades and
+// in unattended-upgrade-shutdown
+// Unattended-Upgrade::Debug "false";
+
+// Allow package downgrade if Pin-Priority exceeds 1000
+// Unattended-Upgrade::Allow-downgrade "false";
+
+// When APT fails to mark a package to be upgraded or installed try adjusting
+// candidates of related packages to help APT's resolver in finding a solution
+// where the package can be upgraded or installed.
+// This is a workaround until APT's resolver is fixed to always find a
+// solution if it exists. (See Debian bug #711128.)
+// The fallback is enabled by default, except on Debian's sid release because
+// uninstallable packages are frequent there.
+// Disabling the fallback speeds up unattended-upgrades when there are
+// uninstallable packages at the expense of rarely keeping back packages which
+// could be upgraded or installed.
+// Unattended-Upgrade::Allow-APT-Mark-Fallback "true";

templates/auto.users

@@ -0,0 +1 @@
+*	nfs.dell-fde.lan:/export/users/&

templates/borgmatic-auth-key

@@ -1 +1 @@
-command="borg serve --restrict-to-path /var/borg/{{ ansible_fqdn }}" {{ included_content }}
+command="borg serve --restrict-to-path /var/borg/{{ ansible_hostname }}" {{ included_content }}

templates/borgmatic-data.yaml

@@ -0,0 +1,54 @@
+constants:
+    user: borg
+    local: {{ ansible_hostname }}
+    remote: atc-backup.dell-atc.lan
+    base: /var/borg
+
+source_directories:
+    - /home
+    - /srv
+    - /var/backups
+{% if 'docker' in group_names %}
+    - /var/lib/docker/volumes/
+{% endif -%}
+{% if 'webservers' in group_names %}
+    - /var/www
+{% endif -%}
+{% if 'mailservers' in group_names %}
+    - /var/dovecot
+{% endif %}
+{% if 'proxmox' in group_names %}
+    - /etc/pve
+{% endif -%}
+{% for dir in backup_dirs | default([]) %}
+    - {{ dir }}
+{% endfor %}
+    
+repositories:
+    - path: ssh://{user}@{remote}{base}/{local}
+      label: data
+
+exclude_from:
+    - /etc/borgmatic/excludes
+
+color: false
+ssh_command: ssh -i /etc/borgmatic/borg_key -oBatchMode=yes -o StrictHostKeychecking=no
+archive_name_format: 'data-{now:%Y-%m-%d_%H%M}'
+
+# borg_base_directory: /path/to/base
+# $borg_base_directory/.config/borg
+# borg_config_directory: /path/to/base/config
+
+# $borg_base_directory/.cache/borg
+# borg_cache_directory: /path/to/base/cache
+
+# keep_within: 3H
+# keep_secondly: 60
+# keep_minutely: 60
+# keep_hourly: 24
+
+keep_daily: 7
+keep_weekly: 4
+keep_monthly: 6
+keep_yearly: 1
+

templates/borgmatic-excludes

@@ -9,6 +9,7 @@
 */.vscode-server
 *.pyc
 */mirrors
+*/models
 */repodata
 */blobs
 /etc/selinux

templates/borgmatic-system.yaml

@@ -1,6 +1,6 @@
 constants:
-    user: borg # borg_{{ ansible_nodename }}
+    user: borg
-    local: {{ ansible_fqdn }}
+    local: {{ ansible_hostname }}
     remote: atc-backup.dell-atc.lan
     base: /var/borg
 
@@ -9,6 +9,7 @@ source_directories:
     - /home
     - /usr/local
     - /opt
+    - /root
     - /var/backups
     - /var/log
     - /var/opt

templates/gitconfig

@@ -0,0 +1,11 @@
+[alias]
+	co = checkout
+	ci = commit
+	st = status
+	br = branch
+	type = cat-file -t
+	dump = cat-file -p
+	hist = log -n 25 --pretty=format:'%h %ad | %s%d [%an]' --graph --date=short
+	histall = log --pretty=format:'%h %ad | %s%d [%an]' --graph --date=short
+	sh = !git remote -v && git br -a --color=never && git stash list && git status && git hist
+

templates/users.autofs

@@ -0,0 +1 @@
+/users	/etc/auto.users

test.yml

@@ -0,0 +1,51 @@
+---
+- name: Test Stuff
+  hosts: docker
+  tasks:
+    - name: Create directories
+      file:
+        path: '{{ item }}'
+        state: directory
+        owner: root
+        group: root
+        mode: '0750'
+      loop:
+        - '/var/lib/containerd'
+        - '/var/lib/docker/volumes'
+        - '/volumes'
+
+    - name: Create Docker Logical Volume
+      community.general.lvol:
+        vg: data
+        lv: docker
+        size: 8G
+
+    - name: Create Logical Volume 'vols'
+      community.general.lvol:
+        vg: data
+        lv: vols
+        size: 1G
+
+    - name: Create Filesystem on docker
+      community.general.filesystem:
+        fstype: xfs
+        dev: /dev/data/docker
+
+    - name: Create Filesystem on vols
+      community.general.filesystem:
+        fstype: xfs
+        dev: /dev/data/vols
+
+    - name: Mount filesystems
+      ansible.posix.mount:
+        path: '{{ item.path }}'
+        src: '{{ item.src }}'
+        opts: '{{ item.opts }}'
+        state: mounted
+        fstype: "{{ item.fstype | default('xfs') }}"
+      loop:
+        - { path: '/var/lib/containerd', src: '/dev/data/docker', opts: 'noatime' }
+        - { path: '/var/lib/docker/volumes', src: '/dev/data/vols', opts: 'noatime' }
+        - { path: '/volumes', src: '/var/lib/docker/volumes', opts: 'bind', fstype: 'none' }
+
+