Add encrypted Borg backups for Atlas

ansible/roles/profile_atlas/templates/atlas-borg-ssh.sh.j2

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Borg receives CAP_DAC_READ_SEARCH only for local snapshot traversal. Drop it
+# before starting the network transport so SSH runs as the plain service user.
+exec setpriv \
+  --inh-caps=-all \
+  --ambient-caps=-all \
+  -- /usr/bin/ssh \
+  -i {{ atlas_borg_ssh_private_key_path | quote }} \
+  -p {{ atlas_borg_repository_port | int }} \
+  -o BatchMode=yes \
+  -o IdentitiesOnly=yes \
+  -o StrictHostKeyChecking=yes \
+  -o UserKnownHostsFile={{ atlas_borg_known_hosts_path | quote }} \
+  -o ConnectTimeout=30 \
+  -o ServerAliveInterval=60 \
+  -o ServerAliveCountMax=3 \
+  "$@"