#!/usr/bin/env bash
set -euo pipefail

# Borg receives CAP_DAC_READ_SEARCH only for local snapshot traversal. Drop it
# before starting the network transport so SSH runs as the plain service user.
exec setpriv \
  --inh-caps=-all \
  --ambient-caps=-all \
  -- /usr/bin/ssh \
  -i {{ atlas_borg_ssh_private_key_path | quote }} \
  -p {{ atlas_borg_repository_port | int }} \
  -o BatchMode=yes \
  -o IdentitiesOnly=yes \
  -o StrictHostKeyChecking=yes \
  -o UserKnownHostsFile={{ atlas_borg_known_hosts_path | quote }} \
  -o ConnectTimeout=30 \
  -o ServerAliveInterval=60 \
  -o ServerAliveCountMax=3 \
  "$@"