mirror of
https://github.com/fscotto/infra.git
synced 2026-09-27 11:02:47 +00:00
20 lines
614 B
Django/Jinja
20 lines
614 B
Django/Jinja
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
# Borg receives CAP_DAC_READ_SEARCH only for local snapshot traversal. Drop it
|
|
# before starting the network transport so SSH runs as the plain service user.
|
|
exec setpriv \
|
|
--inh-caps=-all \
|
|
--ambient-caps=-all \
|
|
-- /usr/bin/ssh \
|
|
-i {{ atlas_borg_ssh_private_key_path | quote }} \
|
|
-p {{ atlas_borg_repository_port | int }} \
|
|
-o BatchMode=yes \
|
|
-o IdentitiesOnly=yes \
|
|
-o StrictHostKeyChecking=yes \
|
|
-o UserKnownHostsFile={{ atlas_borg_known_hosts_path | quote }} \
|
|
-o ConnectTimeout=30 \
|
|
-o ServerAliveInterval=60 \
|
|
-o ServerAliveCountMax=3 \
|
|
"$@"
|