Add mailcow-pull SSH keypair to Ansible vault #13

New issue

Closed

opened 2026-07-06 02:32:48 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-07-06 02:32:48 +00:00

Collaborator

Re-running borg-backup.yml as-is today would generate a different keypair and silently break the forced-command authorized_keys entry already deployed on ccnet-mailcow-ash-1 (mail.coppercore.cc), since that entry is pinned to the specific public key currently live on swarm-mgr-01.

Fix: copy the existing keypair content from swarm-mgr-01 into vault_mailcow_pull_private_key / vault_mailcow_pull_public_key via ansible-vault edit -- do not generate a new keypair.

See ccnet-borg-backup/README.md, 'Mailcow backup pull' section.

The swarm-mgr-01-mailcow-pull ed25519 keypair (used by borg-backup.yml's mailcow backup pull) was generated by hand directly on swarm-mgr-01 on 2026-07-06, since the vault password wasn't available in that session -- it currently only exists at /etc/borg/mailcow_pull_key{,.pub} on that host, not in group_vars/all/vault.yml. Re-running borg-backup.yml as-is today would generate a *different* keypair and silently break the forced-command authorized_keys entry already deployed on ccnet-mailcow-ash-1 (mail.coppercore.cc), since that entry is pinned to the specific public key currently live on swarm-mgr-01. Fix: copy the existing keypair content from swarm-mgr-01 into vault_mailcow_pull_private_key / vault_mailcow_pull_public_key via ansible-vault edit -- do not generate a new keypair. See ccnet-borg-backup/README.md, 'Mailcow backup pull' section.

claude-bot added the

borg-backup

p:high

labels

2026-07-06 02:32:48 +00:00

claude-bot commented

2026-08-27 02:27:00 +00:00

Author

Collaborator

Closing as obsolete. This keypair protected borg-backup.yml's nightly mailcow-backup pull, which:

targeted ccnet-mailcow-ash-1 (mail.coppercore.cc) — decommissioned 2026-07-09;
ran from ccnet-borg-backup/, the whole playbook of which was retired 2026-08-16 (superseded by ccnet-pbs-backup-swarm-data/, all timers/services disabled).

Mail is now ccnet-wv-mailcow (onsite Proxmox VM) backed up by PBS at the disk-image level — no guest-side pull, no SSH keypair, nothing to vault. Nothing re-runs borg-backup.yml today, so the "re-running would generate a different key and break authorized_keys" risk no longer applies.

Closing as obsolete. This keypair protected `borg-backup.yml`'s nightly mailcow-backup pull, which: - targeted `ccnet-mailcow-ash-1` (`mail.coppercore.cc`) — **decommissioned 2026-07-09**; - ran from `ccnet-borg-backup/`, the whole playbook of which was **retired 2026-08-16** (superseded by `ccnet-pbs-backup-swarm-data/`, all timers/services disabled). Mail is now `ccnet-wv-mailcow` (onsite Proxmox VM) backed up by PBS at the disk-image level — no guest-side pull, no SSH keypair, nothing to vault. Nothing re-runs `borg-backup.yml` today, so the "re-running would generate a different key and break authorized_keys" risk no longer applies.

claude-bot closed this issue

2026-08-27 02:27:03 +00:00