Add BorgBase offsite backup repository

Adds a second borgmatic repository targeting BorgBase (US region) for
offsite backups, completing a 3-2-1 backup strategy. SSH key is managed
via 1Password and deployed by Ansible.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ansible/playbooks/indri.yml

@@ -22,6 +22,22 @@
       no_log: true
       tags: [borgmatic]
 
+    - name: Fetch BorgBase SSH private key
+      ansible.builtin.command:
+        cmd: op read "op://vg6xf6vvfmoh5hqjjhlhbeoaie/noiobufntsxyzageu7mvlp2nbe/ssh-private-key"
+      delegate_to: localhost
+      register: _borgbase_ssh_key
+      changed_when: false
+      no_log: true
+      check_mode: false
+      tags: [borgmatic]
+
+    - name: Set BorgBase SSH key fact
+      ansible.builtin.set_fact:
+        borgbase_ssh_private_key: "{{ _borgbase_ssh_key.stdout }}"
+      no_log: true
+      tags: [borgmatic]
+
     # Forgejo secrets
     - name: Fetch forgejo LFS JWT secret
       ansible.builtin.command:

ansible/roles/borgmatic/defaults/main.yml

@@ -17,12 +17,19 @@ borgmatic_source_directories:
   - /Users/erichblume/.config/borgmatic
   - /Users/erichblume/Documents
 
-# Backup repository
+# Backup repositories
 borgmatic_repositories:
   - path: /Volumes/backups/borg/
     label: sifaka-borg-backups
     encryption: repokey
     append_only: true
+  - path: ssh://k04ljcd7@k04ljcd7.repo.borgbase.com/./repo
+    label: borgbase-offsite
+    encryption: repokey
+    append_only: true
+
+# BorgBase SSH key (fetched from 1Password in playbook pre_tasks)
+borgmatic_borgbase_ssh_key_path: /Users/erichblume/.ssh/borgbase_ed25519
 
 # Exclude patterns
 borgmatic_exclude_patterns: []

ansible/roles/borgmatic/tasks/main.yml

@@ -19,6 +19,20 @@
     mode: '0600'
   no_log: true
 
+# BorgBase offsite backup - SSH key and host verification
+- name: Deploy BorgBase SSH private key
+  ansible.builtin.copy:
+    content: "{{ borgbase_ssh_private_key }}\n"
+    dest: "{{ borgmatic_borgbase_ssh_key_path }}"
+    mode: '0600'
+  no_log: true
+
+- name: Add BorgBase host key to known_hosts
+  ansible.builtin.known_hosts:
+    name: k04ljcd7.repo.borgbase.com
+    key: "k04ljcd7.repo.borgbase.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGU0mISTyHBw9tBs6SuhSq8tvNM8m9eifQxM+88TowPO"
+    state: present
+
 - name: Deploy borgmatic configuration
   ansible.builtin.template:
     src: config.yaml.j2

ansible/roles/borgmatic/templates/config.yaml.j2

@@ -31,6 +31,8 @@ exclude_patterns:
 
 encryption_passcommand: {{ borgmatic_encryption_passcommand }}
 
+ssh_command: ssh -i {{ borgmatic_borgbase_ssh_key_path }}
+
 # Retention policy
 keep_daily: {{ borgmatic_keep_daily }}
 keep_monthly: {{ borgmatic_keep_monthly }}

docs/changelog.d/feature-borgbase-offsite-backup.feature.md

@@ -0,0 +1 @@
+Add BorgBase offsite backup repository for 3-2-1 backup strategy