Move backup-related variable defaults from the database roles into the
borg_client role. Also check group membership to guard installation of
database backup helper scripts.

Using plain "borg" resolves to /usr/local/bin/borg which is the wrapper
for our main backup host. This causes the offsite backup to be executed
with BORG_REPO set to the main backup destination.

While the above doesn't cause any issues with the backup script/service,
because borg invocations specify the backup destination as an argument,
it's not ideal and/or correct. Adjust borg_cmd to include the full path
of /usr/bin/borg, thus removing any ambiguity.

rsync.net has upgraded to borg 1.2 and we can now run borg compact on
both rsync.net and the Hetzner storage box.

Fixes: 17927c9a ("borg_client: run compact after pruning on borg 1.2")

These are used to signal the start of the document in a stream of many
documents. As Ansible only supports one YAML document per file this is
unnecessary. About a third of our YAML documents already lacked these.

Only doing this on the Hetzner storage box for now; waiting for
rsync.net to upgrade to borg 1.2 so we can enable it there too.

Kind of sensitive information that doesn't need to be available to all
hosts.

New username; separate and longer account manager + storage passwords.

Also, have to use --remote-path=borg1 when interacting with rsync.net.

This offers improved separation between the server backups and should
avoid bumping against the storage box 10 concurrent connection limit.

Fixes: archlinux/infrastructure#362

Apparently the host without prio is the traffic shaped one which has been very slow for us.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

Signed-off-by: Florian Pritz <bluewind@xinu.at>

The tasks that use variables need them to be at least defined,
even if empty, to be able to run. Added some defaults.