From 1dbaf7f8736603f8f519733f0cf26441f73f37ae Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Tue, 3 Mar 2026 18:50:20 +0000
Subject: [PATCH] Configure osmbackup user directly using chef resources

---
 cookbooks/backup/attributes/default.rb |  2 --
 cookbooks/backup/metadata.rb           |  1 -
 cookbooks/backup/recipes/default.rb    |  2 +-
 cookbooks/backup/recipes/user.rb       | 32 ++++++++++++++++++++++++++
 cookbooks/db/metadata.rb               |  2 +-
 cookbooks/db/recipes/backup.rb         |  2 ++
 cookbooks/db/recipes/base.rb           |  1 -
 roles/db-backup.rb                     |  5 ----
 test/data_bags/accounts/osmbackup.json |  7 ------
 9 files changed, 36 insertions(+), 18 deletions(-)
 create mode 100644 cookbooks/backup/recipes/user.rb
 delete mode 100644 test/data_bags/accounts/osmbackup.json

diff --git a/cookbooks/backup/attributes/default.rb b/cookbooks/backup/attributes/default.rb
index 2773238ab..c0b8de57f 100644
--- a/cookbooks/backup/attributes/default.rb
+++ b/cookbooks/backup/attributes/default.rb
@@ -1,3 +1 @@
 default[:stats][:sites] = []
-
-default[:accounts][:users][:osmbackup][:status] = :role
diff --git a/cookbooks/backup/metadata.rb b/cookbooks/backup/metadata.rb
index d5baa1664..c4f1bdabd 100644
--- a/cookbooks/backup/metadata.rb
+++ b/cookbooks/backup/metadata.rb
@@ -6,4 +6,3 @@ description       "Installs and configures backup.openstreetmap.org"
 
 version           "1.0.0"
 supports          "ubuntu"
-depends           "accounts"
diff --git a/cookbooks/backup/recipes/default.rb b/cookbooks/backup/recipes/default.rb
index 64e63fdee..395e7a1c6 100644
--- a/cookbooks/backup/recipes/default.rb
+++ b/cookbooks/backup/recipes/default.rb
@@ -17,7 +17,7 @@
 # limitations under the License.
 #
 
-include_recipe "accounts"
+include_recipe "backup::user"
 
 package %w[
   perl
diff --git a/cookbooks/backup/recipes/user.rb b/cookbooks/backup/recipes/user.rb
new file mode 100644
index 000000000..2d325f591
--- /dev/null
+++ b/cookbooks/backup/recipes/user.rb
@@ -0,0 +1,32 @@
+#
+# Cookbook:: backup
+# Recipe:: user
+#
+# Copyright:: 2026, OpenStreetMap Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+group "osmbackup" do
+  gid 501
+  append true
+end
+
+user "osmbackup" do
+  uid 501
+  gid 501
+  comment "Backups"
+  home "/store/backup"
+  shell "/usr/sbin/nologin"
+  manage_home false
+end
diff --git a/cookbooks/db/metadata.rb b/cookbooks/db/metadata.rb
index 6deed8bbe..8a093d2a3 100644
--- a/cookbooks/db/metadata.rb
+++ b/cookbooks/db/metadata.rb
@@ -6,7 +6,7 @@ description       "Installs and configures database servers"
 
 version           "1.0.0"
 supports          "ubuntu"
-depends           "accounts"
+depends           "backup"
 depends           "git"
 depends           "postgresql"
 depends           "python"
diff --git a/cookbooks/db/recipes/backup.rb b/cookbooks/db/recipes/backup.rb
index 39d6d573d..53ffe8ce8 100644
--- a/cookbooks/db/recipes/backup.rb
+++ b/cookbooks/db/recipes/backup.rb
@@ -17,6 +17,8 @@
 # limitations under the License.
 #
 
+include_recipe "backup::user"
+
 template "/usr/local/bin/backup-db" do
   source "backup-db.erb"
   owner "root"
diff --git a/cookbooks/db/recipes/base.rb b/cookbooks/db/recipes/base.rb
index aa1e29b70..684a77bdc 100644
--- a/cookbooks/db/recipes/base.rb
+++ b/cookbooks/db/recipes/base.rb
@@ -17,7 +17,6 @@
 # limitations under the License.
 #
 
-include_recipe "accounts"
 include_recipe "git"
 include_recipe "postgresql"
 include_recipe "python"
diff --git a/roles/db-backup.rb b/roles/db-backup.rb
index f713c8058..bf00010fd 100644
--- a/roles/db-backup.rb
+++ b/roles/db-backup.rb
@@ -2,11 +2,6 @@ name "db-backup"
 description "Role applied to the server responsible for database backups"
 
 default_attributes(
-  :accounts => {
-    :users => {
-      :osmbackup => { :status => :role }
-    }
-  },
   :postgresql => {
     :settings => {
       :defaults => {
diff --git a/test/data_bags/accounts/osmbackup.json b/test/data_bags/accounts/osmbackup.json
deleted file mode 100644
index 2fcfd71b4..000000000
--- a/test/data_bags/accounts/osmbackup.json
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  "id": "osmbackup",
-  "uid": 501,
-  "comment": "Backups",
-  "home": "/store/backup",
-  "manage_home": false
-}
-- 
2.47.3