Added create user scripts

setup_backup_user.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# ===============================
+# Load environment
+# ===============================
+ENV_FILE="./.env"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+    echo "ERROR: .env file not found. Copy .env.tmpl to .env and edit it."
+    exit 1
+fi
+
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+
+# ===============================
+# Validate required variables
+# ===============================
+: "${BACKUP_USER:?missing}"
+: "${PYTHON_BIN:?missing}"
+: "${BACKUP_INSTALL_DIR:?missing}"
+: "${BACKUP_RUNNER:?missing}"
+: "${WRAPPER_PATH:?missing}"
+
+RUNNER_PATH="$BACKUP_INSTALL_DIR/$BACKUP_RUNNER"
+HOME_DIR="/home/$BACKUP_USER"
+
+if [[ ! -x "$PYTHON_BIN" ]]; then
+    echo "ERROR: Python binary not executable: $PYTHON_BIN"
+    exit 1
+fi
+
+if [[ ! -f "$RUNNER_PATH" ]]; then
+    echo "ERROR: Runner not found: $RUNNER_PATH"
+    exit 1
+fi
+
+# ===============================
+# Create user (no shell)
+# ===============================
+if ! id "$BACKUP_USER" >/dev/null 2>&1; then
+    useradd -m -d "$HOME_DIR" -s /usr/sbin/nologin "$BACKUP_USER"
+fi
+
+# ===============================
+# SSH setup
+# ===============================
+install -d -m 700 "$HOME_DIR/.ssh"
+touch "$HOME_DIR/.ssh/authorized_keys"
+chmod 600 "$HOME_DIR/.ssh/authorized_keys"
+chown -R "$BACKUP_USER:$BACKUP_USER" "$HOME_DIR/.ssh"
+
+# ===============================
+# Create root-owned wrapper
+# ===============================
+cat > "$WRAPPER_PATH" <<EOF
+#!/usr/bin/env bash
+exec "$PYTHON_BIN" "$RUNNER_PATH"
+EOF
+
+chown root:root "$WRAPPER_PATH"
+chmod 750 "$WRAPPER_PATH"
+
+# ===============================
+# Lock sudo to wrapper ONLY
+# ===============================
+SUDOERS_FILE="/etc/sudoers.d/$BACKUP_USER"
+
+cat > "$SUDOERS_FILE" <<EOF
+$BACKUP_USER ALL=(root) NOPASSWD: $WRAPPER_PATH
+EOF
+
+chmod 440 "$SUDOERS_FILE"
+
+# ===============================
+# Fix runner permissions
+# ===============================
+chown root:root "$RUNNER_PATH"
+chmod 750 "$RUNNER_PATH"
+
+# ===============================
+# Output next steps
+# ===============================
+echo
+echo "User '$BACKUP_USER' created and locked down."
+echo
+echo "NEXT STEP (manual): add SSH public key:"
+echo
+echo "command=\"sudo $WRAPPER_PATH\",no-pty,no-port-forwarding,no-agent-forwarding,no-X11-forwarding <SSH_PUBLIC_KEY>"
+echo