In order to do backups via rsync/ssh into Gohma, the source server needs to have a ssh key for the root user, and Gohma needs to have a user account for that source server containing that key in authorized_keys.
Currently that's done by running a one-time script in gohma's ~/bin. It should be handled in the Ansible playbook to configure backups.
Additionally Gohma's host key should be added to the source server's known_hosts, to avoid getting an interactive prompt the first time the backup runs.
This is done in 227e990cd. The only missing piece is adding gohma's host key to known_hosts. There is a task ensuring it's already present, to avoid backups silently failing, but adding it automatically to the known hosts turned out to be harder than I expected, so we'll have to continue doing this manually for new servers.