Make Synapse's base, bin and ext paths owned by root

Root runs register-user and s3-storage-provider's migrate (from a systemd timer) from bin paths under them.
Whoever owns a parent of a bin path could rename it (even a root-owned one) and put another in its place.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/custom/matrix-synapse/tasks/ext/s3-storage-provider/setup_install.yml

@@ -11,12 +11,13 @@
 #
 # Below are additional tasks for setting up various helper scripts, etc.
 
+# Owned by root: root runs the scripts in the bin path (`migrate` from a systemd timer) and reads the env file.
 - name: Ensure s3-storage-provider paths exists
   ansible.builtin.file:
     path: "{{ item }}"
     state: directory
     mode: '0750'
-    owner: "{{ matrix_synapse_uid }}"
+    owner: root
     group: "{{ matrix_synapse_gid }}"
   with_items:
     - "{{ matrix_synapse_ext_s3_storage_provider_base_path }}"
@@ -40,6 +41,8 @@
   ansible.builtin.template:
     src: "{{ role_path }}/templates/synapse/ext/s3-storage-provider/bin/{{ item }}.j2"
     dest: "{{ matrix_synapse_ext_s3_storage_provider_bin_path }}/{{ item }}"
+    owner: root
+    group: root
     mode: '0750'
   with_items:
     - shell

roles/custom/matrix-synapse/tasks/setup_install.yml

@@ -11,6 +11,21 @@
 
 ---
 
+# Owned by root: root runs the scripts in the bin path (e.g. `register-user`), and s3-storage-provider keeps its own (root-owned) bin path in the ext path.
+# Whoever owns a parent of a bin path could rename it (even a root-owned one) and put another in its place.
+- name: Ensure Synapse root-owned paths exist
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    state: directory
+    mode: '0750'
+    owner: root
+    group: "{{ matrix_synapse_gid }}"
+  with_items:
+    - {path: "{{ matrix_synapse_base_path }}", when: true}
+    - {path: "{{ matrix_synapse_ext_path }}", when: true}
+    - {path: "{{ matrix_synapse_bin_path }}", when: true}
+  when: item.when | bool
+
 - name: Ensure Synapse paths exist
   ansible.builtin.file:
     path: "{{ item.path }}"
@@ -20,13 +35,8 @@
     group: "{{ matrix_synapse_gid }}"
   with_items:
     - {path: "{{ matrix_synapse_config_dir_path }}", when: true}
-    - {path: "{{ matrix_synapse_ext_path }}", when: true}
-    - {path: "{{ matrix_synapse_bin_path }}", when: true}
     - {path: "{{ matrix_synapse_container_src_files_path }}", when: "{{ matrix_synapse_container_image_self_build }}"}
     - {path: "{{ matrix_synapse_customized_container_src_files_path }}", when: "{{ matrix_synapse_container_image_customizations_enabled }}"}
-
-    - {path: "{{ matrix_synapse_ext_s3_storage_provider_base_path }}", when: "{{ matrix_synapse_ext_synapse_s3_storage_provider_enabled }}"}
-    - {path: "{{ matrix_synapse_ext_s3_storage_provider_bin_path }}", when: "{{ matrix_synapse_ext_synapse_s3_storage_provider_enabled }}"}
     - {path: "{{ matrix_synapse_ext_s3_storage_provider_data_path }}", when: "{{ matrix_synapse_ext_synapse_s3_storage_provider_enabled }}"}
 
     # We handle matrix_synapse_media_store_path elsewhere (in ./synapse/setup_install.yml),

roles/custom/matrix-synapse/tasks/synapse/setup_install.yml

@@ -157,6 +157,8 @@
   ansible.builtin.template:
     src: "{{ item.src }}"
     dest: "{{ item.dest }}"
+    owner: root
+    group: root
     mode: "{{ item.mode }}"
   with_items:
     - src: "{{ matrix_synapse_template_synapse_log }}"