mirror of
https://github.com/spantaleev/matrix-docker-ansible-deploy.git
synced 2026-11-02 19:54:15 +00:00
Slavi PantaleevandClaude Opus 5.5
5a3137ca8d
Whoever owns it could rename any service's directory (even a root-owned one) and put another in its place. On Synology, the recursive chown now compares only the base path's gid (its uid is root's now) and runs before the base paths are ensured, so it doesn't undo their ownership. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
52 lines
2.2 KiB
YAML
52 lines
2.2 KiB
YAML
# SPDX-FileCopyrightText: 2017 - 2025 Slavi Pantaleev
|
|
# SPDX-FileCopyrightText: 2018 - 2022 MDAD project contributors
|
|
# SPDX-FileCopyrightText: 2019 Stuart Mumford
|
|
# SPDX-FileCopyrightText: 2020 Béla Becker
|
|
# SPDX-FileCopyrightText: 2020 Chris van Dijk
|
|
# SPDX-FileCopyrightText: 2020 Horvath Gergely
|
|
# SPDX-FileCopyrightText: 2022 Sebastian Gumprich
|
|
# SPDX-FileCopyrightText: 2024 - 2025 Suguru Hirahara
|
|
# SPDX-FileCopyrightText: 2024 László Várady
|
|
# SPDX-FileCopyrightText: 2026 Chiu Ki Sit
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
---
|
|
|
|
# On Synology, name-based chown works for directly-touched paths but leaves
|
|
# existing sub-paths with stale numeric ownership when uid/gid changes between
|
|
# runs. We recurse only when the base path's gid doesn't match, so normal runs
|
|
# skip the expensive tree walk entirely. Its uid is not compared, as the base path is owned by root, not the matrix user.
|
|
# The recursive chown runs before the base paths are ensured below, so they get their own ownership back.
|
|
# chown -R is used instead of the file module's recurse option to avoid Ansible iterating every entry in Python.
|
|
- name: Check current ownership of Matrix base path (Synology)
|
|
ansible.builtin.stat:
|
|
path: "{{ matrix_base_data_path }}"
|
|
register: matrix_base_data_path_stat
|
|
when: matrix_base_host_is_synology
|
|
|
|
- name: Ensure Matrix base path ownership is correct using numeric UID/GID (Synology)
|
|
ansible.builtin.command: chown -R {{ matrix_user_uid }}:{{ matrix_user_gid }} {{ matrix_base_data_path }}
|
|
changed_when: true
|
|
when: >-
|
|
matrix_base_host_is_synology and
|
|
matrix_base_data_path_stat.stat.exists and
|
|
matrix_base_data_path_stat.stat.gid | int != matrix_user_gid | int
|
|
|
|
- name: Ensure Matrix base paths exists
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
state: directory
|
|
mode: "{{ matrix_base_data_path_mode }}"
|
|
owner: "{{ matrix_base_data_path_owner }}"
|
|
group: "{{ matrix_base_data_path_group }}"
|
|
with_items:
|
|
- "{{ matrix_base_data_path }}"
|
|
- "{{ matrix_bin_path }}"
|
|
|
|
- name: Ensure remove-all script created
|
|
ansible.builtin.template:
|
|
src: "{{ role_path }}/templates/bin/remove-all.j2"
|
|
dest: "{{ matrix_bin_path }}/remove-all"
|
|
mode: '0750'
|