From c9a4d5685140aba1b002f70dc7f29cf4e2b686ec Mon Sep 17 00:00:00 2001 From: Lucas Winther Date: Wed, 30 Sep 2026 15:02:27 +0200 Subject: [PATCH] Escalate stack_dirs from the task, not the file module become was indented as a module parameter, so any entry setting owner or group failed. metrics' grafana-data is one. Co-Authored-By: Claude Opus 5.5 --- ansible/roles/compose_stack/tasks/sync.yml | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/ansible/roles/compose_stack/tasks/sync.yml b/ansible/roles/compose_stack/tasks/sync.yml index aa3fd72..72ffa57 100644 --- a/ansible/roles/compose_stack/tasks/sync.yml +++ b/ansible/roles/compose_stack/tasks/sync.yml @@ -43,11 +43,15 @@ # `owner`/`group` and no `mode`: recursing a mode over live data rewrites the # permissions of everything the container has already written there. recurse: "{{ item.recurse | default(omit) }}" - # Escalate only to set an owner or group. Creating these as root would defeat - # the point of pre-creating them at all — callers do it precisely so the bind - # mount is *not* root-owned when Docker first starts the stack. Unescalated - # they land as the deploy user, which is the user Compose runs as. - become: "{{ item.owner is defined or item.group is defined }}" + # Escalate only to set an owner or group. Creating these as root would defeat + # the point of pre-creating them at all — callers do it precisely so the bind + # mount is *not* root-owned when Docker first starts the stack. Unescalated + # they land as the deploy user, which is the user Compose runs as. + # + # A task keyword, at task indentation. One level deeper it is quietly passed to + # the file module as a parameter instead, which fails on the first entry that + # sets owner or group — and lint does not catch it. + become: "{{ item.owner is defined or item.group is defined }}" loop: "{{ stack_dirs }}" loop_control: label: "{{ item.path }}"