From e5b8de8c2b8e295d9e42afef36b6c807e670960c Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Fri, 31 Jul 2026 19:01:01 +0300 Subject: [PATCH] Heal git checkout ownership in all roles cloning repositories on the server 6b4b7647e fixed this for synapse-usage-exporter only. A checkout owned by a different user makes the git task fail from then on, either with a permission error or with git's dubious-ownership protection, until someone removes the directory on the host by hand. It gets into that state when the matrix user's uid changes (a server migration or a restore onto a differently numbered user), when an earlier clone ran as another user, or when someone runs git as root inside the checkout. Every other role cloning a repository onto the server was open to the same failure, so ensure the checkout's ownership recursively before updating it at the remaining 54 sites. The three matrix-synapse ext clones also gain force=yes. They were the only on-server clones without it, which left a checkout that an interrupted run had half-written wedged, instead of repaired on the next run. matrix-matrixto used to clone as root into a directory that nothing ever chowned, unlike every other role. It now becomes the matrix user too. The Element Web and SchildiChat Web theme checkouts live on the Ansible controller, where correcting ownership is not ours to do, so they merely mark the checkout as a safe directory for git. Co-Authored-By: Claude Opus 5 (1M context) --- .../tasks/install.yml | 9 +++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/install.yml | 9 +++++++++ .../custom/matrix-bot-baibot/tasks/install.yml | 9 +++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../matrix-bot-maubot/tasks/setup_install.yml | 9 +++++++++ .../matrix-bot-mjolnir/tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 9 +++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/install.yml | 9 +++++++++ .../tasks/install.yml | 9 +++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../matrix-bridge-wechat/tasks/install.yml | 18 ++++++++++++++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 9 +++++++++ .../tasks/prepare_themes.yml | 6 ++++++ .../tasks/setup_install.yml | 10 ++++++++++ .../tasks/setup_install.yml | 9 +++++++++ .../tasks/prepare_themes.yml | 6 ++++++ .../tasks/setup_install.yml | 9 +++++++++ .../matrix-corporal/tasks/setup_install.yml | 10 ++++++++++ .../matrix-dendrite/tasks/setup_install.yml | 9 +++++++++ .../matrix-element-admin/tasks/install.yml | 9 +++++++++ .../matrix-ketesa/tasks/setup_install.yml | 10 ++++++++++ .../tasks/install.yml | 9 +++++++++ roles/custom/matrix-matrixto/tasks/install.yml | 11 +++++++++++ .../matrix-media-repo/tasks/setup_install.yml | 9 +++++++++ .../matrix-pantalaimon/tasks/install.yml | 10 ++++++++++ .../custom/matrix-rageshake/tasks/install.yml | 10 ++++++++++ .../tasks/install.yml | 9 +++++++++ .../ext/mjolnir-antispam/setup_install.yml | 10 ++++++++++ .../synapse-http-antispam/setup_install.yml | 10 ++++++++++ .../synapse-simple-antispam/setup_install.yml | 10 ++++++++++ .../tasks/synapse/setup_install.yml | 9 +++++++++ .../tasks/setup_install.yml | 10 ++++++++++ 55 files changed, 535 insertions(+) diff --git a/roles/custom/matrix-alertmanager-receiver/tasks/install.yml b/roles/custom/matrix-alertmanager-receiver/tasks/install.yml index 97572b53f..ff707c8dc 100644 --- a/roles/custom/matrix-alertmanager-receiver/tasks/install.yml +++ b/roles/custom/matrix-alertmanager-receiver/tasks/install.yml @@ -53,6 +53,15 @@ - when: matrix_alertmanager_receiver_container_image_self_build | bool block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure matrix-alertmanager-receiver repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_alertmanager_receiver_container_src_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure matrix-alertmanager-receiver repository is present on self-build ansible.builtin.git: repo: "{{ matrix_alertmanager_receiver_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-appservice-draupnir-for-all/tasks/setup_install.yml b/roles/custom/matrix-appservice-draupnir-for-all/tasks/setup_install.yml index b1b1d1dbf..68f12b161 100644 --- a/roles/custom/matrix-appservice-draupnir-for-all/tasks/setup_install.yml +++ b/roles/custom/matrix-appservice-draupnir-for-all/tasks/setup_install.yml @@ -35,6 +35,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_appservice_draupnir_for_all_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Draupnir repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_appservice_draupnir_for_all_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_appservice_draupnir_for_all_container_image_self_build | bool" + - name: Ensure Draupnir repository is present on self-build ansible.builtin.git: repo: "{{ matrix_appservice_draupnir_for_all_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-authentication-service/tasks/install.yml b/roles/custom/matrix-authentication-service/tasks/install.yml index f13415f6a..d1927a45f 100644 --- a/roles/custom/matrix-authentication-service/tasks/install.yml +++ b/roles/custom/matrix-authentication-service/tasks/install.yml @@ -95,6 +95,15 @@ - when: "matrix_authentication_service_container_image_self_build | bool" block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure Matrix Authentication Service repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_authentication_service_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure Matrix Authentication Service repository is present on self-build ansible.builtin.git: repo: "{{ matrix_authentication_service_container_repo }}" diff --git a/roles/custom/matrix-bot-baibot/tasks/install.yml b/roles/custom/matrix-bot-baibot/tasks/install.yml index e31057943..db77eac90 100644 --- a/roles/custom/matrix-bot-baibot/tasks/install.yml +++ b/roles/custom/matrix-bot-baibot/tasks/install.yml @@ -49,6 +49,15 @@ - when: "matrix_bot_baibot_container_image_self_build | bool" block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure baibot repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bot_baibot_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure baibot repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bot_baibot_container_repo }}" diff --git a/roles/custom/matrix-bot-buscarron/tasks/setup_install.yml b/roles/custom/matrix-bot-buscarron/tasks/setup_install.yml index e71713bfe..d37f77823 100644 --- a/roles/custom/matrix-bot-buscarron/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-buscarron/tasks/setup_install.yml @@ -70,6 +70,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bot_buscarron_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Buscarron repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bot_buscarron_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bot_buscarron_container_image_self_build | bool" + - name: Ensure Buscarron repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bot_buscarron_container_repo }}" diff --git a/roles/custom/matrix-bot-draupnir/tasks/setup_install.yml b/roles/custom/matrix-bot-draupnir/tasks/setup_install.yml index efe7bba24..6629c9868 100644 --- a/roles/custom/matrix-bot-draupnir/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-draupnir/tasks/setup_install.yml @@ -47,6 +47,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bot_draupnir_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Draupnir repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bot_draupnir_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bot_draupnir_container_image_self_build | bool" + - name: Ensure Draupnir repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bot_draupnir_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml b/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml index bd861d9b3..846bcbf19 100644 --- a/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-honoroit/tasks/setup_install.yml @@ -72,6 +72,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bot_honoroit_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Honoroit repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bot_honoroit_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bot_honoroit_container_image_self_build | bool" + - name: Ensure Honoroit repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bot_honoroit_container_repo }}" diff --git a/roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml b/roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml index 1c2c0af65..448d4bb8e 100644 --- a/roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-matrix-reminder-bot/tasks/setup_install.yml @@ -62,6 +62,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bot_matrix_reminder_bot_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure matrix-reminder-bot repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bot_matrix_reminder_bot_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bot_matrix_reminder_bot_container_image_self_build | bool" + - name: Ensure matrix-reminder-bot repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bot_matrix_reminder_bot_container_repo }}" diff --git a/roles/custom/matrix-bot-maubot/tasks/setup_install.yml b/roles/custom/matrix-bot-maubot/tasks/setup_install.yml index 3ae13bc59..3486bcc56 100644 --- a/roles/custom/matrix-bot-maubot/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-maubot/tasks/setup_install.yml @@ -48,6 +48,15 @@ - when: matrix_bot_maubot_container_image_self_build | bool block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure maubot repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bot_maubot_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure maubot repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bot_maubot_container_repo }}" diff --git a/roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml b/roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml index 92e8bd4d7..bae12a370 100644 --- a/roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml +++ b/roles/custom/matrix-bot-mjolnir/tasks/setup_install.yml @@ -37,6 +37,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bot_mjolnir_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure mjolnir repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bot_mjolnir_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bot_mjolnir_container_image_self_build | bool" + - name: Ensure mjolnir repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bot_mjolnir_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml b/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml index 31ed0a300..f267ff5b5 100644 --- a/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-appservice-irc/tasks/setup_install.yml @@ -89,6 +89,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_appservice_irc_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure matrix-appservice-irc repository ownership is correct when self-building + ansible.builtin.file: + path: "{{ matrix_bridge_appservice_irc_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_appservice_irc_enabled | bool and matrix_bridge_appservice_irc_container_image_self_build | bool" + - name: Ensure matrix-appservice-irc repository is present when self-building ansible.builtin.git: repo: "{{ matrix_bridge_appservice_irc_container_repo }}" diff --git a/roles/custom/matrix-bridge-beeper-line/tasks/setup_install.yml b/roles/custom/matrix-bridge-beeper-line/tasks/setup_install.yml index 8ac4823cb..58a66299d 100644 --- a/roles/custom/matrix-bridge-beeper-line/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-beeper-line/tasks/setup_install.yml @@ -57,6 +57,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_beeper_line_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Beeper LINE repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_beeper_line_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_beeper_line_container_image_self_build | bool" + - name: Ensure Beeper LINE repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_beeper_line_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-beeper-linkedin/tasks/setup_install.yml b/roles/custom/matrix-bridge-beeper-linkedin/tasks/setup_install.yml index 9e668a676..163d83559 100644 --- a/roles/custom/matrix-bridge-beeper-linkedin/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-beeper-linkedin/tasks/setup_install.yml @@ -55,6 +55,15 @@ - when: "matrix_bridge_beeper_linkedin_container_image_self_build | bool" block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure Beeper LinkedIn repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_beeper_linkedin_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure Beeper LinkedIn repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_beeper_linkedin_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml b/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml index 57bc365de..698042b81 100644 --- a/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-hookshot/tasks/setup_install.yml @@ -38,6 +38,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_hookshot_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure hookshot repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_hookshot_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_hookshot_container_image_self_build | bool" + - name: Ensure hookshot repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_hookshot_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-bluesky/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-bluesky/tasks/setup_install.yml index 263dd2219..98e6f499e 100644 --- a/roles/custom/matrix-bridge-mautrix-bluesky/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-bluesky/tasks/setup_install.yml @@ -31,6 +31,16 @@ - {path: "{{ matrix_bridge_mautrix_bluesky_container_src_files_path }}", when: "{{ matrix_bridge_mautrix_bluesky_container_image_self_build }}"} when: item.when | bool +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix Bluesky repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_bluesky_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_bluesky_enabled | bool and matrix_bridge_mautrix_bluesky_container_image_self_build" + - name: Ensure Mautrix Bluesky repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_bluesky_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-discord/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-discord/tasks/setup_install.yml index 0077aece8..92aecc6a0 100644 --- a/roles/custom/matrix-bridge-mautrix-discord/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-discord/tasks/setup_install.yml @@ -59,6 +59,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_mautrix_discord_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix discord repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_discord_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_discord_container_image_self_build | bool" + - name: Ensure Mautrix discord repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_discord_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-gmessages/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-gmessages/tasks/setup_install.yml index 0a14e4687..5465a1a4f 100644 --- a/roles/custom/matrix-bridge-mautrix-gmessages/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-gmessages/tasks/setup_install.yml @@ -59,6 +59,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_mautrix_gmessages_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix gmessages repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_gmessages_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_gmessages_container_image_self_build | bool" + - name: Ensure Mautrix gmessages repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_gmessages_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml index 6e2bfefb1..a9249a38c 100644 --- a/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-googlechat/tasks/setup_install.yml @@ -61,6 +61,16 @@ - {path: "{{ matrix_bridge_mautrix_googlechat_container_src_files_path }}", when: "{{ matrix_bridge_mautrix_googlechat_container_image_self_build }}"} when: "item.when | bool" +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix Hangots repository ownership is correct on self build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_googlechat_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_googlechat_container_image_self_build | bool" + - name: Ensure Mautrix Hangots repository is present on self build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_googlechat_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-gvoice/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-gvoice/tasks/setup_install.yml index 163d170b2..f16785a55 100644 --- a/roles/custom/matrix-bridge-mautrix-gvoice/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-gvoice/tasks/setup_install.yml @@ -57,6 +57,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_mautrix_gvoice_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix gvoice repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_gvoice_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_gvoice_container_image_self_build | bool" + - name: Ensure Mautrix gvoice repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_gvoice_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-linkedin/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-linkedin/tasks/setup_install.yml index e6485f386..32957b60c 100644 --- a/roles/custom/matrix-bridge-mautrix-linkedin/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-linkedin/tasks/setup_install.yml @@ -57,6 +57,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_mautrix_linkedin_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix linkedin repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_linkedin_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_linkedin_container_image_self_build | bool" + - name: Ensure Mautrix linkedin repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_linkedin_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml index 9196d8dda..b0771c277 100644 --- a/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml +++ b/roles/custom/matrix-bridge-mautrix-meta-instagram/tasks/install.yml @@ -58,6 +58,15 @@ - when: matrix_bridge_mautrix_meta_instagram_container_image_self_build | bool block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure mautrix-meta-instagram repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_meta_instagram_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure mautrix-meta-instagram repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_meta_instagram_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml index 633a91f92..7186702a4 100644 --- a/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml +++ b/roles/custom/matrix-bridge-mautrix-meta-messenger/tasks/install.yml @@ -58,6 +58,15 @@ - when: matrix_bridge_mautrix_meta_messenger_container_image_self_build | bool block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure mautrix-meta-messenger repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_meta_messenger_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure mautrix-meta-messenger repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_meta_messenger_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-signal/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-signal/tasks/setup_install.yml index fd46b3b82..3d6bbbb30 100644 --- a/roles/custom/matrix-bridge-mautrix-signal/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-signal/tasks/setup_install.yml @@ -64,6 +64,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_mautrix_signal_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix signal repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_signal_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_signal_container_image_self_build | bool" + - name: Ensure Mautrix signal repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_signal_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml index dbb722089..0506c7343 100644 --- a/roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-slack/tasks/setup_install.yml @@ -58,6 +58,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_mautrix_slack_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix slack repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_slack_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_slack_container_image_self_build | bool" + - name: Ensure Mautrix slack repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_slack_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml index 135dec0dc..c6de5c077 100644 --- a/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-telegram/tasks/setup_install.yml @@ -103,6 +103,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_mautrix_telegram_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix Telegram repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_telegram_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_telegram_container_image_self_build | bool" + - name: Ensure Mautrix Telegram repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_telegram_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-twitter/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-twitter/tasks/setup_install.yml index 4523ddb75..801039d89 100644 --- a/roles/custom/matrix-bridge-mautrix-twitter/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-twitter/tasks/setup_install.yml @@ -37,6 +37,16 @@ - {path: "{{ matrix_bridge_mautrix_twitter_container_src_files_path }}", when: "{{ matrix_bridge_mautrix_twitter_container_image_self_build }}"} when: item.when | bool +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix Twitter repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_twitter_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_twitter_enabled | bool and matrix_bridge_mautrix_twitter_container_image_self_build" + - name: Ensure Mautrix Twitter repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_twitter_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml index e0d5370e5..9f1eaaa6e 100644 --- a/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mautrix-whatsapp/tasks/setup_install.yml @@ -69,6 +69,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_mautrix_whatsapp_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Mautrix Whatsapp repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_mautrix_whatsapp_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mautrix_whatsapp_container_image_self_build | bool" + - name: Ensure Mautrix Whatsapp repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_mautrix_whatsapp_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml b/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml index 6c06a8dae..43aa99d27 100644 --- a/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mx-puppet-groupme/tasks/setup_install.yml @@ -82,6 +82,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_mx_puppet_groupme_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure MX Puppet Groupme repository ownership is correct on self build + ansible.builtin.file: + path: "{{ matrix_bridge_mx_puppet_groupme_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mx_puppet_groupme_enabled | bool and matrix_bridge_mx_puppet_groupme_container_image_self_build" + - name: Ensure MX Puppet Groupme repository is present on self build ansible.builtin.git: repo: "{{ matrix_bridge_mx_puppet_groupme_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml b/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml index 331a9f019..cf89a245a 100644 --- a/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-mx-puppet-steam/tasks/setup_install.yml @@ -84,6 +84,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_mx_puppet_steam_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure MX Puppet Steam repository ownership is correct on self build + ansible.builtin.file: + path: "{{ matrix_bridge_mx_puppet_steam_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_mx_puppet_steam_enabled | bool and matrix_bridge_mx_puppet_steam_container_image_self_build" + - name: Ensure MX Puppet Steam repository is present on self build ansible.builtin.git: repo: "{{ matrix_bridge_mx_puppet_steam_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-postmoogle/tasks/setup_install.yml b/roles/custom/matrix-bridge-postmoogle/tasks/setup_install.yml index ac4d3a862..8b2c703da 100644 --- a/roles/custom/matrix-bridge-postmoogle/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-postmoogle/tasks/setup_install.yml @@ -88,6 +88,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_bridge_postmoogle_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure postmoogle repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_postmoogle_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_postmoogle_container_image_self_build | bool" + - name: Ensure postmoogle repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_postmoogle_container_repo }}" diff --git a/roles/custom/matrix-bridge-rustpush/tasks/setup_install.yml b/roles/custom/matrix-bridge-rustpush/tasks/setup_install.yml index 97df25f14..21e3302b4 100644 --- a/roles/custom/matrix-bridge-rustpush/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-rustpush/tasks/setup_install.yml @@ -19,6 +19,16 @@ - {path: "{{ matrix_bridge_rustpush_container_src_files_path }}", when: "{{ matrix_bridge_rustpush_container_image_self_build }}"} when: item.when | bool +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure RustPush repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_rustpush_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_rustpush_enabled | bool and matrix_bridge_rustpush_container_image_self_build" + - name: Ensure RustPush repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_rustpush_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-steam/tasks/setup_install.yml b/roles/custom/matrix-bridge-steam/tasks/setup_install.yml index 725489512..33c8de1fa 100644 --- a/roles/custom/matrix-bridge-steam/tasks/setup_install.yml +++ b/roles/custom/matrix-bridge-steam/tasks/setup_install.yml @@ -31,6 +31,16 @@ - {path: "{{ matrix_bridge_steam_container_src_files_path }}", when: "{{ matrix_bridge_steam_container_image_self_build }}"} when: item.when | bool +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Steam bridge repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_steam_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_bridge_steam_enabled | bool and matrix_bridge_steam_container_image_self_build" + - name: Ensure Steam bridge repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_steam_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-bridge-wechat/tasks/install.yml b/roles/custom/matrix-bridge-wechat/tasks/install.yml index 48840f1de..890dd8d87 100644 --- a/roles/custom/matrix-bridge-wechat/tasks/install.yml +++ b/roles/custom/matrix-bridge-wechat/tasks/install.yml @@ -32,6 +32,15 @@ - when: matrix_bridge_wechat_container_image_self_build | bool block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure WeChat Bridge repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_wechat_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure WeChat Bridge repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_wechat_container_image_self_build_repo }}" @@ -63,6 +72,15 @@ - when: matrix_bridge_wechat_agent_container_image_self_build | bool block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure WeChat Agent repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_bridge_wechat_agent_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure WeChat Agent repository is present on self-build ansible.builtin.git: repo: "{{ matrix_bridge_wechat_agent_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-cactus-comments/tasks/setup_install.yml b/roles/custom/matrix-cactus-comments/tasks/setup_install.yml index e5b47207f..2e3e3546a 100644 --- a/roles/custom/matrix-cactus-comments/tasks/setup_install.yml +++ b/roles/custom/matrix-cactus-comments/tasks/setup_install.yml @@ -47,6 +47,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_cactus_comments_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure matrix-cactus-comments repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_cactus_comments_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_cactus_comments_container_image_self_build | bool" + - name: Ensure matrix-cactus-comments repository is present on self-build ansible.builtin.git: repo: "{{ matrix_cactus_comments_container_repo }}" diff --git a/roles/custom/matrix-client-commet/tasks/setup_install.yml b/roles/custom/matrix-client-commet/tasks/setup_install.yml index 0eec9001a..15515b4a4 100644 --- a/roles/custom/matrix-client-commet/tasks/setup_install.yml +++ b/roles/custom/matrix-client-commet/tasks/setup_install.yml @@ -40,6 +40,15 @@ when: not matrix_client_commet_git_config_file_stat.stat.exists become: true + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure Commet repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_client_commet_container_src_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure Commet repository is present on self-build ansible.builtin.git: repo: "{{ matrix_client_commet_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-client-element/tasks/prepare_themes.yml b/roles/custom/matrix-client-element/tasks/prepare_themes.yml index 56ddb3403..133c8a803 100644 --- a/roles/custom/matrix-client-element/tasks/prepare_themes.yml +++ b/roles/custom/matrix-client-element/tasks/prepare_themes.yml @@ -15,11 +15,17 @@ delegate_to: 127.0.0.1 become: false block: + # This checkout lives on the Ansible controller, so we cannot correct its ownership like we do for checkouts on the server. + # Marking it as a safe directory keeps git's dubious-ownership protection from failing the task when the playbook directory belongs to another user. - name: Ensure Element Web themes repository is pulled ansible.builtin.git: repo: "{{ matrix_client_element_themes_repository_url }}" version: "{{ matrix_client_element_themes_repository_version }}" dest: "{{ role_path }}/files/scratchpad/themes" + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ role_path }}/files/scratchpad/themes" - name: Find all Element Web theme files ansible.builtin.find: diff --git a/roles/custom/matrix-client-element/tasks/setup_install.yml b/roles/custom/matrix-client-element/tasks/setup_install.yml index bd6728e21..116d50f89 100644 --- a/roles/custom/matrix-client-element/tasks/setup_install.yml +++ b/roles/custom/matrix-client-element/tasks/setup_install.yml @@ -33,6 +33,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_client_element_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Element Web repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_client_element_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_client_element_container_image_self_build | bool" + - name: Ensure Element Web repository is present on self-build ansible.builtin.git: repo: "{{ matrix_client_element_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-client-fluffychat/tasks/setup_install.yml b/roles/custom/matrix-client-fluffychat/tasks/setup_install.yml index 44791239f..851d94a03 100644 --- a/roles/custom/matrix-client-fluffychat/tasks/setup_install.yml +++ b/roles/custom/matrix-client-fluffychat/tasks/setup_install.yml @@ -29,6 +29,15 @@ - when: "matrix_client_fluffychat_container_image_self_build | bool" block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure FluffyChat Web repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_client_fluffychat_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure FluffyChat Web repository is present on self-build ansible.builtin.git: repo: "{{ matrix_client_fluffychat_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-client-schildichat/tasks/prepare_themes.yml b/roles/custom/matrix-client-schildichat/tasks/prepare_themes.yml index 4c2167bcd..0402e4bba 100644 --- a/roles/custom/matrix-client-schildichat/tasks/prepare_themes.yml +++ b/roles/custom/matrix-client-schildichat/tasks/prepare_themes.yml @@ -14,11 +14,17 @@ delegate_to: 127.0.0.1 become: false block: + # This checkout lives on the Ansible controller, so we cannot correct its ownership like we do for checkouts on the server. + # Marking it as a safe directory keeps git's dubious-ownership protection from failing the task when the playbook directory belongs to another user. - name: Ensure SchildiChat Web themes repository is pulled ansible.builtin.git: repo: "{{ matrix_client_schildichat_themes_repository_url }}" version: "{{ matrix_client_schildichat_themes_repository_version }}" dest: "{{ role_path }}/files/scratchpad/themes" + environment: + GIT_CONFIG_COUNT: "1" + GIT_CONFIG_KEY_0: safe.directory + GIT_CONFIG_VALUE_0: "{{ role_path }}/files/scratchpad/themes" - name: Find all SchildiChat Web theme files ansible.builtin.find: diff --git a/roles/custom/matrix-client-schildichat/tasks/setup_install.yml b/roles/custom/matrix-client-schildichat/tasks/setup_install.yml index d6de88274..e421fdb0c 100644 --- a/roles/custom/matrix-client-schildichat/tasks/setup_install.yml +++ b/roles/custom/matrix-client-schildichat/tasks/setup_install.yml @@ -32,6 +32,15 @@ - when: "matrix_client_schildichat_container_image_self_build | bool" block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure SchildiChat Web repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_client_schildichat_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure SchildiChat Web repository is present on self-build ansible.builtin.git: repo: "{{ matrix_client_schildichat_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-corporal/tasks/setup_install.yml b/roles/custom/matrix-corporal/tasks/setup_install.yml index 271089e85..ede0b2b7a 100644 --- a/roles/custom/matrix-corporal/tasks/setup_install.yml +++ b/roles/custom/matrix-corporal/tasks/setup_install.yml @@ -24,6 +24,16 @@ - "{{ matrix_corporal_cache_dir_path }}" - "{{ matrix_corporal_var_dir_path }}" +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Matrix Corporal repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_corporal_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: matrix_corporal_container_image_self_build | bool + - name: Ensure Matrix Corporal repository is present on self-build ansible.builtin.git: repo: "{{ matrix_corporal_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-dendrite/tasks/setup_install.yml b/roles/custom/matrix-dendrite/tasks/setup_install.yml index 667a6f5b4..ef5735254 100644 --- a/roles/custom/matrix-dendrite/tasks/setup_install.yml +++ b/roles/custom/matrix-dendrite/tasks/setup_install.yml @@ -91,6 +91,15 @@ - when: "matrix_dendrite_container_image_self_build | bool" block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure Dendrite repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_dendrite_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure Dendrite repository is present on self-build ansible.builtin.git: repo: "{{ matrix_dendrite_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-element-admin/tasks/install.yml b/roles/custom/matrix-element-admin/tasks/install.yml index 5539807f7..c54ac9c8d 100644 --- a/roles/custom/matrix-element-admin/tasks/install.yml +++ b/roles/custom/matrix-element-admin/tasks/install.yml @@ -43,6 +43,15 @@ - when: matrix_element_admin_container_image_self_build | bool block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure Element Admin repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_element_admin_container_src_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure Element Admin repository is present on self-build ansible.builtin.git: repo: "{{ matrix_element_admin_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-ketesa/tasks/setup_install.yml b/roles/custom/matrix-ketesa/tasks/setup_install.yml index e112e0cc2..d0bec5633 100644 --- a/roles/custom/matrix-ketesa/tasks/setup_install.yml +++ b/roles/custom/matrix-ketesa/tasks/setup_install.yml @@ -80,6 +80,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_ketesa_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure matrix-ketesa repository ownership is correct when self-building + ansible.builtin.file: + path: "{{ matrix_ketesa_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: matrix_ketesa_container_image_self_build | bool + - name: Ensure matrix-ketesa repository is present when self-building ansible.builtin.git: repo: "{{ matrix_ketesa_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-livekit-jwt-service/tasks/install.yml b/roles/custom/matrix-livekit-jwt-service/tasks/install.yml index 18e09891d..bf369b5df 100644 --- a/roles/custom/matrix-livekit-jwt-service/tasks/install.yml +++ b/roles/custom/matrix-livekit-jwt-service/tasks/install.yml @@ -40,6 +40,15 @@ - when: "matrix_livekit_jwt_service_container_image_self_build | bool" block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure LiveKit JWT Service repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_livekit_jwt_service_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure LiveKit JWT Service repository is present on self-build ansible.builtin.git: repo: "{{ matrix_livekit_jwt_service_container_repo }}" diff --git a/roles/custom/matrix-matrixto/tasks/install.yml b/roles/custom/matrix-matrixto/tasks/install.yml index 6abed3110..3da68b309 100644 --- a/roles/custom/matrix-matrixto/tasks/install.yml +++ b/roles/custom/matrix-matrixto/tasks/install.yml @@ -26,12 +26,23 @@ - labels register: matrix_matrixto_support_files_result +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Matrix.to repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_matrixto_container_image_self_build_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure Matrix.to repository is present on self-build ansible.builtin.git: repo: "{{ matrix_matrixto_container_image_self_build_repo }}" version: "{{ matrix_matrixto_container_image_self_build_repo_version }}" dest: "{{ matrix_matrixto_container_image_self_build_src_files_path }}" force: "yes" + become: true + become_user: "{{ matrix_user_name }}" register: matrix_matrixto_git_pull_results - name: Ensure Matrix.to container image is built diff --git a/roles/custom/matrix-media-repo/tasks/setup_install.yml b/roles/custom/matrix-media-repo/tasks/setup_install.yml index 094bdf31e..43155e687 100755 --- a/roles/custom/matrix-media-repo/tasks/setup_install.yml +++ b/roles/custom/matrix-media-repo/tasks/setup_install.yml @@ -58,6 +58,15 @@ - when: "matrix_media_repo_container_image_self_build | bool" block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure media-repo repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_media_repo_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure media-repo repository is present on self-build ansible.builtin.git: repo: "{{ matrix_media_repo_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-pantalaimon/tasks/install.yml b/roles/custom/matrix-pantalaimon/tasks/install.yml index 8f19974be..618a22d5e 100644 --- a/roles/custom/matrix-pantalaimon/tasks/install.yml +++ b/roles/custom/matrix-pantalaimon/tasks/install.yml @@ -37,6 +37,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_pantalaimon_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure pantalaimon repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_pantalaimon_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_pantalaimon_container_image_self_build | bool" + - name: Ensure pantalaimon repository is present on self-build ansible.builtin.git: repo: "{{ matrix_pantalaimon_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-rageshake/tasks/install.yml b/roles/custom/matrix-rageshake/tasks/install.yml index e2636066a..31e5fdcba 100644 --- a/roles/custom/matrix-rageshake/tasks/install.yml +++ b/roles/custom/matrix-rageshake/tasks/install.yml @@ -51,6 +51,16 @@ delay: "{{ devture_playbook_help_container_retries_delay }}" until: matrix_rageshake_container_image_pull_result is not failed +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure rageshake repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_rageshake_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_rageshake_container_image_self_build | bool" + - name: Ensure rageshake repository is present on self-build ansible.builtin.git: repo: "{{ matrix_rageshake_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-synapse-auto-compressor/tasks/install.yml b/roles/custom/matrix-synapse-auto-compressor/tasks/install.yml index 5fea7dc00..e64a32aaa 100644 --- a/roles/custom/matrix-synapse-auto-compressor/tasks/install.yml +++ b/roles/custom/matrix-synapse-auto-compressor/tasks/install.yml @@ -51,6 +51,15 @@ - when: "matrix_synapse_auto_compressor_container_image_self_build | bool" block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure synapse-auto-compressor repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_synapse_auto_compressor_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + - name: Ensure synapse-auto-compressor repository is present on self-build ansible.builtin.git: repo: "{{ matrix_synapse_auto_compressor_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml index d6c8429d5..0b3f191e4 100644 --- a/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml @@ -12,11 +12,21 @@ name: git state: present +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure mjolnir-antispam repository ownership is correct + ansible.builtin.file: + path: "{{ matrix_synapse_ext_path }}/mjolnir" + state: directory + owner: "{{ matrix_synapse_uid }}" + group: "{{ matrix_synapse_gid }}" + recurse: true + - name: Clone mjolnir-antispam git repository ansible.builtin.git: repo: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_git_repository_url }}" version: "{{ matrix_synapse_ext_spam_checker_mjolnir_antispam_git_version }}" dest: "{{ matrix_synapse_ext_path }}/mjolnir" + force: "yes" become: true become_user: "{{ matrix_synapse_username }}" diff --git a/roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml index f7ce74096..56e7a1c5d 100644 --- a/roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml @@ -10,11 +10,21 @@ name: git state: present +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure synapse-http-antispam repository ownership is correct + ansible.builtin.file: + path: "{{ matrix_synapse_ext_path }}/synapse-http-antispam" + state: directory + owner: "{{ matrix_synapse_uid }}" + group: "{{ matrix_synapse_gid }}" + recurse: true + - name: Clone synapse-http-antispam git repository ansible.builtin.git: repo: "{{ matrix_synapse_ext_synapse_http_antispam_git_repository_url }}" version: "{{ matrix_synapse_ext_synapse_http_antispam_git_version }}" dest: "{{ matrix_synapse_ext_path }}/synapse-http-antispam" + force: "yes" become: true become_user: "{{ matrix_synapse_username }}" diff --git a/roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml b/roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml index 2a5a24b2b..13b587a9b 100644 --- a/roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml @@ -19,11 +19,21 @@ name: git state: present +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure synapse-simple-antispam repository ownership is correct + ansible.builtin.file: + path: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam" + state: directory + owner: "{{ matrix_synapse_uid }}" + group: "{{ matrix_synapse_gid }}" + recurse: true + - name: Clone synapse-simple-antispam git repository ansible.builtin.git: repo: "{{ matrix_synapse_ext_spam_checker_synapse_simple_antispam_git_repository_url }}" version: "{{ matrix_synapse_ext_spam_checker_synapse_simple_antispam_git_version }}" dest: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam" + force: "yes" become: true become_user: "{{ matrix_synapse_username }}" diff --git a/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml b/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml index c0cdae581..a5daf50a9 100644 --- a/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml +++ b/roles/custom/matrix-synapse/tasks/synapse/setup_install.yml @@ -35,6 +35,15 @@ - when: "matrix_synapse_container_image_self_build | bool" block: + # A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. + - name: Ensure Synapse repository ownership is correct on self-build + ansible.builtin.file: + path: "{{ matrix_synapse_container_src_files_path }}" + state: directory + owner: "{{ matrix_synapse_uid }}" + group: "{{ matrix_synapse_gid }}" + recurse: true + - name: Ensure Synapse repository is present on self-build ansible.builtin.git: repo: "{{ matrix_synapse_container_image_self_build_repo }}" diff --git a/roles/custom/matrix-user-verification-service/tasks/setup_install.yml b/roles/custom/matrix-user-verification-service/tasks/setup_install.yml index ca810c3cd..533380c7c 100644 --- a/roles/custom/matrix-user-verification-service/tasks/setup_install.yml +++ b/roles/custom/matrix-user-verification-service/tasks/setup_install.yml @@ -28,6 +28,16 @@ until: matrix_user_verification_service_container_image_pull_result is not failed when: "not matrix_user_verification_service_container_image_self_build | bool" +# A checkout owned by a different user (a uid change, an earlier clone by another user, etc.) would make the git task below fail on ownership or permissions. +- name: Ensure Matrix User Verification Service repository ownership is correct when self-building + ansible.builtin.file: + path: "{{ matrix_user_verification_service_container_src_files_path }}" + state: directory + owner: "{{ matrix_user_name }}" + group: "{{ matrix_group_name }}" + recurse: true + when: "matrix_user_verification_service_container_image_self_build | bool" + - name: Ensure Matrix User Verification Service repository is present when self-building ansible.builtin.git: repo: "{{ matrix_user_verification_service_container_image_self_build_repo }}"