kevinveenbirkenbach/computer-playbook
1
0 Fork 0
mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sys-svc-rdbms): resolve a bind volume's device, not its unmounted _data

Browse Source 
docker mounts a bind-backed volume's device only while a container holds it, so .Mountpoint is an empty _data whenever the stack is down - which is exactly when the credential realign runs. The script then failed its 'test -f' and exited 0, reporting ok instead of changed, so a rotated password never reached the app's persisted config.

Read .Options.device when .Options.o declares a bind; compose volumes carry no .Options and keep the .Mountpoint path. Affects every role shipping tasks/utils/patch/db_credentials.yml: friendica, joomla, kix, matomo, moodle, nextcloud, suitecrm.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kevinveenbirkenbachandClaude Opus 5 committed 2026-09-08 13:15:40 +02:00
1 parent ceb7e9e628
commit da729cecec
1 file changed
+7 -2
Download Patch File Download Diff File Expand all files Collapse all files
roles/sys-svc-rdbms/files/shell/patch_persisted_password.sh
+7 -2
View File
@@ -22,8 +22,13 @@ set -euo pipefail
container volume ls -q -f "name=^${PATCH_VOLUME}$" | grep -q . || exit 0
mountpoint="$(container volume inspect --format '{{.Mountpoint}}' "$PATCH_VOLUME")"
config="${mountpoint}/${PATCH_CONFIG_REL}"
opts="$(container volume inspect --format '{{if .Options}}{{.Options.o}}{{end}}' "$PATCH_VOLUME")"
case "$opts" in
*bind*) data_dir="$(container volume inspect --format '{{.Options.device}}' "$PATCH_VOLUME")" ;;
*) data_dir="$(container volume inspect --format '{{.Mountpoint}}' "$PATCH_VOLUME")" ;;
esac
config="${data_dir}/${PATCH_CONFIG_REL}"
test -f "$config" || exit 0
expression="${PATCH_EXPRESSION//@PASSWORD@/$PATCH_PASSWORD}"