---
# Set ownership/permissions on Moodle volumes after first start. The
# entrypoint already chowns on every boot, but this is a belt-and-
# suspenders pass for re-deploys after operator-driven file edits.
#
# Code dir uses world-readable perms (0755 dirs / 0644 files) so the
# nginx sidecar (alpine, runs as uid 101) can serve static assets and
# stream PHP files to FPM. Data dir stays restrictive (0770 / 0660)
# because only Moodle FPM (running as MOODLE_RUNTIME_USER) needs to
# read/write user-uploaded content.

- name: "✅ Ensure ownership is correct on Moodle code dir"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} chown -R {{ MOODLE_RUNTIME_USER_GROUP }} {{ MOODLE_CODE_DIR }}"
  changed_when: false

- name: "✅ Ensure ownership is correct on Moodle data dir"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} chown -R {{ MOODLE_RUNTIME_USER_GROUP }} {{ MOODLE_DATA_DIR }}"
  changed_when: false

- name: "📁 Code dir: 0755 dirs (nginx-readable)"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} find {{ MOODLE_CODE_DIR }} -type d -exec chmod 0755 {} \\;"
  changed_when: false

- name: "📁 Code dir: 0644 files (nginx-readable)"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} find {{ MOODLE_CODE_DIR }} -type f -exec chmod 0644 {} \\;"
  changed_when: false

- name: "📁 Code dir: 0640 config.php (FPM-only)"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} chmod 0640 {{ MOODLE_CONFIG }}"
  changed_when: false

- name: "📁 Data dir: 0770 dirs (FPM-only)"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} find {{ MOODLE_DATA_DIR }} -type d -exec chmod 0770 {} \\;"
  changed_when: false

- name: "📁 Data dir: 0660 files (FPM-only)"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} find {{ MOODLE_DATA_DIR }} -type f -exec chmod 0660 {} \\;"
  changed_when: false