mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
0aa9767265
The block was gated on a denylist of exactly one filesystem, '^nfs'. A zpool defaults to acltype=off and rejects setfacl with the same 'Operation not supported', so three compose jobs of run 30695207248 died the moment the filesystem matrix drew zfs. Attempt the ACL and gate on its return code. That also covers the next backing store, and stops skipping a zpool that does carry acltype=posixacl. The findmnt task stays as the record, so a skipped block still names the filesystem that caused it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
48 lines
1.2 KiB
YAML
48 lines
1.2 KiB
YAML
---
|
|
# POSIX ACLs granting the backup user rwx (group/other none) with inheritance.
|
|
# Included only where the caller's probe proved setfacl works: NFS and a zpool
|
|
# with acltype=off both reject it with "Operation not supported", and the
|
|
# chown backup:backup + 0700 in the caller already enforce the same
|
|
# backup-only posture there.
|
|
- name: 🔐 Grant ACL rwx on backups root to backup user
|
|
ansible.posix.acl:
|
|
path: "{{ DIR_BACKUPS }}"
|
|
entity: backup
|
|
etype: user
|
|
permissions: rwx
|
|
state: present
|
|
|
|
- name: 🔧 Set default ACL (inherit) for backup user under backups root
|
|
ansible.posix.acl:
|
|
path: "{{ DIR_BACKUPS }}"
|
|
entity: backup
|
|
etype: user
|
|
permissions: rwx
|
|
default: true
|
|
state: present
|
|
|
|
- name: 🔐 Default ACL for backup user (inherit)
|
|
ansible.posix.acl:
|
|
path: "{{ DIR_BACKUPS }}"
|
|
etype: user
|
|
entity: backup
|
|
permissions: rwx
|
|
default: true
|
|
state: present
|
|
|
|
- name: 🔐 Default ACL for group -> none
|
|
ansible.posix.acl:
|
|
path: "{{ DIR_BACKUPS }}"
|
|
etype: group
|
|
permissions: "---"
|
|
default: true
|
|
state: present
|
|
|
|
- name: 🔐 Default ACL for other -> none
|
|
ansible.posix.acl:
|
|
path: "{{ DIR_BACKUPS }}"
|
|
etype: other
|
|
permissions: "---"
|
|
default: true
|
|
state: present
|