computer-playbook/roles/web-app-dashboard/meta/volumes.yml at fix/dev-python/python-upper-bound - computer-playbook - Infinito.Nexus Code Hub

kevinveenbirkenbach/computer-playbook

0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-06 10:59:59 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.8 9e7f28db20 test(lint): enforce swarm config objects are world-readable + widen 18 roles to 0444

Swarm config objects mount root:root; a 0440 mode is unreadable by a non-root container app user and crashloops the service (jenkins JCasC AccessDeniedException, exit 5). docker compose never hits this since there the file is a host bind-mount inheriting host perms.

New lint test_config_object_world_readable flags type:config modes lacking o+r (type:secret exempt, per-line # nocheck escape). Widen the 22 offending 0440 configs across 18 roles to 0444: adds read only, cannot break a reader, and fixes latent non-root cases (e.g. synapse, pixelfed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-03 13:57:30 +02:00

9 lines

219 B

YAML

Raw Permalink Blame History

 ---
 config:
   type: config
   source: "{{ [lookup('container', 'web-app-dashboard', 'directories.volumes'), 'config.yaml'] | path_join }}"
   mode: "0444"
   mounts:
     - service: dashboard
       target: /app/config.yaml