mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 4.8
9e7f28db20
Swarm config objects mount root:root; a 0440 mode is unreadable by a non-root container app user and crashloops the service (jenkins JCasC AccessDeniedException, exit 5). docker compose never hits this since there the file is a host bind-mount inheriting host perms. New lint test_config_object_world_readable flags type:config modes lacking o+r (type:secret exempt, per-line # nocheck escape). Widen the 22 offending 0440 configs across 18 roles to 0444: adds read only, cannot break a reader, and fixes latent non-root cases (e.g. synapse, pixelfed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
25 lines
707 B
YAML
25 lines
707 B
YAML
---
|
|
data:
|
|
type: volume
|
|
name: pgadmin_data
|
|
mounts:
|
|
- service: pgadmin
|
|
target: /var/lib/pgadmin
|
|
|
|
servers_json:
|
|
type: config
|
|
source: "{{ [lookup('container', 'web-app-pgadmin', 'directories.volumes'), 'servers.json'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: pgadmin
|
|
target: /pgadmin4/servers.json
|
|
when: "{{ lookup('config', 'web-app-pgadmin', 'services.pgadmin.server_mode') | bool }}"
|
|
|
|
pgpass:
|
|
type: bind
|
|
source: "{{ [lookup('container', 'web-app-pgadmin', 'directories.volumes'), '.pgpass'] | path_join }}"
|
|
mounts:
|
|
- service: pgadmin
|
|
target: /pgpass
|
|
when: "{{ lookup('config', 'web-app-pgadmin', 'services.pgadmin.server_mode') | bool }}"
|