mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.8
9e7f28db20
Swarm config objects mount root:root; a 0440 mode is unreadable by a non-root container app user and crashloops the service (jenkins JCasC AccessDeniedException, exit 5). docker compose never hits this since there the file is a host bind-mount inheriting host perms. New lint test_config_object_world_readable flags type:config modes lacking o+r (type:secret exempt, per-line # nocheck escape). Widen the 22 offending 0440 configs across 18 roles to 0444: adds read only, cannot break a reader, and fixes latent non-root cases (e.g. synapse, pixelfed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
17 lines
440 B
YAML
17 lines
440 B
YAML
---
|
|
data:
|
|
type: volume
|
|
name: xwiki_data
|
|
mounts:
|
|
- service: xwiki
|
|
target: /usr/local/xwiki
|
|
|
|
properties:
|
|
type: config
|
|
name: "xwiki_properties_{{ 'oidc' if xwiki_oidc_enabled_switch | default(false) | bool else 'std' }}"
|
|
source: "{{ [lookup('container', 'web-app-xwiki', 'directories.config'), 'xwiki.properties'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: xwiki
|
|
target: /etc/infinito/xwiki.properties
|