From 65c947704bc58bb4e114082bebe36a680b58b855 Mon Sep 17 00:00:00 2001 From: librelad Date: Fri, 28 Aug 2026 12:46:43 +0100 Subject: [PATCH] ownership: create the secret drop's parent instead of requiring it MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit secret-dir was wired into the WebUI ownership reconcile last commit and still did nothing on a fresh install. It demanded frontend/data already exist, and the reconcile runs before the container has made it — so it returned 1, and the caller has no reason to check a return, so the drop was simply absent. Timing from a clean run: reconcile at install, frontend/data created a minute later. Create the parent when missing, owned by the container user, which is who owns it anyway. An existing directory is left exactly as it is — this must not take ownership of the WebUI's data directory out from under it. Verified on the clean install: with frontend/data removed entirely, secret-dir recreates both, .secrets at 2730 dockerinstall:libreportal. Co-Authored-By: Claude Opus 5 --- scripts/system/libreportal-ownership | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/scripts/system/libreportal-ownership b/scripts/system/libreportal-ownership index 6fcce7a..90534f9 100644 --- a/scripts/system/libreportal-ownership +++ b/scripts/system/libreportal-ownership @@ -136,7 +136,16 @@ _webui_bind_access() { secret_dir() { local mode cowner; mode="$(_mode)"; cowner="$(_container_owner "$mode")" local parent="$WEBUI_DIR/frontend/data" - [[ -d "$parent" ]] || { echo "libreportal-ownership: no WebUI data dir at $parent" >&2; return 1; } + # Create the parent rather than requiring it. The install reconciles WebUI + # ownership before the container has made frontend/data, so demanding it + # already exist meant this returned 1 there and the drop was simply absent + # on a fresh install — silently, since the caller has no reason to check. + # Ownership is only set when we are the ones creating it; an existing + # directory belongs to the container and is left exactly as it is. + if [[ ! -d "$parent" ]]; then + mkdir -p -- "$parent" || return 1 + chown "$cowner:$cowner" -- "$parent" || return 1 + fi local d="$parent/.secrets" mkdir -p -- "$d" || return 1 chown "$cowner:$MANAGER" -- "$d" || return 1