Webstar/LibrePortal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ownership: create the secret drop's parent instead of requiring it

Browse Source 
secret-dir was wired into the WebUI ownership reconcile last commit and still
did nothing on a fresh install. It demanded frontend/data already exist, and the
reconcile runs before the container has made it — so it returned 1, and the
caller has no reason to check a return, so the drop was simply absent. Timing
from a clean run: reconcile at install, frontend/data created a minute later.

Create the parent when missing, owned by the container user, which is who owns
it anyway. An existing directory is left exactly as it is — this must not take
ownership of the WebUI's data directory out from under it.

Verified on the clean install: with frontend/data removed entirely, secret-dir
recreates both, .secrets at 2730 dockerinstall:libreportal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
librelad 2026-08-28 12:46:43 +01:00
parent 9d8b92367b
commit 65c947704b
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
scripts/system/libreportal-ownership
View File

@ -136,7 +136,16 @@ _webui_bind_access() {
secret_dir() { secret_dir() {
local mode cowner; mode="$(_mode)"; cowner="$(_container_owner "$mode")" local mode cowner; mode="$(_mode)"; cowner="$(_container_owner "$mode")"
local parent="$WEBUI_DIR/frontend/data" local parent="$WEBUI_DIR/frontend/data"
[[ -d "$parent" ]] || { echo "libreportal-ownership: no WebUI data dir at $parent" >&2; return 1; } # Create the parent rather than requiring it. The install reconciles WebUI
# ownership before the container has made frontend/data, so demanding it
# already exist meant this returned 1 there and the drop was simply absent
# on a fresh install — silently, since the caller has no reason to check.
# Ownership is only set when we are the ones creating it; an existing
# directory belongs to the container and is left exactly as it is.
if [[ ! -d "$parent" ]]; then
mkdir -p -- "$parent" || return 1
chown "$cowner:$cowner" -- "$parent" || return 1
fi
local d="$parent/.secrets" local d="$parent/.secrets"
mkdir -p -- "$d" || return 1 mkdir -p -- "$d" || return 1
chown "$cowner:$MANAGER" -- "$d" || return 1 chown "$cowner:$MANAGER" -- "$d" || return 1