fscotto/infra
1
0
Fork 0
mirror of https://github.com/fscotto/infra.git synced 2026-10-03 13:29:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix Atlas Borg runtime permissions

Browse Source
This commit is contained in:
Fabio Scotto di Santolo
2026-09-30 08:56:01 +02:00
parent fa1c8c0b82
commit 797087c66f
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ansible/roles/profile_atlas/templates/atlas-borg-backup.sh.j2
View File

@@ -87,7 +87,10 @@ exec 9>/run/lock/atlas-zfs-snapshot.lock
zpool list -H -o name "$pool" >/dev/null zpool list -H -o name "$pool" >/dev/null
rm -rf "$stage" rm -rf "$stage"
mkdir -p "$stage" mkdir -p "$stage"
chown root:"$borg_group" /run/atlas-borg "$stage" # Keep systemd's root:root ownership of RuntimeDirectory: changing it makes
# ExecStopPost re-chown its contents, which SELinux denies for the marker.
setfacl -m "u:${borg_user}:rx" /run/atlas-borg
chown root:"$borg_group" "$stage"
chmod 0750 /run/atlas-borg "$stage" chmod 0750 /run/atlas-borg "$stage"
flock 9 flock 9

4
ansible/roles/profile_atlas/templates/atlas-monitor-failure@.service.j2
View File

@@ -1,12 +1,12 @@
[Unit] [Unit]
Description=Submit a 45Drives Alert for failed Atlas job %I Description=Submit a 45Drives Alert for failed Atlas job %i
Requires=houston-dbus.service Requires=houston-dbus.service
After=houston-dbus.service After=houston-dbus.service
ConditionFileIsExecutable=/usr/local/libexec/atlas-health-monitor ConditionFileIsExecutable=/usr/local/libexec/atlas-health-monitor
[Service] [Service]
Type=oneshot Type=oneshot
ExecStart=/usr/local/libexec/atlas-health-monitor --job-failed %I ExecStart=/usr/local/libexec/atlas-health-monitor --job-failed %i
User=root User=root
Group=root Group=root
UMask=0077 UMask=0077