updated fixed systemd errors

roles/stoat/tasks/harden.yml

@@ -72,19 +72,24 @@
     name: dnf5-plugin-automatic
     state: present
 
+# ini_file with create: true handles both a missing config file
+# (package may not ship /etc/dnf/automatic.conf until a run) and
+# preserves any other sections the user may have customized.
 - name: Enable automatic installation of updates
-  ansible.builtin.lineinfile:
+  community.general.ini_file:
     path: /etc/dnf/automatic.conf
-    insertafter: "^\\[commands\\]"
-    regexp: "^#?\\s*apply_updates\\s*="
-    line: "apply_updates = yes"
+    section: commands
+    option: apply_updates
+    value: "yes"
+    create: true
 
 - name: Restrict automatic updates to security errata
-  ansible.builtin.lineinfile:
+  community.general.ini_file:
     path: /etc/dnf/automatic.conf
-    insertafter: "^\\[commands\\]"
-    regexp: "^#?\\s*upgrade_type\\s*="
-    line: "upgrade_type = security"
+    section: commands
+    option: upgrade_type
+    value: "security"
+    create: true
 
 - name: Enable and start dnf5-automatic.timer
   ansible.builtin.systemd:

roles/stoat/tasks/stoat.yml

@@ -2,25 +2,22 @@
 # ------------------------------------------------------------
 # Stoat deployment - rootless podman-compose, managed by systemd
 # ------------------------------------------------------------
+# These tasks run as root (play-level become), NOT as the stoat
+# user: becoming an unprivileged user trips an ACL bug on Linux
+# ("chmod A+user:..."). Ownership is handed to the service user
+# afterwards via chown, and the systemd unit runs podman-compose
+# as the stoat user via User=.
 - name: Clone Stoat self-hosted repository
   ansible.builtin.git:
     repo: "{{ stoat_repo }}"
     dest: "{{ stoat_install_dir }}"
     version: "{{ stoat_version }}"
     force: true
-  become: true
-  become_user: "{{ stoat_service_user }}"
-  become_method: su
-  environment:
-    HOME: "/home/{{ stoat_service_user }}"
 
 - name: Ensure generate_config.sh is executable
   ansible.builtin.file:
     path: "{{ stoat_install_dir }}/generate_config.sh"
     mode: "0755"
-  become: true
-  become_user: "{{ stoat_service_user }}"
-  become_method: su
 
 # The compose file bind-mounts these directories; create them up
 # front so rootless podman does not fail on missing sources.
@@ -50,11 +47,16 @@
   args:
     chdir: "{{ stoat_install_dir }}"
     creates: "{{ stoat_install_dir }}/Revolt.toml"
-  become: true
-  become_user: "{{ stoat_service_user }}"
-  become_method: su
-  environment:
-    HOME: "/home/{{ stoat_service_user }}"
+
+# The generator and clone run as root; hand the whole deployment
+# tree to the service user so rootless podman can read/write it.
+- name: Hand ownership of the deployment tree to the service user
+  ansible.builtin.file:
+    path: "{{ stoat_install_dir }}"
+    state: directory
+    owner: "{{ stoat_service_user }}"
+    group: "{{ stoat_service_user }}"
+    recurse: true
 
 - name: Deploy podman-compose systemd unit
   ansible.builtin.template:
@@ -65,11 +67,10 @@
     mode: "0644"
 
 # First start pulls ~2 GB of images + initializes MongoDB, which can
-# take several minutes. TimeoutStartSec covers this inside the unit.
+# take several minutes. TimeoutStartSec in the unit covers this.
 - name: Enable and start the Stoat service (first pull may take minutes)
   ansible.builtin.systemd:
     name: podman-compose-stoat
     state: started
     enabled: true
-    daemon_reload: true
-    timeout: 900
+    daemon_reload: true