updated fixed systemd errors

.omo/run-continuation/ses_f63e23ebcffe7Q6sJKCl9W8sFt.json

@@ -1,10 +1,10 @@
 {
   "sessionID": "ses_f63e23ebcffe7Q6sJKCl9W8sFt",
-  "updatedAt": "2026-09-13T19:33:29.129Z",
+  "updatedAt": "2026-09-13T19:48:15.726Z",
   "sources": {
     "background-task": {
       "state": "idle",
-      "updatedAt": "2026-09-13T19:33:29.129Z"
+      "updatedAt": "2026-09-13T19:48:15.726Z"
     }
   }
 }

inventory.ini

@@ -1,15 +1,16 @@
 # --------------------------------------------------------------
 # Ansible inventory - servers to harden
-# Usage: ansible-playbook -i inventory.ini harden_fedora44.yml
+# Usage: ansible-playbook -i inventory.ini site.yml -k
 # --------------------------------------------------------------
 
 [servers]
-stoat-demo ansible_host=stoat-demo
+# Replace YOUR_SSH_PASSWORD with the real password. Keep the file
+# out of git / chmod 600 it, or encrypt with ansible-vault:
+#   ansible-vault encrypt inventory.ini
+stoat-demo ansible_host=stoat-demo ansible_user=fedora ansible_ssh_pass=VjocLlmw6faSdM
 
 [servers:vars]
 # Elevate privileges (the playbook already sets become: true,
 # but this allows per-group override if needed)
 ansible_become=yes
 ansible_become_method=sudo
-# Optional: path to your SSH private key
-# ansible_ssh_private_key_file=/home/you/.ssh/id_ed25519

roles/stoat/tasks/harden.yml

@@ -72,19 +72,24 @@
     name: dnf5-plugin-automatic
     state: present
 
+# ini_file with create: true handles both a missing config file
+# (package may not ship /etc/dnf/automatic.conf until a run) and
+# preserves any other sections the user may have customized.
 - name: Enable automatic installation of updates
-  ansible.builtin.lineinfile:
+  community.general.ini_file:
     path: /etc/dnf/automatic.conf
-    insertafter: "^\\[commands\\]"
+    section: commands
-    regexp: "^#?\\s*apply_updates\\s*="
+    option: apply_updates
-    line: "apply_updates = yes"
+    value: "yes"
+    create: true
 
 - name: Restrict automatic updates to security errata
-  ansible.builtin.lineinfile:
+  community.general.ini_file:
     path: /etc/dnf/automatic.conf
-    insertafter: "^\\[commands\\]"
+    section: commands
-    regexp: "^#?\\s*upgrade_type\\s*="
+    option: upgrade_type
-    line: "upgrade_type = security"
+    value: "security"
+    create: true
 
 - name: Enable and start dnf5-automatic.timer
   ansible.builtin.systemd:

roles/stoat/tasks/stoat.yml

@@ -2,25 +2,22 @@
 # ------------------------------------------------------------
 # Stoat deployment - rootless podman-compose, managed by systemd
 # ------------------------------------------------------------
+# These tasks run as root (play-level become), NOT as the stoat
+# user: becoming an unprivileged user trips an ACL bug on Linux
+# ("chmod A+user:..."). Ownership is handed to the service user
+# afterwards via chown, and the systemd unit runs podman-compose
+# as the stoat user via User=.
 - name: Clone Stoat self-hosted repository
   ansible.builtin.git:
     repo: "{{ stoat_repo }}"
     dest: "{{ stoat_install_dir }}"
     version: "{{ stoat_version }}"
     force: true
-  become: true
-  become_user: "{{ stoat_service_user }}"
-  become_method: su
-  environment:
-    HOME: "/home/{{ stoat_service_user }}"
 
 - name: Ensure generate_config.sh is executable
   ansible.builtin.file:
     path: "{{ stoat_install_dir }}/generate_config.sh"
     mode: "0755"
-  become: true
-  become_user: "{{ stoat_service_user }}"
-  become_method: su
 
 # The compose file bind-mounts these directories; create them up
 # front so rootless podman does not fail on missing sources.
@@ -50,11 +47,16 @@
   args:
     chdir: "{{ stoat_install_dir }}"
     creates: "{{ stoat_install_dir }}/Revolt.toml"
-  become: true
+
-  become_user: "{{ stoat_service_user }}"
+# The generator and clone run as root; hand the whole deployment
-  become_method: su
+# tree to the service user so rootless podman can read/write it.
-  environment:
+- name: Hand ownership of the deployment tree to the service user
-    HOME: "/home/{{ stoat_service_user }}"
+  ansible.builtin.file:
+    path: "{{ stoat_install_dir }}"
+    state: directory
+    owner: "{{ stoat_service_user }}"
+    group: "{{ stoat_service_user }}"
+    recurse: true
 
 - name: Deploy podman-compose systemd unit
   ansible.builtin.template:
@@ -65,11 +67,10 @@
     mode: "0644"
 
 # First start pulls ~2 GB of images + initializes MongoDB, which can
-# take several minutes. TimeoutStartSec covers this inside the unit.
+# take several minutes. TimeoutStartSec in the unit covers this.
 - name: Enable and start the Stoat service (first pull may take minutes)
   ansible.builtin.systemd:
     name: podman-compose-stoat
     state: started
     enabled: true
     daemon_reload: true
-    timeout: 900