03_ownership.yml

---
# Set ownership/permissions on Moodle volumes after first start. The
# entrypoint already chowns on every boot, but this is a belt-and-
# suspenders pass for re-deploys after operator-driven file edits.
#
# Code dir uses world-readable perms (0755 dirs / 0644 files) so the
# nginx sidecar (alpine, runs as uid 101) can serve static assets and
# stream PHP files to FPM. Data dir stays restrictive (0770 / 0660)
# because only Moodle FPM (running as MOODLE_RUNTIME_USER) needs to
# read/write user-uploaded content.

- name: "⏳ Wait until no container is still bootstrapping the shared code volume"
  shell: >
    container exec --user root {{ MOODLE_CONTAINER_ADDRESS }}
    sh -c 'test ! -e {{ MOODLE_BOOTSTRAP_STAGE }} && test "$(cat {{ MOODLE_BOOTSTRAP_SENTINEL }} 2>/dev/null)" = "{{ MOODLE_RELEASE }}"'
  register: moodle_bootstrap_settled
  until: moodle_bootstrap_settled.rc == 0
  retries: 120
  delay: 5
  changed_when: false

- name: "✅ Ensure ownership is correct on Moodle code dir"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} find {{ MOODLE_CODE_DIR }} -path {{ MOODLE_BOOTSTRAP_STAGE }} -prune -o -exec chown -h {{ MOODLE_RUNTIME_USER_GROUP
    }} {} +"
  changed_when: false

- name: "✅ Ensure ownership is correct on Moodle data dir"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} chown -R {{ MOODLE_RUNTIME_USER_GROUP }} {{ MOODLE_DATA_DIR }}"
  changed_when: false

- name: "📁 Code dir: 0755 dirs (nginx-readable)"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} find {{ MOODLE_CODE_DIR }} -path {{ MOODLE_BOOTSTRAP_STAGE }} -prune -o -type d -exec chmod 0755
    {} +"
  changed_when: false

- name: "📁 Code dir: 0644 files (nginx-readable)"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} find {{ MOODLE_CODE_DIR }} -path {{ MOODLE_BOOTSTRAP_STAGE }} -prune -o -type f -exec chmod 0644
    {} +"
  changed_when: false

- name: "📁 Code dir: 0640 config.php (FPM-only)"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} chmod 0640 {{ MOODLE_CONFIG }}"
  changed_when: false

- name: "📁 Data dir: 0770 dirs (FPM-only)"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} find {{ MOODLE_DATA_DIR }} -type d -exec chmod 0770 {} +"
  changed_when: false

- name: "📁 Data dir: 0660 files (FPM-only)"
  shell: "container exec --user root {{ MOODLE_CONTAINER_ADDRESS }} find {{ MOODLE_DATA_DIR }} -type f -exec chmod 0660 {} +"
  changed_when: false