40 lines
2.4 KiB
YAML
40 lines
2.4 KiB
YAML
# nh3-dev: /srv/nemi/books, the book drop Nemi validates into ~/library/<shelf>/ (albok unit 8; albok-dev 2026-10-16 after
|
|
# Prime: "build the books drop folder in nemi ... a rejection folder feels appropriate"). Same shape as /srv/nemi/inbox
|
|
# (playbooks/nh3-dev-nemi-inbox.yaml, which created group nemi-drop and /srv/nemi): Nemi moves each valid epub from
|
|
# fiction/ or nonfiction/ into ~/library/<shelf>/, and anything it refuses into rejected/ beside a reason file.
|
|
# scripts/elway infra-ops@10.100.10.50 --playbook playbooks/nh3-dev-nemi-books.yaml
|
|
# Writers: group nemi-drop (lkraven, infra-ops). Nemi runs as lkraven from the user manager, whose groups predate
|
|
# nemi-drop, so lkraven gets in through the u:lkraven ACL entries, NOT the group (see servers/nh3-dev/README.md).
|
|
steps:
|
|
- name: Prerequisites from the inbox playbook (group nemi-drop, /srv/nemi with u:lkraven:rx)
|
|
shell: |
|
|
getent group nemi-drop >/dev/null && test -d /srv/nemi && getfacl -p /srv/nemi | grep -q '^user:lkraven:r-x'
|
|
changed_when: "false"
|
|
- name: /srv/nemi/books and fiction/ nonfiction/ rejected/ (lkraven:nemi-drop 2770, same ACL as the inbox)
|
|
sudo: true
|
|
shell: |
|
|
for d in /srv/nemi/books /srv/nemi/books/fiction /srv/nemi/books/nonfiction /srv/nemi/books/rejected; do
|
|
install -d -o lkraven -g nemi-drop -m 2770 "$d"
|
|
setfacl -m u:lkraven:rwx,g:nemi-drop:rwx "$d"
|
|
setfacl -d -m u::rwX,u:lkraven:rwX,g::rwX,g:nemi-drop:rwX,o::--- "$d"
|
|
done
|
|
getfacl -p /srv/nemi/books
|
|
creates: /srv/nemi/books/rejected
|
|
verify:
|
|
- name: Nemi's own context (lkraven's systemd user manager, groups fixed at boot) can list every books dir
|
|
shell: runuser -u lkraven -- env XDG_RUNTIME_DIR=/run/user/1000 systemd-run --user --wait --pipe -q ls -ld /srv/nemi/books /srv/nemi/books/fiction /srv/nemi/books/nonfiction /srv/nemi/books/rejected
|
|
sudo: true
|
|
changed_when: "false"
|
|
- name: A file dropped by infra-ops into fiction/ is readable by lkraven, movable to rejected/, and removable
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
f=/srv/nemi/books/fiction/.acl-probe-$$
|
|
r=/srv/nemi/books/rejected/.acl-probe-$$
|
|
runuser -u infra-ops -g nemi-drop -- sh -c "umask 077; echo probe > $f"
|
|
runuser -u lkraven -- cat "$f" >/dev/null
|
|
runuser -u lkraven -- mv "$f" "$r"
|
|
runuser -u lkraven -- rm -f "$r"
|
|
test ! -e "$f" && test ! -e "$r" && echo "infra-ops drop -> lkraven read+move+remove: ok"
|
|
changed_when: "false"
|