Self-heal vault/state ownership; run ob as the sync user #42

Merged

parkerhdavis merged 1 commit from obsidian-sync-ownership into main 2026-10-12 13:34:24 -06:00

Conversation 0 Commits 1 Files changed 6 +84 -35

parkerhdavis commented 2026-10-12 13:34:21 -06:00 (Migrated from github.com)

Copy link

Docker auto-creates missing bind sources as root:root, which locked the sync user out of its own vault (EACCES on downloads on beelink and tower). Containers now start as root solely to repair /state and vault ownership (chown -R the top level when the owner is wrong), then drop to OBSIDIAN_UID/GID via gosu for every ob call, so ob never writes as root and fresh hosts need no manual chown. go su resets $HOME, which hid the persisted auth token and forced a re-login on every start; run() pins HOME=/state through the drop, and the login pre-flight now retries transient failures but breaks immediately on a genuine 'No account logged in'.

Docker auto-creates missing bind sources as root:root, which locked the sync user out of its own vault (EACCES on downloads on beelink and tower). Containers now start as root solely to repair /state and vault ownership (chown -R the top level when the owner is wrong), then drop to OBSIDIAN_UID/GID via gosu for every ob call, so ob never writes as root and fresh hosts need no manual chown. go su resets $HOME, which hid the persisted auth token and forced a re-login on every start; run() pins HOME=/state through the drop, and the login pre-flight now retries transient failures but breaks immediately on a genuine 'No account logged in'.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

parker/cumulus!42

No description provided.