tmp

scripts/fix-impermanence-perms.sh

@@ -0,0 +1,128 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+HOST=$(hostname)
+
+fix() {
+  local dir=$1 user=$2 group=$3
+  if [ ! -e "$dir" ]; then
+    echo "  skipping (not found): $dir"
+    return
+  fi
+  echo "  fixing: $dir ($user:$group 700)"
+  chown -R "$user:$group" "$dir"
+  chmod -R u=rwX,g=,o= "$dir"
+}
+
+fix_root() {
+  local dir=$1
+  if [ ! -e "$dir" ]; then
+    echo "  skipping (not found): $dir"
+    return
+  fi
+  echo "  fixing: $dir (root:root 700)"
+  chmod -R u=rwX,g=,o= "$dir"
+}
+
+echo "=== Fixing impermanence folder permissions on $HOST ==="
+
+# slurm client (all hosts)
+fix /var/spool/slurmd slurm slurm
+
+# slurm controller
+if [ "$HOST" = arisu ] || [ "$HOST" = chibi ]; then
+  fix /var/spool/slurmctld slurm slurm
+fi
+
+# postgresql + pgbouncer
+if [ "$HOST" = tsuki ] || [ "$HOST" = shiori ]; then
+  fix /var/lib/postgresql postgres postgres
+  fix /var/lib/pgbouncer pgbouncer pgbouncer
+fi
+
+# tsuki-specific services
+if [ "$HOST" = tsuki ]; then
+  fix /var/lib/forgejo forgejo forgejo
+  fix /var/lib/ignis ignis ignis
+  fix /var/lib/rustypaste rustypaste rustypaste
+  fix /var/lib/vaultwarden vaultwarden vaultwarden
+  fix /var/lib/immich immich immich
+  fix /var/lib/asciinema asciinema asciinema
+  fix /var/lib/jellyfin jellyfin jellyfin
+fi
+
+# chibi-specific services
+if [ "$HOST" = chibi ]; then
+  fix /var/lib/prometheus2 prometheus prometheus
+  fix_root /var/lib/nfs
+
+  for d in /mnt/nfs/*; do
+    [ -d "$d" ] || continue
+    fix_root "$d"
+  done
+fi
+
+# arisu-specific services
+if [ "$HOST" = arisu ]; then
+  fix_root /var/lib/samba
+  for d in /mnt/samba/*; do
+    [ -d "$d" ] || continue
+    fix_root "$d"
+  done
+fi
+
+# Syncthing (all hosts)
+fix /mnt/syncthing c4patino syncthing
+for d in /mnt/syncthing/*/; do
+  [ -d "$d" ] || continue
+  fix "$d" c4patino syncthing
+done
+
+# ACME + servarr (shiori only)
+if [ "$HOST" = shiori ]; then
+  fix /var/lib/acme acme acme
+  fix /var/lib/sonarr sonarr sonarr
+  fix /var/lib/radarr radarr radarr
+  fix /var/lib/lidarr lidarr lidarr
+  fix /var/lib/prowlarr prowlarr prowlarr
+  fix /var/lib/bazarr bazarr bazarr
+  fix /var/lib/autobrr autobrr autobrr
+  fix /var/lib/seerr seerr seerr
+  fix /var/lib/qBittorrent qbittorrent qbittorrent
+  fix /var/lib/qui qui qui
+  fix /var/lib/unpackerr unpackerr unpackerr
+fi
+
+# Tailscale (all hosts — runs as root)
+fix_root /var/lib/tailscale
+
+# GitHub runner (arisu only)
+if [ "$HOST" = arisu ]; then
+  fix /var/lib/github-runner github-runner github-runner
+fi
+
+# Docker (all hosts)
+fix_root /var/lib/docker
+
+# Podman / containers (all hosts)
+fix_root /var/lib/containers
+
+# NetworkManager (all hosts)
+fix_root /etc/NetworkManager/system-connections
+
+# Bluetooth (desktop hosts)
+if [ "$HOST" = arisu ] || [ "$HOST" = kokoro ]; then
+  fix_root /var/lib/bluetooth
+fi
+
+# fingerprint (kokoro only)
+if [ "$HOST" = kokoro ]; then
+  fix /var/lib/fprint fprint fprint
+fi
+
+# greetd/tuigreet (desktop hosts)
+if [ "$HOST" = arisu ] || [ "$HOST" = kokoro ]; then
+  fix /var/cache/tuigreet greeter greeter
+fi
+
+echo "=== Done ==="