From 81d5db5ddb9fa6aa8cfa3f750d4dfcaabc6b52a3 Mon Sep 17 00:00:00 2001
From: patrick <patrickjaroszewski@protonmail.com>
Date: Thu, 16 Jul 2026 23:28:33 -0400
Subject: [PATCH] chown romm mysql-data to uid 999 with mode 0700

---
 roles/romm/meta/main.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/roles/romm/meta/main.yml b/roles/romm/meta/main.yml
index 3344fc2..594eaea 100644
--- a/roles/romm/meta/main.yml
+++ b/roles/romm/meta/main.yml
@@ -10,10 +10,12 @@ dependencies:
       app_role_name: romm
       # romm_library_path is intentionally excluded: it's user-managed
       # external storage (often on NFS/SMB with pre-existing perms).
+      # mysql_data_path needs uid/gid 999 (mysql user inside the mariadb
+      # container) and mode 0700 (mariadb refuses world/group access).
       app_subdirectories: >-
         {{
           [romm_assets_path, romm_config_path, romm_resources_path,
-           romm_mysql_data_path]
+           {'path': romm_mysql_data_path, 'owner': 999, 'group': 999, 'mode': '0700'}]
           + ([romm_redis_data_path] if romm_redis_data_path else [])
         }}
       app_backup_subdirectories: