From dd5901a2f0d424bdcff64167fdb01a6ebff3befd Mon Sep 17 00:00:00 2001
From: patrick <patrickjaroszewski@protonmail.com>
Date: Thu, 16 Jul 2026 23:56:51 -0400
Subject: [PATCH] align romm shim with jellyfin/navidrome uid pattern
 (romm_uid/romm_gid)

---
 roles/romm/defaults/main.yml        |  8 ++++++++
 roles/romm/meta/main.yml            | 15 ++++++++++-----
 roles/romm/templates/compose.yml.j2 |  1 +
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/roles/romm/defaults/main.yml b/roles/romm/defaults/main.yml
index c047172..469fc70 100644
--- a/roles/romm/defaults/main.yml
+++ b/roles/romm/defaults/main.yml
@@ -11,6 +11,14 @@ romm_restart_policy: "{{ app_restart_policy | default('unless-stopped') }}"
 # Network configuration
 romm_http_port: 8080
 
+# User the romm container runs as. Defaults to app_uid/app_gid (the ansible
+# connection user, or root under become). Override in your playbook to
+# align with host user perms on bind-mounted paths (e.g. NFS). Applies to
+# the romm service only; mariadb manages its own user internally. Also used
+# as the owner of the app-managed subdirectories.
+romm_uid: "{{ app_uid }}"
+romm_gid: "{{ app_gid }}"
+
 # Volume paths
 romm_library_path: "{{ app_dir }}/library"
 romm_assets_path: "{{ app_dir }}/assets"
diff --git a/roles/romm/meta/main.yml b/roles/romm/meta/main.yml
index 594eaea..ada97c5 100644
--- a/roles/romm/meta/main.yml
+++ b/roles/romm/meta/main.yml
@@ -10,13 +10,18 @@ dependencies:
       app_role_name: romm
       # romm_library_path is intentionally excluded: it's user-managed
       # external storage (often on NFS/SMB with pre-existing perms).
-      # mysql_data_path needs uid/gid 999 (mysql user inside the mariadb
-      # container) and mode 0700 (mariadb refuses world/group access).
+      # mysql_data_path is chowned to 999:999 mode 0700 for the mariadb
+      # container's mysql user. App dirs match romm_puid/romm_pgid when set;
+      # otherwise fall back to the base role's app_uid/app_gid.
       app_subdirectories: >-
         {{
-          [romm_assets_path, romm_config_path, romm_resources_path,
-           {'path': romm_mysql_data_path, 'owner': 999, 'group': 999, 'mode': '0700'}]
-          + ([romm_redis_data_path] if romm_redis_data_path else [])
+          [
+            {'path': romm_assets_path,     'owner': romm_uid, 'group': romm_gid},
+            {'path': romm_config_path,     'owner': romm_uid, 'group': romm_gid},
+            {'path': romm_resources_path,  'owner': romm_uid, 'group': romm_gid},
+            {'path': romm_mysql_data_path, 'owner': 999, 'group': 999, 'mode': '0700'},
+          ]
+          + ([{'path': romm_redis_data_path, 'owner': romm_uid, 'group': romm_gid}] if romm_redis_data_path else [])
         }}
       app_backup_subdirectories:
         - "{{ romm_assets_path }}"
diff --git a/roles/romm/templates/compose.yml.j2 b/roles/romm/templates/compose.yml.j2
index 449e16d..3329474 100644
--- a/roles/romm/templates/compose.yml.j2
+++ b/roles/romm/templates/compose.yml.j2
@@ -4,6 +4,7 @@ services:
     image: "rommapp/romm:{{ romm_container_version }}"
     container_name: "{{ romm_container_name }}"
     restart: "{{ romm_restart_policy }}"
+    user: "{{ romm_uid }}:{{ romm_gid }}"
     env_file:
       - .env
     volumes: