From a6a9f3fbb300e986db30eb708009008e51bb7bf8 Mon Sep 17 00:00:00 2001 From: Slavi Pantaleev Date: Mon, 31 Aug 2026 06:54:01 +0300 Subject: [PATCH] Mount GMessages configuration read-only --- .../molecule/default/verify.yml | 4 ++-- .../templates/systemd/matrix-mautrix-gmessages.service.j2 | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/roles/custom/matrix-bridge-mautrix-gmessages/molecule/default/verify.yml b/roles/custom/matrix-bridge-mautrix-gmessages/molecule/default/verify.yml index 3dbae9543..20eb5c9b9 100644 --- a/roles/custom/matrix-bridge-mautrix-gmessages/molecule/default/verify.yml +++ b/roles/custom/matrix-bridge-mautrix-gmessages/molecule/default/verify.yml @@ -346,13 +346,13 @@ that: - mautrix_gmessages_config_mount | length > 0 - mautrix_gmessages_config_mount.Source == matrix_bridge_mautrix_gmessages_config_path - - mautrix_gmessages_config_mount.RW + - not mautrix_gmessages_config_mount.RW - mautrix_gmessages_data_mount | length > 0 - mautrix_gmessages_data_mount.Source == matrix_bridge_mautrix_gmessages_data_path - mautrix_gmessages_data_mount.RW - mautrix_gmessages_container.Mounts | length == 2 fail_msg: "The running container does not carry the role's exact config and data mounts" - success_msg: "The running container carries the role's exact config and data mounts" + success_msg: "The running container carries read-only config and writable data mounts" vars: mautrix_gmessages_config_mount: >- {{ mautrix_gmessages_container.Mounts diff --git a/roles/custom/matrix-bridge-mautrix-gmessages/templates/systemd/matrix-mautrix-gmessages.service.j2 b/roles/custom/matrix-bridge-mautrix-gmessages/templates/systemd/matrix-mautrix-gmessages.service.j2 index 071013f2c..6a39d46d9 100644 --- a/roles/custom/matrix-bridge-mautrix-gmessages/templates/systemd/matrix-mautrix-gmessages.service.j2 +++ b/roles/custom/matrix-bridge-mautrix-gmessages/templates/systemd/matrix-mautrix-gmessages.service.j2 @@ -23,7 +23,7 @@ ExecStartPre={{ devture_systemd_docker_base_host_command_docker }} create \ --user={{ matrix_user_uid }}:{{ matrix_user_gid }} \ --cap-drop=ALL \ --network={{ matrix_bridge_mautrix_gmessages_container_network }} \ - --mount type=bind,src={{ matrix_bridge_mautrix_gmessages_config_path }},dst=/config \ + --mount type=bind,src={{ matrix_bridge_mautrix_gmessages_config_path }},dst=/config,ro \ --mount type=bind,src={{ matrix_bridge_mautrix_gmessages_data_path }},dst=/data \ --label-file={{ matrix_bridge_mautrix_gmessages_base_path }}/labels \ --workdir=/data \