timothykim/argento
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add hannah smb user, fix music dir permissions

Browse Source
This commit is contained in:
timothykim
2026-08-29 20:38:35 -04:00
parent f7888a8f8d
commit c287fb0145
3 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+1
View File
@@ -15,6 +15,7 @@ Recovery steps are in `RUNBOOK.md`. Repo overview and workflows are in `README.m
- **Cockpit (argento.timothykim.net)**: Runs directly on the host (not Docker) on port 9090 with self-signed TLS. The nginx conf inlines security headers instead of including security-headers.inc because Cockpit's internal iframes break with X-Frame-Options: DENY. Cockpit has a known bug where font files return 404 — this is not a proxy issue.
- **Minecraft HTTP-only**: HTTPS causes WebSocket/CORS errors with the MCSManager daemon. No cert issued for this domain.
- **SSL cert issuance chicken-and-egg**: On fresh recovery, certs don't exist so SSL confs can't load. The `.hold` pattern moves SSL confs aside, starts nginx with HTTP-only confs, issues certs, then restores SSL confs.
- **ZFS NFSv4 ACLs on threeteras/media**: `acltype=nfsv4`, `aclmode=restricted`, `aclinherit=passthrough`. `chmod` on anything under `/opt/argento/smb/media` fails with `Operation not permitted` (EPERM) even as root — that is the ACL refusing to be overwritten, not a bug. New dirs inherit the parent's ACL automatically, so setgid bits and `chmod` are unnecessary; don't put `force create mode` / `force directory mode` in smb.conf shares over this dataset either, since those make Samba call chmod.
- **SELinux is enforcing**: Caused issues with samba (symlinks blocked, parent directory traversal blocked). Don't use symlinks for config files — use the sync-system.sh copy approach instead.
- **Secrets in .env files**: All secrets (DB passwords, API keys, tokens) live in `.env` files under each app's `docker/<app>/` directory on the server. These are gitignored (`**/.env` in root `.gitignore`). The `.env` files are included in the USB backup. If the backup is lost, all secrets can be recreated from Bitwarden. The `system/msmtprc` in the repo has its password REDACTED -- the real one is only on the server.
- **ZFS parent dataset mountpoints**: Pools have parent datasets (e.g., `nextcloud`, `threeteras`) that create mountpoints like `/mnt/nextcloud`. These are empty and expected — do not delete them.