From 6c9e085cbd32403483bfc905491ac3437bb10da0 Mon Sep 17 00:00:00 2001
From: tim <tim@stack.local>
Date: Wed, 22 Jul 2026 11:09:04 -0700
Subject: [PATCH] Fix Ansible stack deploy rsync chgrp permission errors

Skip owner/group preservation when syncing as non-root; Docker-owned
files under /opt/stack caused rsync code 23. Ownership is fixed after.
---
 ansible/roles/stack/tasks/main.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/ansible/roles/stack/tasks/main.yml b/ansible/roles/stack/tasks/main.yml
index 5145dc3..bd02072 100644
--- a/ansible/roles/stack/tasks/main.yml
+++ b/ansible/roles/stack/tasks/main.yml
@@ -53,6 +53,13 @@
     dest: "{{ stack_root }}/"
     delete: false
     recursive: true
+    # Non-root rsync cannot chown/chgrp files Docker created as root
+    # (e.g. searxng). Content sync only; ownership fixed in next task.
+    archive: true
+    owner: false
+    group: false
+    perms: true
+    times: true
     rsync_opts:
       - "--exclude=.git"
       - "--exclude=config/"
@@ -62,6 +69,9 @@
       - "--exclude=.env"
       - "--exclude=wireguard/wg0.conf"
       - "--exclude=ansible/.vault_pass"
+      - "--no-owner"
+      - "--no-group"
+      - "--chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r"
   when: deploy_stack_files | bool
   become: false
   tags: [stack, deploy]
@@ -74,6 +84,7 @@
     group: "{{ stack_group }}"
     recurse: true
   when: deploy_stack_files | bool
+  # become: true from play — can reset root-owned files from containers
   tags: [stack, deploy]
 
 - name: Deploy production .env for this host