2026-07-10 10:58:38 +00:00
1 changed files with 15 additions and 1 deletions
@@ -213,6 +213,20 @@
  loop:
    - ""
    - config
-    - certs
    - dumps
    - images
+
+# The certs dir holds the reverse-mTLS bot-link keypair, bind-mounted into the gateway (and
+# backend) which run as the distroless nonroot UID 65532 — not the deploy user. The dir must be
+# traversable by "other" (0755) or the nonroot process cannot open the 0644 keypair and crash-loops
+# at startup ("mtls: load server keypair: ... permission denied") — a latent failure that only bites
+# on a container restart (e.g. a host reboot), not while a long-running container holds the keypair
+# in memory. The keys themselves are 0644 by design (see the gateway compose); the host is
+# single-tenant and SSH-access-controlled, so a traversable certs dir adds no meaningful exposure.
+- name: Create the scrabble certs directory (traversable by the nonroot gateway UID)
+  ansible.builtin.file:
+    path: "{{ scrabble_base_dir }}/certs"
+    state: directory
+    owner: "{{ deploy_user }}"
+    group: "{{ deploy_user }}"
+    mode: "0755"