From cacd3195514285363c3917a2537bfe52274c05fb Mon Sep 17 00:00:00 2001 From: Tony Wasserka Date: Sun, 15 Feb 2026 12:52:02 +0100 Subject: [PATCH 1/2] nixos/tests/mobilizon: check for correct directory owner --- nixos/tests/mobilizon.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nixos/tests/mobilizon.nix b/nixos/tests/mobilizon.nix index 1a07c5fc2732..5800ac702f16 100644 --- a/nixos/tests/mobilizon.nix +++ b/nixos/tests/mobilizon.nix @@ -43,5 +43,11 @@ in server.wait_for_unit("mobilizon.service") server.wait_for_open_port(${toString port}) server.succeed("curl --fail https://${mobilizonDomain}/") + + # Verify ownership is set up correctly + owner = server.succeed("stat -c '%U' /var/lib/mobilizon/sitemap").rstrip() + assert owner == "mobilizon", f"unexpected owner: {owner}" + owner = server.succeed("stat -c '%U' /var/lib/mobilizon/uploads").rstrip() + assert owner == "mobilizon", f"unexpected owner: {owner}" ''; } From 718474975bd1cd3c831e2d5e8ec05d0724c03ad8 Mon Sep 17 00:00:00 2001 From: Tony Wasserka Date: Fri, 13 Feb 2026 23:28:16 +0100 Subject: [PATCH 2/2] mobilizon: fix permissions on /var/lib/mobilizon and its folders Image uploads were broken due to /var/lib/mobilizon/uploads being root-owned. The root cause is that systemd doesn't always process tmpfiles rules in the listed order. The "Z" rule is actually applied first, so it didn't have any effect on first run (when the directory doesn't exist). The other rules would then proceed to create the directory structure, but any parent directories that aren't explicitly listed would be root-owned. The fix is to explicitly list parent directories with the proper owner. --- nixos/modules/services/web-apps/mobilizon.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nixos/modules/services/web-apps/mobilizon.nix b/nixos/modules/services/web-apps/mobilizon.nix index 35efbeb767d6..77a19e60a074 100644 --- a/nixos/modules/services/web-apps/mobilizon.nix +++ b/nixos/modules/services/web-apps/mobilizon.nix @@ -398,7 +398,10 @@ in }; systemd.tmpfiles.rules = [ + "d /var/lib/mobilizon 700 mobilizon mobilizon - -" "d /var/lib/mobilizon/sitemap 700 mobilizon mobilizon - -" + "d /var/lib/mobilizon/uploads 700 mobilizon mobilizon - -" + "d /var/lib/mobilizon/uploads/exports 700 mobilizon mobilizon - -" "d /var/lib/mobilizon/uploads/exports/csv 700 mobilizon mobilizon - -" "Z /var/lib/mobilizon 700 mobilizon mobilizon - -" ];