Initialize hosted audit volume ownership

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

compose.coolify.agriculture.yaml

@@ -16,6 +16,9 @@ x-relay-common: &relay-common
   platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
   restart: unless-stopped
   environment: *relay-environment
+  depends_on:
+    volume-permissions:
+      condition: service_completed_successfully
   healthcheck:
     test: ["CMD", "/usr/local/bin/registry-relay", "healthcheck"]
     interval: 30s
@@ -33,10 +36,23 @@ x-notary-common: &notary-common
     timeout: 10s
     retries: 3
   depends_on:
+    volume-permissions:
+      condition: service_completed_successfully
     redis:
       condition: service_healthy
 
 services:
+  volume-permissions:
+    image: ${VOLUME_INIT_IMAGE:-busybox:1.36}
+    command:
+      - sh
+      - -c
+      - chown -R 65532:65532 /relay/* && chown -R 65534:65534 /notary/*
+    volumes:
+      - nagdi-agriculture-cache:/relay/nagdi-agriculture-cache
+      - nagdi-agriculture-audit:/relay/nagdi-agriculture-audit
+      - nagdi-notary-state:/notary/nagdi-notary-state
+
   redis:
     image: ${REDIS_IMAGE:-redis:7.4-alpine}
     command: ["redis-server", "--save", "", "--appendonly", "no"]

compose.coolify.citizen-services.yaml

@@ -18,10 +18,21 @@ x-notary-common: &notary-common
     timeout: 10s
     retries: 3
   depends_on:
+    volume-permissions:
+      condition: service_completed_successfully
     redis:
       condition: service_healthy
 
 services:
+  volume-permissions:
+    image: ${VOLUME_INIT_IMAGE:-busybox:1.36}
+    command:
+      - sh
+      - -c
+      - chown -R 65534:65534 /notary/*
+    volumes:
+      - citizen-notary-state:/notary/citizen-notary-state
+
   redis:
     image: ${REDIS_IMAGE:-redis:7.4-alpine}
     command: ["redis-server", "--save", "", "--appendonly", "no"]

compose.coolify.interior.yaml

@@ -9,13 +9,28 @@ x-relay-common: &relay-common
   platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
   restart: unless-stopped
   environment: *relay-environment
+  depends_on:
+    volume-permissions:
+      condition: service_completed_successfully
   healthcheck:
     test: ["CMD", "/usr/local/bin/registry-relay", "healthcheck"]
     interval: 30s
     timeout: 10s
     retries: 3
 
 services:
+  volume-permissions:
+    image: ${VOLUME_INIT_IMAGE:-busybox:1.36}
+    command:
+      - sh
+      - -c
+      - chown -R 65532:65532 /relay/*
+    volumes:
+      - cra-civil-cache:/relay/cra-civil-cache
+      - cra-civil-audit:/relay/cra-civil-audit
+      - nia-population-cache:/relay/nia-population-cache
+      - nia-population-audit:/relay/nia-population-audit
+
   postgres:
     image: ${SOLMARA_POSTGRES_IMAGE:?set digest-pinned Solmara Postgres image}
     entrypoint: ["/bin/sh", "/usr/local/bin/solmara-postgres-entrypoint.sh"]
@@ -66,6 +81,8 @@ services:
       NIA_CITIZEN_SOURCE_HASH: ${NIA_CITIZEN_SOURCE_HASH}
       PORTAL_RELAY_TOKEN_HASH: ${PORTAL_RELAY_TOKEN_HASH}
     depends_on:
+      volume-permissions:
+        condition: service_completed_successfully
       postgres:
         condition: service_healthy
     volumes:

compose.coolify.labour-pensions.yaml

@@ -16,6 +16,9 @@ x-relay-common: &relay-common
   platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
   restart: unless-stopped
   environment: *relay-environment
+  depends_on:
+    volume-permissions:
+      condition: service_completed_successfully
   healthcheck:
     test: ["CMD", "/usr/local/bin/registry-relay", "healthcheck"]
     interval: 30s
@@ -33,10 +36,23 @@ x-notary-common: &notary-common
     timeout: 10s
     retries: 3
   depends_on:
+    volume-permissions:
+      condition: service_completed_successfully
     redis:
       condition: service_healthy
 
 services:
+  volume-permissions:
+    image: ${VOLUME_INIT_IMAGE:-busybox:1.36}
+    command:
+      - sh
+      - -c
+      - chown -R 65532:65532 /relay/* && chown -R 65534:65534 /notary/*
+    volumes:
+      - sipf-pensions-cache:/relay/sipf-pensions-cache
+      - sipf-pensions-audit:/relay/sipf-pensions-audit
+      - pension-notary-state:/notary/pension-notary-state
+
   redis:
     image: ${REDIS_IMAGE:-redis:7.4-alpine}
     command: ["redis-server", "--save", "", "--appendonly", "no"]

compose.coolify.social-development.yaml

@@ -16,6 +16,9 @@ x-relay-common: &relay-common
   platform: ${REGISTRY_STACK_PLATFORM:-linux/amd64}
   restart: unless-stopped
   environment: *relay-environment
+  depends_on:
+    volume-permissions:
+      condition: service_completed_successfully
   healthcheck:
     test: ["CMD", "/usr/local/bin/registry-relay", "healthcheck"]
     interval: 30s
@@ -33,10 +36,25 @@ x-notary-common: &notary-common
     timeout: 10s
     retries: 3
   depends_on:
+    volume-permissions:
+      condition: service_completed_successfully
     redis:
       condition: service_healthy
 
 services:
+  volume-permissions:
+    image: ${VOLUME_INIT_IMAGE:-busybox:1.36}
+    command:
+      - sh
+      - -c
+      - chown -R 65532:65532 /relay/* && chown -R 65534:65534 /notary/*
+    volumes:
+      - sro-social-cache:/relay/sro-social-cache
+      - sro-social-audit:/relay/sro-social-audit
+      - programme-mis-cache:/relay/programme-mis-cache
+      - programme-mis-audit:/relay/programme-mis-audit
+      - child-benefit-notary-state:/notary/child-benefit-notary-state
+
   redis:
     image: ${REDIS_IMAGE:-redis:7.4-alpine}
     command: ["redis-server", "--save", "", "--appendonly", "no"]

scripts/test_quality_scripts.py

@@ -120,14 +120,19 @@ def test_coolify_services_mount_durable_audit_state(self) -> None:
                 compose = yaml.safe_load((ROOT / compose_name).read_text(encoding="utf-8"))
                 declared_volumes = set((compose.get("volumes") or {}).keys())
                 services = compose["services"]
+                init_service = services["volume-permissions"]
+                init_volume_names = {mount.split(":", 1)[0] for mount in init_service.get("volumes") or []}
 
                 for service_name, mounts in service_mounts.items():
                     service = services[service_name]
                     service_volumes = set(service.get("volumes") or [])
+                    self.assertIn("volume-permissions", service.get("depends_on") or {})
                     for mount in mounts:
                         with self.subTest(service=service_name, mount=mount):
+                            volume_name = mount.split(":", 1)[0]
                             self.assertIn(mount, service_volumes)
-                            self.assertIn(mount.split(":", 1)[0], declared_volumes)
+                            self.assertIn(volume_name, declared_volumes)
+                            self.assertIn(volume_name, init_volume_names)
 
     def test_story_preview_smoke_passes_current_tree(self) -> None:
         result = subprocess.run(