fix(roles/repo_*): deploy repository files carrying mirror credentials with mode 0600

CHANGELOG.md

@@ -31,6 +31,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+* A repository file that carries mirror credentials is deployed with mode `0600` instead of `0644`, so an unprivileged `dnf` or `zypper` no longer lists those repositories (all `repo_*` roles).
 * **role:collabora**: A host running a Collabora version the role has no configuration template for aborts with that version and the list of supported ones, instead of failing on a missing file.
 * **role:collabora**: The `localhost` WOPI host is an ordinary entry of `collabora__coolwsd_storage_wopi__*` instead of being hard-coded in the template, so it can be dropped with `state: 'absent'` like any other host.
 * **role:php**: The PHP-FPM configuration is checked with `php-fpm --test` before the service is restarted, so a broken pool or ini aborts the run with the error message instead of taking PHP-FPM down on the restart.

roles/repo_baseos/tasks/main.yml

@@ -12,7 +12,8 @@
       dest: '/etc/yum.repos.d/{{ item | basename }}'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_baseos__basic_auth_login | default({}) | length > 0 else "0o644" }}'
     loop: '{{ __repo_baseos__repo_files }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'

roles/repo_collabora/tasks/main.yml

@@ -12,7 +12,8 @@
       dest: '/etc/yum.repos.d/Collabora.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_collabora__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_collabora_code/tasks/main.yml

@@ -13,7 +13,8 @@
       dest: '/etc/yum.repos.d/Collabora.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_collabora_code__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_docker/tasks/main.yml

@@ -8,7 +8,8 @@
       dest: '/etc/yum.repos.d/docker-ce.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_docker__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_elasticsearch/tasks/RedHat.yml

@@ -8,7 +8,8 @@
       dest: '/etc/yum.repos.d/elasticsearch.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_elasticsearch__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_epel/tasks/main.yml

@@ -17,7 +17,8 @@
       dest: '/etc/yum.repos.d/{{ item | basename }}'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_epel__basic_auth_login | default({}) | length > 0 else "0o644" }}'
     loop: '{{ __repo_epel__repo_files }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'

roles/repo_gitlab_ce/tasks/main.yml

@@ -8,7 +8,8 @@
       dest: '/etc/yum.repos.d/gitlab_gitlab-ce.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_gitlab_ce__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_gitlab_runner/tasks/main.yml

@@ -7,7 +7,8 @@
       dest: '/etc/yum.repos.d/gitlab_gitlab-ce.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_gitlab_runner__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_grafana/tasks/RedHat.yml

@@ -22,7 +22,8 @@
       dest: '/etc/yum.repos.d/grafana.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_grafana__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_graylog/tasks/RedHat.yml

@@ -24,7 +24,8 @@
       dest: '/etc/yum.repos.d/graylog.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_graylog__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_icinga/tasks/RedHat.yml

@@ -22,7 +22,8 @@
       dest: '/etc/yum.repos.d/ICINGA-release.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_icinga__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:
@@ -38,7 +39,8 @@
       dest: '/etc/yum.repos.d/ICINGA-snapshot.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_icinga__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_icinga/tasks/Suse.yml

@@ -29,7 +29,8 @@
       dest: '/etc/zypp/repos.d/ICINGA-release.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_icinga__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:
@@ -45,7 +46,8 @@
       dest: '/etc/zypp/repos.d/ICINGA-snapshot.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_icinga__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_influxdb/tasks/RedHat.yml

@@ -21,7 +21,8 @@
       dest: '/etc/yum.repos.d/influxdb.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_influxdb__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_mariadb/tasks/RedHat.yml

@@ -17,7 +17,8 @@
       dest: '/etc/yum.repos.d/MariaDB.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_mariadb__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_mongodb/tasks/RedHat.yml

@@ -24,7 +24,8 @@
       dest: '/etc/yum.repos.d/mongodb-org.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_mongodb__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_monitoring_plugins/tasks/RedHat.yml

@@ -34,7 +34,8 @@
       dest: '/etc/yum.repos.d/linuxfabrik-monitoring-plugins.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_monitoring_plugins__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   tags:
     - 'repo_monitoring_plugins'

roles/repo_monitoring_plugins/tasks/Suse.yml

@@ -29,7 +29,8 @@
       dest: '/etc/zypp/repos.d/linuxfabrik-monitoring-plugins.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_monitoring_plugins__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   tags:
     - 'repo_monitoring_plugins'

roles/repo_mydumper/tasks/RedHat.yml

@@ -7,7 +7,8 @@
       dest: '/etc/yum.repos.d/mydumper.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_mydumper__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   tags:
     - 'repo_mydumper'

roles/repo_opensearch/tasks/RedHat.yml

@@ -23,7 +23,8 @@
       dest: '/etc/yum.repos.d/opensearch.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_opensearch__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_postgresql/tasks/main.yml

@@ -15,7 +15,8 @@
       dest: '/etc/yum.repos.d/pgdg-redhat-all.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_postgresql__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_proxysql/tasks/RedHat.yml

@@ -24,7 +24,8 @@
       dest: '/etc/yum.repos.d/proxysql.repo'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_proxysql__basic_auth_login | default({}) | length > 0 else "0o644" }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'
     ansible.builtin.include_role:

roles/repo_remi/tasks/main.yml

@@ -19,7 +19,8 @@
       dest: '/etc/yum.repos.d/{{ item | basename }}'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_remi__basic_auth_login | default({}) | length > 0 else "0o644" }}'
     loop: '{{ __repo_remi__repo_files }}'
 
   - name: 'Remove rpmnew / rpmsave (and Debian equivalents)'

roles/repo_rpmfusion/tasks/main.yml

@@ -7,7 +7,8 @@
       dest: '/{{ item }}'
       owner: 'root'
       group: 'root'
-      mode: 0o644
+      # 0600 while the file carries the mirror credentials
+      mode: '{{ "0o600" if repo_rpmfusion__basic_auth_login | default({}) | length > 0 else "0o644" }}'
     loop:
       - 'etc/yum.repos.d/rpmfusion-free-updates-testing.repo'
       - 'etc/yum.repos.d/rpmfusion-free-updates.repo'