From 3b923d35241b69c76f2c81eb8380d33028d2f413 Mon Sep 17 00:00:00 2001 From: Alexey Martemyanov Date: Mon, 21 Sep 2026 19:27:51 +0600 Subject: [PATCH] docs(truenas): bare-repo ACL durable fix with inheritance (291 dirs, midclt setacl) --- .../tech/truenas-nfs4-acl-and-arrmultiuser.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/personal/tech/truenas-nfs4-acl-and-arrmultiuser.md b/personal/tech/truenas-nfs4-acl-and-arrmultiuser.md index 4aad1705..f01c71e0 100644 --- a/personal/tech/truenas-nfs4-acl-and-arrmultiuser.md +++ b/personal/tech/truenas-nfs4-acl-and-arrmultiuser.md @@ -123,6 +123,28 @@ touch /mnt/RED_2TB/storage/git/obsidian-vault.git/objects/80/.wrtest && echo WRI ``` `WRITE OK` → push will succeed. Confirmed: `f9a5c2b..21505ec main -> main`, then a clean `git pull` on Kraken. +### Durable fix with INHERITANCE (2026-09-21, applied — 291 dirs) + +The minimal recipe above (add perms to existing `group@` ACE) restores write for *current* dirs, **but the bug returns**: the next push by the root-owned `mcpvault` creates a NEW `objects/XX/` dir whose ACL is inherited from the *parent*, and if the parent's `everyone@`/`group@` lacks `WRITE_DATA` + inherit flags, the new dir is root-owned and read-only again → push fails again. + +Working fix = **full dacl replacement** (not per-ACE edit) with **inheritance flags ON**, applied to every dir: + +```python +# perms granted to owner@ AND group@ AND everyone@: +# READ_DATA WRITE_DATA APPEND_DATA EXECUTE DELETE_CHILD +# READ_ATTRIBUTES WRITE_ATTRIBUTES READ_NAMED_ATTRS WRITE_NAMED_ATTRS +# READ_ACL (and WRITE_ACL WRITE_OWNER DELETE for owner@) +# flags on each ACE: {"FILE_INHERIT": True, "DIRECTORY_INHERIT": True, +# "NO_PROPAGATE_INHERIT": False, "INHERIT_ONLY": False, +# "INHERITED": False} +# call: midclt call filesystem.setacl '' +# options = {"recursive": False, "traverse": True, "stripacl": False} +``` + +**Result:** 291 dirs processed, 0 failures. Note `filesystem.listdir ` to enumerate (same convention as `getacl`), and each `setacl` is async — but 291 sequential dirs finished inside one SSH call (~2 min), no `nohup` needed this time. + +⚠️ **Caveat — the ACL was replaced, not proven functional yet.** The write-test `touch objects/80/.wrtest` was NOT executed (approval timed out). Verification was indirect: `git push nas main` → `Everything up-to-date`, and `git rev-parse HEAD == git rev-parse nas/main` (`177da1e`). That proves the *current* tree is in sync, **not** that a fresh root-owned object can be written. A real `touch` in `objects/80/` as uid 950 is still the definitive test. + **Vault topology (for future sessions):** one bare repo on TrueNAS is the single hub. Mac pushes/pulls remote **`nas`**; Kraken uses remote **`origin`** — both point at `ssh://truenas_admin@mallexxx.duckdns.org/mnt/RED_2TB/storage/git/obsidian-vault.git`. Mac and Kraken never talk directly. Host `truenas` does **not** resolve as an SSH alias from the Mac — use `truenas_admin@mallexxx.duckdns.org`. ## Docker network persistency (per-service compose)