Skip to content

Reddit archive reader access — 2026-10-29

TL;DR

The production native probe failed with PermissionError for app UID/GID 10001:10001, groups [10001], reading a published NAS file owned by 1032:100, mode 0640. Source adds supplementary GID 100 only to web, Property and media, preserving the existing read-only media library mount and non-root identities. The parent is verifying the supplementary-group probe and releasing web via a private override; this task does not claim live success or broader source application, and workers remain stopped.

Phase status

Workstream Status
Capacity PR #533 Merged before this task; capacity worktree preserved
Reader access source Three role-scoped group additions; no deployment-hold changes
Media library bind Already on fresh main via PR #514; read-only mount/environment retained
Parent live verification Supplementary-GID probe being verified; result not supplied here
Automation reconciliation Pending owner-approved application and effective-config verification

No PLAN phase is closed; PLAN.md is unchanged. This is a separate access PR, not more capacity work or an application change.

Source change and safety boundaries

  • group_add: ["100"] applies only to reddit-explorer, reddit-explorer-property-worker, and reddit-explorer-media-worker. UID/primary GID remain 10001:10001. No added privilege, capabilities, host group changes, NAS ACL changes, or group for the existing stills initializer.
  • Media keeps /mnt/whrrr-reddit-library → /library read-only, rslave, and REDDIT_EXPLORER_ARCHIVE_LIBRARY=/library; /data stays read-only and /stills writable. Existing web/Property mounts are unchanged. No broader NAS mount scope.
  • Reader credentials do not change: no new SSH key/trust for web/media; the existing Property writer key remains scoped to that role.
  • Published 0640 group-100 files are group-readable when parent traversal and NAS enforcement permit. Known 0700 private paths remain unreadable to UID 10001; supplementary membership is not an ACL or owner-permission bypass. It may grant existing group permissions on other already-mounted content, so group scope is deliberate and limited to the three app roles.

See the service README. Regression checks cover exactly the three supplementary memberships, non-root identities, unchanged shared env-file/hold behavior, existing reader bind modes, and absence of reader SSH credentials.

Live override is not global source acceptance

The owner reports web is being released through a private host override with GID 100 and hold 0; the shared worker environment remains hold 1, and both workers are still stopped. Parent verification of the GID-100 probe is in progress, not a result produced by this task. No source hold semantics, env precedence, role commands, or restart/deployment logic are changed here.

Keep the override until approved automation reconciliation verifies the reviewed source and effective role groups/mounts/holds. Only then remove redundant group configuration deliberately; do not drop a whole override containing the deliberate web hold setting or propagate hold 0 into the shared worker env. Worker/canary activation and containment release are separate approvals, not consequences of this PR. Source rollback can restore the file-read failure; no NAS modes change.

Isolation and validation

PR #533 was confirmed merged before creating fix/reddit-archive-reader-access in a separate worktree from freshly fetched main 9818053. The dirty original checkout and existing capacity worktree/branch are preserved. Prior media-library support PR #514 is already on main; this change preserves it rather than duplicating it.

Validation is scoped to safe-fixture Compose rendering (no daemon operations), relevant deployment tests, docs lint/structure, and staged hooks/secret checks. The PR records exact commands/results. No live operations, app edits, container starts, NAS permission changes, deployment, or merge were performed by this task.

What remains

  • Parent/operator, before access acceptance: supply the same native probe with supplementary GID 100 showing published-file read success and private-path denial.
  • Owner/operator, before removing private group override: reconcile only under explicit approval; verify effective groups, read-only reader mounts/no key and web/worker hold separation. Keep workers stopped until separately authorized.
  • Maintainer, before merge: review the focused diff and exact-head CI; this task does not merge or claim globally applied source.
flowchart TD
    A[Published NAS file 1032:100 mode 0640] --> B[App groups lack 100 and read fails]
    B --> C[Source adds group 100 to three app roles only]
    C --> D[Parent verifies probe with private host override]
    D --> E[Owner-approved automation reconciliation pending]
    E --> F[Verify groups mounts and role-specific holds]
    F --> G[Retire only redundant group override]