Split host setup into explicit entity actions

actions/tier/chown.py

@@ -0,0 +1,76 @@
+# actions/tier/chown.py
+"""Port of tier/chown — ownership: {tier}/{proj} -> uid:gid; {tier}/shared/{proj} ->
+uid:shared_gid (+sticky); base/node-infra -> root:root. Reads APEX_UID/GID from each .env."""
+import os
+from engine.descriptor import Meta, Arg
+
+METADATA = Meta(summary="Apply tier ownership/permissions from each project's APEX_UID/GID/.env.",
+                args=[Arg("tier1_path", "Path to tier 1", required=False),
+                      Arg("tier2_path", "Path to tier 2", required=False),
+                      Arg("tier3_path", "Path to tier 3", required=False)])
+SHARED_GROUP = "noroot-shared"
+
+def _env_val(path, key):
+    if not os.path.exists(path):
+        return ""
+    with open(os.path.realpath(path), encoding="utf-8") as f:
+        for line in f:
+            line = line.strip()
+            if line.startswith(key + "="):
+                return line.split("=", 1)[1].strip()
+    return ""
+
+def run(ctx, args):
+    log, s = ctx.log, ctx.sys
+    comp = ctx.paths.compositions
+    # Defaults are the TIER ROOTS (compositions/@tierN, bash $ROOT_TIERn) — NOT
+    # ctx.paths.tierN, which is the apex core project's data dir one level deeper.
+    tiers = [os.path.realpath(args.tier1_path or ctx.paths.root_tier1),
+             os.path.realpath(args.tier2_path or ctx.paths.root_tier2),
+             os.path.realpath(args.tier3_path or ctx.paths.root_tier3)]
+
+    cp = s.run(["getent", "group", SHARED_GROUP], check=False, capture=True)
+    if cp.returncode != 0:
+        log.error(f"Shared group '{SHARED_GROUP}' not found. Run tier/useradd first."); raise SystemExit(1)
+
+    log.info("Ensuring base structures owned by root...")
+    for tp in tiers:
+        s.sudo(["chown", "root:root", tp])
+        shared = os.path.join(tp, "shared")
+        if os.path.isdir(shared):       # dir inode only — recursing would clobber
+            s.sudo(["chown", "root:root", shared])  # skipped projects' shared subtrees
+        infra = os.path.join(tp, "node-infra")
+        if os.path.isdir(infra):
+            s.sudo(["chown", "-R", "root:root", infra])
+
+    for proj in sorted(os.listdir(comp)):
+        full = os.path.join(comp, proj)
+        if not os.path.isdir(full) or proj.startswith(".") or proj.startswith("@"):
+            continue
+        # opt-out: .apex-root-owned forces this project's tier data (dir + children,
+        # recursively) to root:root — for services that run as root and reject
+        # non-root-owned data (e.g. seafile-mc). Blocks noroot ownership entirely.
+        if os.path.isfile(os.path.join(full, ".apex-root-owned")):
+            log.info(f"Applying root ownership for {proj} (.apex-root-owned)")
+            for tp in tiers:
+                for d in (os.path.join(tp, proj), os.path.join(tp, "shared", proj)):
+                    if os.path.isdir(d):
+                        s.sudo(["chown", "-R", "root:root", d]); log.success(f"  Owned {d} (root)")
+            continue
+        env_path = os.path.join(full, ".env")
+        uid = _env_val(env_path, "APEX_UID")
+        gid = _env_val(env_path, "APEX_GID")
+        sgid = _env_val(env_path, "APEX_SHARED_GID")
+        if not (uid and gid and sgid):
+            log.warn(f"Incomplete APEX_UID/GID/SHARED_GID for {proj}. Run tier/useradd first. Skipping.")
+            continue
+        log.info(f"Applying permissions for {proj} (UID={uid} GID={gid} SHARED_GID={sgid})")
+        for tp in tiers:
+            pdir = os.path.join(tp, proj)
+            sdir = os.path.join(tp, "shared", proj)
+            if os.path.isdir(pdir):
+                s.sudo(["chown", "-R", f"{uid}:{gid}", pdir]); log.success(f"  Owned {pdir}")
+            if os.path.isdir(sdir):
+                s.sudo(["chown", "-R", f"{uid}:{sgid}", sdir])
+                s.sudo(["chmod", "+t", sdir]); log.success(f"  Owned {sdir} (sticky)")
+    log.success("Permissions applied.")