Ownership script shakeup

- Don't touch a file to determine if we need to run
- Instead, check ownership of each location and skip it if we are happy
- Keeping SKIP_CERTBOT_OWNERSHIP flag
- More vebose logging of outcomes

docker/rootfs/etc/s6-overlay/s6-rc.d/prepare/30-ownership.sh

@@ -8,35 +8,53 @@ log_info 'Setting ownership ...'
 # root
 chown root /tmp/nginx
 
-# npm user and group
+locations=(
-chown -R "$PUID:$PGID" /data
+	"/data"
-chown -R "$PUID:$PGID" /etc/letsencrypt
+	"/etc/letsencrypt"
-chown -R "$PUID:$PGID" /run/nginx
+	"/run/nginx"
-chown -R "$PUID:$PGID" /tmp/nginx
+	"/tmp/nginx"
-chown -R "$PUID:$PGID" /var/cache/nginx
+	"/var/cache/nginx"
-chown -R "$PUID:$PGID" /var/lib/logrotate
+	"/var/lib/logrotate"
-chown -R "$PUID:$PGID" /var/lib/nginx
+	"/var/lib/nginx"
-chown -R "$PUID:$PGID" /var/log/nginx
+	"/var/log/nginx"
+	"/etc/nginx/nginx"
+	"/etc/nginx/nginx.conf"
+	"/etc/nginx/conf.d"
+)
 
-# Don't chown entire /etc/nginx folder as this causes crashes on some systems
+chownit() {
-chown -R "$PUID:$PGID" /etc/nginx/nginx
+	local dir="$1"
-chown -R "$PUID:$PGID" /etc/nginx/nginx.conf
+	local recursive="${2:-true}"
-chown -R "$PUID:$PGID" /etc/nginx/conf.d
 
-# Certbot directories - optimized approach
+	local have
-CERT_INIT_FLAG="/opt/certbot/.ownership_initialized"
+	have="$(stat -c '%u:%g' "$dir")"
+	echo -n "  $dir ... "
 
-if [ ! -f "$CERT_INIT_FLAG" ] && [ "$SKIP_CERTBOT_OWNERSHIP" != "true" ]; then
+	if [ "$have" != "$PUID:$PGID" ]; then
-	# Prevents errors when installing python certbot plugins when non-root
+		if [ "$recursive" = 'true' ] && [ -d "$dir" ]; then
-	log_info 'Changing ownership of /opt/certbot directories ...'
+			chown -R "$PUID:$PGID" "$dir"
-	chown "$PUID:$PGID" /opt/certbot /opt/certbot/bin
+		else
+			chown "$PUID:$PGID" "$dir"
+		fi
+		echo "DONE"
+	else
+		echo "SKIPPED"
+	fi
+}
+
+for loc in "${locations[@]}"; do
+	chownit "$loc"
+done
+
+if [ "${SKIP_CERTBOT_OWNERSHIP:-}" != "true" ]; then
+	log_info 'Changing ownership of certbot directories, this may take some time ...'
+	chownit "/opt/certbot" false
+	chownit "/opt/certbot/bin" false
 
 	# Handle all site-packages directories efficiently
 	find /opt/certbot/lib -type d -name "site-packages" | while read -r SITE_PACKAGES_DIR; do
-		chown -R "$PUID:$PGID" "$SITE_PACKAGES_DIR"
+		chownit "$SITE_PACKAGES_DIR"
 	done
-
+else
-	# Create a flag file to skip this step on subsequent runs
+	log_info 'Skipping ownership change of certbot directories'
-	touch "$CERT_INIT_FLAG"
-	chown "$PUID:$PGID" "$CERT_INIT_FLAG"
 fi