configpolicy/roles/homeassistant
Dustin 679ea47bf7 r/homeassistant: Protect ~/.ssh
When the Home Assistant container restarts, Podman relabels the entire
`/var/lib/homeassistant` directory as `container_file_t`.  Since the
*homeassistant* user's home directory is `/var/lib/homeassistant`, its
`~/.ssh` directory is thus also relabeled, preventing the SSH daemon
from accessing it.  Since Home Assistant itself does not need access to
this path, we can tell systemd to mount an empty tmpfs filesystem there
in the service unit's mount namespace.  This way, when Podman relabels
the directory, it will change the label of the tmpfs mount point instead
of the actual directory.
2023-06-08 10:05:36 -05:00
..
defaults r/homeassistant: Proxy for Zigbee2MQTT frontend 2022-12-12 17:47:05 -06:00
files roles/homeassistant: Deploy container with Podman 2021-07-19 13:38:08 -05:00
handlers roles/homeassistant: Install in a virtualenv 2020-07-04 14:25:16 -05:00
tasks Add ability to update HA-related containers 2021-08-12 19:02:34 -05:00
templates r/homeassistant: Protect ~/.ssh 2023-06-08 10:05:36 -05:00
vars roles/homeassistant: Deploy container with Podman 2021-07-19 13:38:08 -05:00