redis: config directory must be owned by the user that runs the service

… to be able to write tmp config files in it

CHANGELOG.md

@@ -21,6 +21,7 @@ The **patch** part changes is incremented if multiple releases happen the same m
 
 * haproxy: make it so that munin doesn't break if there is a non default `haproxy_stats_path`
 * varnish: make `-j <jail_config>` the first argument on jessie/stretch as it has to be the first argument there.
+* redis: config directory must be owned by the user that runs the service (to be able to write tmp config files in it)
 
 ### Removed
 

redis/tasks/default-server.yml

@@ -11,6 +11,15 @@
   tags:
     - redis
 
+- name: Config directory permissions are set
+  file:
+    dest: "{{ redis_conf_dir }}"
+    mode: "0750"
+    owner: redis
+    group: redis
+  tags:
+    - redis
+
 - name: Redis is running and enabled on boot.
   systemd:
     name: "{{ redis_systemd_name }}"

redis/tasks/instance-server.yml

@@ -28,9 +28,9 @@
 - name: "Instance '{{ redis_instance_name }}' config directory is present"
   file:
     dest: "{{ redis_conf_dir }}"
-    mode: "0755"
-    owner: "root"
-    group: "root"
+    mode: "0750"
+    owner: "redis-{{ redis_instance_name }}"
+    group: "redis-{{ redis_instance_name }}"
     follow: yes
     state: directory
   tags:
@@ -39,9 +39,9 @@
 - name: "Instance '{{ redis_instance_name }}' config hooks directories are present"
   file:
     dest: "{{ _dir }}"
-    mode: "0755"
-    owner: "root"
-    group: "root"
+    mode: "0750"
+    owner: "redis-{{ redis_instance_name }}"
+    group: "redis-{{ redis_instance_name }}"
     follow: yes
     state: directory
   loop: