Merge pull request #7 from dhawal-ss/codex/z0-linux-reset-fix

Fix Ubuntu Matrix spike config ownership

Author: dhawal-ss

mesh/infra/matrix-spike/setup.ps1

@@ -8,6 +8,9 @@ $spikeRoot = Split-Path -Parent $MyInvocation.MyCommand.Path
 $runtimeRoot = Join-Path $spikeRoot 'runtime'
 $certRoot = Join-Path $runtimeRoot 'certs'
 $synapseImage = 'matrixdotorg/synapse:v1.157.0@sha256:53a686c52cdfca5fdb0adff5ef10b276b1d0971931b09815a9eb6b48d7188a1a'
+$runningOnWindows = [System.Runtime.InteropServices.RuntimeInformation]::IsOSPlatform(
+    [System.Runtime.InteropServices.OSPlatform]::Windows
+)
 
 if ($Reset) {
     Push-Location $spikeRoot
@@ -79,9 +82,29 @@ function Ensure-SynapseConfig {
     New-Item -ItemType Directory -Force -Path $dataPath | Out-Null
     $configPath = Join-Path $dataPath 'homeserver.yaml'
     if (-not (Test-Path -LiteralPath $configPath)) {
-        & docker run --rm -v "${dataPath}:/data" `
-            -e "SYNAPSE_SERVER_NAME=$ServerName" -e SYNAPSE_REPORT_STATS=no `
-            $synapseImage generate
+        $dockerRunArguments = @('run', '--rm')
+        if (-not $runningOnWindows) {
+            $userId = (& id -u).Trim()
+            if ($LASTEXITCODE -ne 0 -or $userId -notmatch '^\d+$') {
+                throw 'Could not determine the Unix user ID for Matrix spike setup'
+            }
+            $groupId = (& id -g).Trim()
+            if ($LASTEXITCODE -ne 0 -or $groupId -notmatch '^\d+$') {
+                throw 'Could not determine the Unix group ID for Matrix spike setup'
+            }
+            $dockerRunArguments += @('--user', "${userId}:${groupId}")
+        }
+        $dockerRunArguments += @(
+            '-v',
+            "${dataPath}:/data",
+            '-e',
+            "SYNAPSE_SERVER_NAME=$ServerName",
+            '-e',
+            'SYNAPSE_REPORT_STATS=no',
+            $synapseImage,
+            'generate'
+        )
+        & docker @dockerRunArguments
         if ($LASTEXITCODE -ne 0) { throw "Failed to generate Synapse config for $ServerName" }
 
         Add-Content -LiteralPath $configPath -Value @"
@@ -141,6 +164,22 @@ allow_public_rooms_over_federation: true
 "@
     }
     Copy-Item -LiteralPath $caCert -Destination (Join-Path $dataPath 'test-ca.crt') -Force
+    if (-not $runningOnWindows) {
+        # Disposable CI only: the host runner owns setup files while Synapse
+        # runs as UID 991. Keep the gitignored runtime mutually accessible so
+        # reset can rewrite it and the container can create its SQLite/media
+        # state. Production homeserver permissions are configured elsewhere.
+        & chmod 0777 $dataPath
+        if ($LASTEXITCODE -ne 0) {
+            throw "Could not grant Synapse write access to $dataPath"
+        }
+        foreach ($runtimeFile in Get-ChildItem -LiteralPath $dataPath -File) {
+            & chmod 0644 $runtimeFile.FullName
+            if ($LASTEXITCODE -ne 0) {
+                throw "Could not grant Synapse read access to $($runtimeFile.FullName)"
+            }
+        }
+    }
 }
 
 Ensure-SynapseConfig -DirectoryName 'hs1' -ServerName 'hs1.mesh.test' -HostPort 8008