DCD-224: Refactor installer role to work around various quirks.

roles/jira_config/molecule/default/playbook.yml

@@ -12,5 +12,5 @@
   roles:
     - role: linux_common
     - role: product_common
-    - role: tgz_download
+    - role: installer_download
     - role: jira_config

roles/jira_config/molecule/default/tests/test_default.py

@@ -43,3 +43,11 @@ def test_server_file(host):
     assert f.contains('scheme="http"')
     assert not f.contains('proxyName=')
     assert not f.contains('proxyPort=')
+
+def test_install_permissions(host):
+    assert host.file('/opt/atlassian/jira-software/current/conf/server.xml').user == 'root'
+    assert host.file('/opt/atlassian/jira-software/current/atlassian-jira/WEB-INF/web.xml').user == 'root'
+
+    assert host.file('/opt/atlassian/jira-software/current/logs/').user == 'root'
+    assert host.file('/opt/atlassian/jira-software/current/work/').user == 'root'
+    assert host.file('/opt/atlassian/jira-software/current/temp/').user == 'root'

roles/jira_config/tasks/main.yml

@@ -29,7 +29,6 @@
     - 'JVM_MINIMUM_MEMORY'
     - 'JVM_MAXIMUM_MEMORY'
 
-
 - name: Create application directories
   file:
     path: "{{ item }}"
@@ -38,5 +37,35 @@
     owner: "{{ atl_product_user }}"
     group: "{{ atl_product_user }}"
   with_items:
+    - "{{ atl_product_home }}"
     - "{{ atl_product_home_shared }}"
     - "{{ atl_product_shared_plugins }}"
+  changed_when: false  # For Molecule idempotence check
+
+
+- name: Limit permissions on the installation directory
+  file:
+    path: "{{ atl_product_installation_versioned }}"
+    owner: "root"
+    group: "root"
+    mode: "u=rwX,g=rX,o-rwx"
+    recurse: true
+  with_items:
+    - "{{ atl_installer_temp }}"
+    - "{{ atl_product_installation_versioned }}"
+    - "{{ atl_product_version_cache_dir }}"
+  changed_when: false  # For Molecule idempotence check
+
+- name: Grant access to the product working directories
+  file:
+    path: "{{ item }}"
+    state: directory
+    mode: 0750
+    owner: "root"
+    group: "root"
+    recurse: true
+  with_items:
+    - "{{ atl_product_installation_versioned }}/logs"
+    - "{{ atl_product_installation_versioned }}/temp"
+    - "{{ atl_product_installation_versioned }}/work"
+  changed_when: false  # For Molecule idempotence check