From 0b277f56f9759b7c0f0c2919e0098a144e106eef Mon Sep 17 00:00:00 2001
From: "j.w.jonkers" <joris.jonkers@nedap.com>
Date: Mon, 8 Jun 2026 08:26:21 +0200
Subject: [PATCH] media: set UMASK=002 on all linuxserver containers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without UMASK, linuxserver images default to 022, which creates files
as 0644 and directories as 0755. The deploy group is GID 1000 and all
containers run PGID=1000, so the host and container identities align —
but files created inside the Completed/Series/Films trees are not
group-writable.

UMASK=002 makes new files 0664 and directories 0775, matching the
parent directories (0775 deploy:deploy) set by the tmpfiles z-rules.
This ensures Samba (running as a different uid in the deploy group),
the *arr import/delete cycle, and any future group-identity tooling
can all write freely without needing to be the owning UID.

Applies to: qbittorrent, prowlarr (downloads pod), sonarr, radarr,
bazarr.
---
 platform/cluster/flux/apps/media/bazarr/deployment.yaml    | 2 ++
 platform/cluster/flux/apps/media/downloads/deployment.yaml | 4 ++++
 platform/cluster/flux/apps/media/radarr/deployment.yaml    | 2 ++
 platform/cluster/flux/apps/media/sonarr/deployment.yaml    | 2 ++
 4 files changed, 10 insertions(+)

diff --git a/platform/cluster/flux/apps/media/bazarr/deployment.yaml b/platform/cluster/flux/apps/media/bazarr/deployment.yaml
index 1bd7149d..f084444a 100644
--- a/platform/cluster/flux/apps/media/bazarr/deployment.yaml
+++ b/platform/cluster/flux/apps/media/bazarr/deployment.yaml
@@ -30,6 +30,8 @@ spec:
               value: '1000'
             - name: PGID
               value: '1000'
+            - name: UMASK
+              value: '002'
           ports:
             - containerPort: 6767
               name: http
diff --git a/platform/cluster/flux/apps/media/downloads/deployment.yaml b/platform/cluster/flux/apps/media/downloads/deployment.yaml
index febcf7ff..be63973a 100644
--- a/platform/cluster/flux/apps/media/downloads/deployment.yaml
+++ b/platform/cluster/flux/apps/media/downloads/deployment.yaml
@@ -193,6 +193,8 @@ spec:
               value: '1000'
             - name: PGID
               value: '1000'
+            - name: UMASK
+              value: '002'
             - name: TZ
               value: Europe/Amsterdam
             - name: WEBUI_PORT
@@ -341,6 +343,8 @@ spec:
               value: '1000'
             - name: PGID
               value: '1000'
+            - name: UMASK
+              value: '002'
             - name: TZ
               value: Europe/Amsterdam
           ports:
diff --git a/platform/cluster/flux/apps/media/radarr/deployment.yaml b/platform/cluster/flux/apps/media/radarr/deployment.yaml
index 25e1bccf..0076102b 100644
--- a/platform/cluster/flux/apps/media/radarr/deployment.yaml
+++ b/platform/cluster/flux/apps/media/radarr/deployment.yaml
@@ -30,6 +30,8 @@ spec:
               value: '1000'
             - name: PGID
               value: '1000'
+            - name: UMASK
+              value: '002'
           ports:
             - containerPort: 7878
               name: http
diff --git a/platform/cluster/flux/apps/media/sonarr/deployment.yaml b/platform/cluster/flux/apps/media/sonarr/deployment.yaml
index 7a23ef0e..893e7fb0 100644
--- a/platform/cluster/flux/apps/media/sonarr/deployment.yaml
+++ b/platform/cluster/flux/apps/media/sonarr/deployment.yaml
@@ -30,6 +30,8 @@ spec:
               value: '1000'
             - name: PGID
               value: '1000'
+            - name: UMASK
+              value: '002'
           ports:
             - containerPort: 8989
               name: http