Fix user lingering and pipewire systemd user failures

Create the linger file directly instead of using loginctl enable-linger,
which fails in containers where systemd-logind isn't fully functional.
The linger file at /var/lib/systemd/linger/<user> is what systemd checks
to persist user instances across logouts.

After creating the linger file, explicitly start user@<uid>.service to
boot the user's systemd instance immediately. This creates the D-Bus
session bus socket at /run/user/<uid>/bus, which is required for
systemctl --user to work. Without this, roles like pipewire that manage
user-scoped services fail with "Failed to connect to user scope bus".

This also refactors the user creation to simplify the logic and make the
user.id available for both cases of password or default_password

Co-Authored-By: Claude.ai

1 files changed, 18 insertions, 28 deletions

diff --git a/roles/user/tasks/main.yml b/roles/user/tasks/main.yml
index bc252d88..4831cab8 100644
--- a/roles/user/tasks/main.yml
+++ b/roles/user/tasks/main.yml
@@ -10,7 +10,7 @@
     state: "present"
   loop: "{{ user_groups }}"
 
-- name: "Create user with user_default_password"
+- name: "Create user"
   # noqa var-naming[no-role-prefix] username is more understandable than user_name
   become: true
   ansible.builtin.user:
@@ -18,30 +18,14 @@
     append: true
     create_home: true
     generate_ssh_key: false
-    groups: "{{  user_groups }}"
-    password: "{{ user_default_password }}"
-    shell: "/bin/bash"
-    state: "present"
-    update_password: "on_create"
-  register: user
-  notify: "Require password change"
-  when: not user_password is defined
-
-- name: "Create user with user_password"
-  # noqa var-naming[no-role-prefix] username is more understandable than user_name
-  become: true
-  ansible.builtin.user:
-    name: "{{ username }}"
-    append: true
-    create_home: true
-    generate_ssh_key: false
-    groups: "{{  user_groups }}"
-    password: "{{ user_password }}"
+    groups: "{{ user_groups }}"
+    password: "{{ user_password | default(user_default_password) }}"
     shell: "/bin/bash"
     state: "present"
     update_password: "on_create"
+  register: created_user
+  notify: "{{ [] if user_password is defined else ['Require password change'] }}"
   no_log: true
-  when: user_password is defined
 
 - name: "Create user ssh directory"
   ansible.builtin.file:
@@ -60,11 +44,17 @@
 
 - name: "Enable lingering for user systemd instance"
   become: true
-  ansible.builtin.command:
-    cmd: "loginctl enable-linger {{ username }}"
-    creates: "/var/lib/systemd/linger/{{ username }}"
+  ansible.builtin.file:
+    path: "/var/lib/systemd/linger/{{ username }}"
+    state: "touch"
+    modification_time: "preserve"
+    access_time: "preserve"
+    mode: "0644"
+  when: not ansible_facts['is_chroot']
+
+- name: "Start user systemd instance"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "user@{{ created_user.uid }}.service"
+    state: "started"
   when: not ansible_facts['is_chroot']
-  tags:
-    # This is failing locally, and I can't figure out why
-    # Ignoring it seems to be fairly safe
-    - "molecule-notest"