From 0e595ecc88cc8f4c5e5ee9415269a08a577e02ea Mon Sep 17 00:00:00 2001
From: Ahmed Abdelhalim <pm@a14m.dev>
Date: Wed, 11 Feb 2026 22:28:19 +0100
Subject: Fix user lingering and pipewire systemd user failures

Create the linger file directly instead of using loginctl enable-linger,
which fails in containers where systemd-logind isn't fully functional.
The linger file at /var/lib/systemd/linger/<user> is what systemd checks
to persist user instances across logouts.

After creating the linger file, explicitly start user@<uid>.service to
boot the user's systemd instance immediately. This creates the D-Bus
session bus socket at /run/user/<uid>/bus, which is required for
systemctl --user to work. Without this, roles like pipewire that manage
user-scoped services fail with "Failed to connect to user scope bus".

This also refactors the user creation to simplify the logic and make the
user.id available for both cases of password or default_password

Co-Authored-By: Claude.ai
---
 roles/user/tasks/main.yml | 46 ++++++++++++++++++----------------------------
 1 file changed, 18 insertions(+), 28 deletions(-)

(limited to 'roles')

diff --git a/roles/user/tasks/main.yml b/roles/user/tasks/main.yml
index bc252d88..4831cab8 100644
--- a/roles/user/tasks/main.yml
+++ b/roles/user/tasks/main.yml
@@ -10,7 +10,7 @@
     state: "present"
   loop: "{{ user_groups }}"
 
-- name: "Create user with user_default_password"
+- name: "Create user"
   # noqa var-naming[no-role-prefix] username is more understandable than user_name
   become: true
   ansible.builtin.user:
@@ -18,30 +18,14 @@
     append: true
     create_home: true
     generate_ssh_key: false
-    groups: "{{  user_groups }}"
-    password: "{{ user_default_password }}"
-    shell: "/bin/bash"
-    state: "present"
-    update_password: "on_create"
-  register: user
-  notify: "Require password change"
-  when: not user_password is defined
-
-- name: "Create user with user_password"
-  # noqa var-naming[no-role-prefix] username is more understandable than user_name
-  become: true
-  ansible.builtin.user:
-    name: "{{ username }}"
-    append: true
-    create_home: true
-    generate_ssh_key: false
-    groups: "{{  user_groups }}"
-    password: "{{ user_password }}"
+    groups: "{{ user_groups }}"
+    password: "{{ user_password | default(user_default_password) }}"
     shell: "/bin/bash"
     state: "present"
     update_password: "on_create"
+  register: created_user
+  notify: "{{ [] if user_password is defined else ['Require password change'] }}"
   no_log: true
-  when: user_password is defined
 
 - name: "Create user ssh directory"
   ansible.builtin.file:
@@ -60,11 +44,17 @@
 
 - name: "Enable lingering for user systemd instance"
   become: true
-  ansible.builtin.command:
-    cmd: "loginctl enable-linger {{ username }}"
-    creates: "/var/lib/systemd/linger/{{ username }}"
+  ansible.builtin.file:
+    path: "/var/lib/systemd/linger/{{ username }}"
+    state: "touch"
+    modification_time: "preserve"
+    access_time: "preserve"
+    mode: "0644"
+  when: not ansible_facts['is_chroot']
+
+- name: "Start user systemd instance"
+  become: true
+  ansible.builtin.systemd_service:
+    name: "user@{{ created_user.uid }}.service"
+    state: "started"
   when: not ansible_facts['is_chroot']
-  tags:
-    # This is failing locally, and I can't figure out why
-    # Ignoring it seems to be fairly safe
-    - "molecule-notest"
-- 
cgit v1.2.3