v0.324.0: the database password comes back with the data (R-1106, R-127b, R-926); restic 0.19.1 (R-1107); R-1108, R-1065, R-1017; dashboard hardening (R-983, R-976)

controller/internal/stacks/samba.go

@@ -258,12 +258,22 @@ func (m *Manager) SetSMBPassword(password string) error {
 	}
 	dir := m.sambaDir()
 	data := m.sambaRenderData(smb)
-	if _, err := m.writeSambaFiles(dir, data); err != nil {
+	changed, err := m.writeSambaFiles(dir, data)
+	if err != nil {
 		return err
 	}
 	// The container must be running to accept smbpasswd. Bringing it up before a password exists is
 	// safe: `security = user` + `map to guest = never` means nothing is reachable until this lands.
-	if !m.sambaIsRunning() {
+	//
+	// R-1108: an ALREADY-running container must also be re-applied when the files changed. A share
+	// added while the password was unset was skipped by reconcileSambaAt (UserSet=false) and lands on
+	// disk only here; smb.conf is a bind-mounted FILE replaced by atomic rename, so the running
+	// container still holds the old inode — only `compose up -d` (which recreates, the share binds
+	// having changed the compose file) applies it. The next reconcile sees "unchanged + running" and
+	// would never do it. Pinned by TestSambaPassword_ShareAddedBeforePasswordIsApplied.
+	running := m.sambaIsRunning()
+	if !running || changed {
+		m.logger.Printf("[INFO] [samba] applying samba stack before password set: shares=%d config_changed=%v was_running=%v", len(data.Shares), changed, running)
 		if err := m.sambaUp(dir); err != nil {
 			return util.MsgError("err.stacks.a_megosztas_szolgaltatas_inditasa_sikertelen", err)
 		}