From 09f3b6bd72ba84745dd05ea239115deb7da388ef Mon Sep 17 00:00:00 2001
From: NetworkCats <networkcatlol@gmail.com>
Date: Fri, 20 Mar 2026 08:17:36 +0800
Subject: [PATCH] fix(deploy): move HAProxy admin socket to /tmp for correct
 permissions

The named Docker volume created /var/run/haproxy owned by root:root,
preventing the haproxy user (uid 99) from creating the socket file.
---
 deploy/ansible/roles/app/tasks/main.yml                  | 4 ++--
 deploy/ansible/roles/app/templates/docker-compose.yml.j2 | 2 --
 deploy/ansible/roles/app/templates/haproxy.cfg.j2        | 2 +-
 3 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/deploy/ansible/roles/app/tasks/main.yml b/deploy/ansible/roles/app/tasks/main.yml
index 16e9d7c..e93de37 100644
--- a/deploy/ansible/roles/app/tasks/main.yml
+++ b/deploy/ansible/roles/app/tasks/main.yml
@@ -221,7 +221,7 @@
       ansible.builtin.shell: |
         for i in $(seq 1 10); do
           if docker exec rustyip-haproxy sh -c \
-            'echo "set server app/{{ deploy_target }} state ready" | socat stdio unix:/var/run/haproxy/admin.sock' 2>/dev/null; then
+            'echo "set server app/{{ deploy_target }} state ready" | socat stdio unix:/tmp/admin.sock' 2>/dev/null; then
             echo "admin socket command succeeded on attempt $i"
             exit 0
           fi
@@ -293,7 +293,7 @@
       ansible.builtin.shell: |
         for i in $(seq 1 10); do
           if docker exec rustyip-haproxy sh -c \
-            'echo "set server app/{{ current_active }} state ready" | socat stdio unix:/var/run/haproxy/admin.sock' 2>/dev/null; then
+            'echo "set server app/{{ current_active }} state ready" | socat stdio unix:/tmp/admin.sock' 2>/dev/null; then
             echo "admin socket command succeeded on attempt $i"
             exit 0
           fi
diff --git a/deploy/ansible/roles/app/templates/docker-compose.yml.j2 b/deploy/ansible/roles/app/templates/docker-compose.yml.j2
index 1d394c8..f69cedf 100644
--- a/deploy/ansible/roles/app/templates/docker-compose.yml.j2
+++ b/deploy/ansible/roles/app/templates/docker-compose.yml.j2
@@ -9,7 +9,6 @@ services:
       - ./haproxy/haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg:ro
       - ./haproxy/ipv4_domain.lst:/usr/local/etc/haproxy/ipv4_domain.lst:ro
       - ./haproxy/certs:/etc/haproxy/certs:ro
-      - haproxy_run:/var/run/haproxy
 {% if ipv4_domain %}
       - ./haproxy/certs-ipv4:/etc/haproxy/certs-ipv4:ro
 {% endif %}
@@ -65,7 +64,6 @@ services:
       - internal
 
 volumes:
-  haproxy_run:
   db_data_blue:
   db_data_green:
 
diff --git a/deploy/ansible/roles/app/templates/haproxy.cfg.j2 b/deploy/ansible/roles/app/templates/haproxy.cfg.j2
index 23119eb..b067bcb 100644
--- a/deploy/ansible/roles/app/templates/haproxy.cfg.j2
+++ b/deploy/ansible/roles/app/templates/haproxy.cfg.j2
@@ -1,7 +1,7 @@
 global
     log stderr local0 err
     maxconn 10000
-    stats socket /var/run/haproxy/admin.sock mode 660 level admin
+    stats socket /tmp/admin.sock mode 660 level admin expose-fd listeners
     # Performance tuning for high-throughput
     tune.bufsize 16384
     tune.maxrewrite 1024