7 files changed, 79 insertions, 28 deletions
diff --git a/roles/jail/tasks/jail_setup.yml b/roles/jail/tasks/jail_setup.yml
index 7920ee4..0b1abad 100644
--- a/roles/jail/tasks/jail_setup.yml
+++ b/roles/jail/tasks/jail_setup.yml
@@ -1,3 +1,54 @@
+- name: "Check for existing data before ZFS volume creation for {{ jail_name }}"
+  shell: |
+    zfs list {{ item.name }} >/dev/null 2>&1 && echo "exists" || \
+    ([ -d "/usr/local/jails/containers/{{ jail_name }}{{ item.mountpoint }}" ] && \
+     [ "$(ls -A /usr/local/jails/containers/{{ jail_name }}{{ item.mountpoint }})" ] && \
+     echo "migrate" || echo "empty")
+  loop: "{{ zfs | default([]) }}"
+  loop_control:
+    label: "{{ item.name }}"
+  register: _zfs_volume_state
+  changed_when: false
+  delegate_to: "{{ jail_delegate_host }}"
+
+- name: "*** VOLUME MIGRATION REQUIRED: {{ jail_name }} ***"
+  pause:
+    prompt: |
+
+      ════════════════════════════════════════════════════════════════
+        VOLUME MIGRATION: {{ jail_name }}
+      ════════════════════════════════════════════════════════════════
+        The following paths contain data that will be migrated
+        to new ZFS volumes:
+      {% for result in _zfs_volume_state.results | default([]) if result.stdout == 'migrate' %}
+          - {{ result.item.mountpoint }} → {{ result.item.name }}
+      {% endfor %}
+
+        This will:
+          1. Stop the jail
+          2. Move existing data to {{ result.item.mountpoint }}.migrate
+          3. Create ZFS volumes
+          4. Copy data into the volumes
+      ════════════════════════════════════════════════════════════════
+
+      Press Enter to continue or Ctrl+C to abort
+  when: (_zfs_volume_state.results | default([]) | selectattr('stdout', 'equalto', 'migrate') | list | length) > 0
+
+- name: "Stop {{ jail_name }} jail for volume migration"
+  shell: "service jail stop {{ jail_name }} || true"
+  when: (_zfs_volume_state.results | default([]) | selectattr('stdout', 'equalto', 'migrate') | list | length) > 0
+  delegate_to: "{{ jail_delegate_host }}"
+
+- name: "Move existing data aside for {{ jail_name }}"
+  shell: |
+    mv "/usr/local/jails/containers/{{ jail_name }}{{ item.item.mountpoint }}" \
+       "/usr/local/jails/containers/{{ jail_name }}{{ item.item.mountpoint }}.migrate"
+  loop: "{{ _zfs_volume_state.results | default([]) }}"
+  loop_control:
+    label: "{{ item.item.name }}"
+  when: item.stdout == "migrate"
+  delegate_to: "{{ jail_delegate_host }}"
+
 - name: "Create ZFS volumes for {{ jail_name }}"
   community.general.zfs:
     name: "{{ item.name }}"
@@ -13,9 +64,9 @@
   file:
     path: "/usr/local/jails/containers/{{ jail_name }}{{ item.mountpoint }}"
     state: directory
-    owner: root
-    group: wheel
-    mode: "0755"
+    owner: "{{ item.owner | default('root') }}"
+    group: "{{ item.group | default('wheel') }}"
+    mode: "{{ item.mode | default('0755') }}"
   loop: "{{ zfs | default([]) }}"
   loop_control:
     label: "{{ item.mountpoint }}"
@@ -29,6 +80,24 @@
   changed_when: false
   delegate_to: "{{ jail_delegate_host }}"
 
+- name: "Restore migrated data into ZFS volumes for {{ jail_name }}"
+  shell: |
+    cp -a "/usr/local/jails/containers/{{ jail_name }}{{ item.item.mountpoint }}.migrate/." \
+          "/usr/local/jails/containers/{{ jail_name }}{{ item.item.mountpoint }}/"
+  loop: "{{ _zfs_volume_state.results | default([]) }}"
+  loop_control:
+    label: "{{ item.item.name }}"
+  when: item.stdout == "migrate"
+  delegate_to: "{{ jail_delegate_host }}"
+
+- name: "Note: .migrate directories left as backup for {{ jail_name }}"
+  debug:
+    msg: "Data migrated from {{ item.item.mountpoint }}.migrate — verify and remove manually"
+  loop: "{{ _zfs_volume_state.results | default([]) }}"
+  loop_control:
+    label: "{{ item.item.name }}"
+  when: item.stdout == "migrate"
+
 # Host-side setup (runs on the jail host via SSH)
 - name: "Check if {{ jail_name }} container exists"
   shell: "zfs list -o name | grep -Fxq 'zroot/jails/containers/{{ jail_name }}'"
diff --git a/roles/jails/02_postgres/defaults/main.yml b/roles/jails/02_postgres/defaults/main.yml
index d16d128..fa18195 100644
--- a/roles/jails/02_postgres/defaults/main.yml
+++ b/roles/jails/02_postgres/defaults/main.yml
@@ -4,6 +4,9 @@ devfs_ruleset: 5
 zfs:
   - name: zroot/jails/volumes/postgres_data
     mountpoint: /var/db/postgres
+    owner: "770"
+    group: "770"
+    mode: "0755"
 
 jail_conf_options:
   - "allow.raw_sockets"
diff --git a/roles/jails/02_postgres/tasks/main.yml b/roles/jails/02_postgres/tasks/main.yml
index 81d357a..8ce0864 100644
--- a/roles/jails/02_postgres/tasks/main.yml
+++ b/roles/jails/02_postgres/tasks/main.yml
@@ -7,15 +7,6 @@
     path: /var/db/postgres/data18/PG_VERSION
   register: _pg_data
 
-- name: Set postgres data directory ownership
-  file:
-    path: /var/db/postgres
-    state: directory
-    owner: postgres
-    group: postgres
-    mode: "0755"
-  when: not _pg_data.stat.exists
-
 - name: Initialize database
   shell: /usr/local/etc/rc.d/postgresql initdb
   when: not _pg_data.stat.exists
diff --git a/roles/jails/14_freshrss/defaults/main.yml b/roles/jails/14_freshrss/defaults/main.yml
index 5a55d8f..a8c3b54 100644
--- a/roles/jails/14_freshrss/defaults/main.yml
+++ b/roles/jails/14_freshrss/defaults/main.yml
@@ -3,6 +3,8 @@ userland: "15.0-RELEASE"
 zfs:
   - name: zroot/jails/volumes/freshrss_data
     mountpoint: /usr/local/FreshRSS/data
+    owner: "80"
+    group: "80"
 
 pkg:
   - nginx
diff --git a/roles/jails/14_freshrss/tasks/main.yml b/roles/jails/14_freshrss/tasks/main.yml
index 9cc08fc..50b8e7c 100644
--- a/roles/jails/14_freshrss/tasks/main.yml
+++ b/roles/jails/14_freshrss/tasks/main.yml
@@ -12,14 +12,6 @@
   register: _freshrss_download
   changed_when: "'constants.php' not in _freshrss_download.cmd"
 
-- name: Set FreshRSS data ownership
-  file:
-    path: /usr/local/FreshRSS/data
-    state: directory
-    owner: www
-    group: www
-    recurse: true
-
 - name: Create php-fpm socket directory
   file:
     path: /var/run/php
diff --git a/roles/jails/17_syncthing/defaults/main.yml b/roles/jails/17_syncthing/defaults/main.yml
index a6c0f29..27ec9ff 100644
--- a/roles/jails/17_syncthing/defaults/main.yml
+++ b/roles/jails/17_syncthing/defaults/main.yml
@@ -11,6 +11,8 @@ nullfs:
 zfs:
   - name: zroot/jails/volumes/syncthing_config
     mountpoint: /usr/local/etc/syncthing
+    owner: "1001"
+    group: "1001"
 
 pkg:
   - syncthing
diff --git a/roles/jails/17_syncthing/tasks/main.yml b/roles/jails/17_syncthing/tasks/main.yml
index 4575308..91eb61c 100644
--- a/roles/jails/17_syncthing/tasks/main.yml
+++ b/roles/jails/17_syncthing/tasks/main.yml
@@ -10,14 +10,6 @@
   shell: pw groupmod syncthing -g 1001 || true
   changed_when: false
 
-- name: Fix syncthing config ownership
-  file:
-    path: /usr/local/etc/syncthing
-    state: directory
-    owner: syncthing
-    group: syncthing
-    recurse: true
-
 - import_role:
     name: jail
     tasks_from: jail_launch