service: Support setting templated file mode

roles/service/meta/argument_specs.yaml

@@ -150,6 +150,11 @@ argument_specs:
             type: str
             required: false
             default: ""
+          mode:
+            description: Templated file permissions
+            type: str
+            required: false
+            default: "0644"
           volume_device:
             description: >-
               The path of a device which is mounted for the volume.

roles/service/tasks/templates.yaml

@@ -22,6 +22,6 @@
   ansible.builtin.template:
     src: "{{ item[0].source }}"
     dest: "{{ item[1] }}"
-    mode: "0644"
+    mode: "{{ item[0].mode | default('0644') }}"
   notify: Restart container service {{ service_name }}
   loop: "{{ _service_all_template_mounts | zip(_service_all_template_mount_host_files) }}"

roles/service/vars/main/additional.yaml

@@ -39,7 +39,8 @@ _service_additional_container_template_mounts: >-
   {{
     ([{'readonly': true}] * _service_additional_template_mounts | length) |
     zip(
-      _service_additional_template_mounts,
+      _service_additional_template_mounts |
+        community.general.remove_keys(['mode']),
       _service_additional_template_mounts |
         map(attribute='source') |
         map('regex_replace', '\.j2$', '') |

roles/service/vars/main/mounts.yaml

@@ -19,7 +19,8 @@ _service_container_template_mounts: >-
   {{
     ([{'readonly': true}] * _service_template_mounts | length) |
     zip(
-      _service_template_mounts,
+      _service_template_mounts |
+        community.general.remove_keys(['mode']),
       _service_template_mounts |
         map(attribute='source') |
         map('regex_replace', '\.j2$', '') |