From f69a00c773e7cf539882c793ab46ce00f34df17c Mon Sep 17 00:00:00 2001 From: opencode Date: Sat, 19 Sep 2026 16:03:20 +0200 Subject: [PATCH] fix: run desfoto deploy compose commands as the directory owner The live directory /home/denny/stacks/desfoto belongs to denny, but the SSH deploy identity cannot traverse /home/denny (0750). Run the directory change and the compose command together under the owning identity via 'sudo -n -u denny bash -c' instead of a bare 'cd' as the SSH user. Applies to the deploy, the stack teardown and both rollback paths. --- .ocauto/deploy | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.ocauto/deploy b/.ocauto/deploy index 42983f2..0679efc 100755 --- a/.ocauto/deploy +++ b/.ocauto/deploy @@ -39,12 +39,11 @@ if [ "$release_sha" = "rollback" ]; then sudo cp '$target/nginx.conf' '$live_dir/nginx.conf' sudo cp '$target/compose.yml' '$live_dir/compose.yml' sudo cp '$target/compose.vps.yml' '$live_dir/compose.vps.yml' - cd '$live_dir' - sudo docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans + sudo -n -u denny bash -c \"cd '$live_dir' && docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans\" else echo '[deploy] initial-state snapshot: removing the desfoto stack again' if sudo test -d '$live_dir'; then - ( cd '$live_dir' && sudo docker compose -f compose.yml -f compose.vps.yml down --remove-orphans ) + sudo -n -u denny bash -c \"cd '$live_dir' && docker compose -f compose.yml -f compose.vps.yml down --remove-orphans\" fi fi if sudo test -f '$target/docker-compose.yml.stack-backup'; then @@ -99,9 +98,10 @@ sudo chown -R denny:denny "$LIVE_DIR" sudo rm -f "$archive" printf '%s\n' "$REMOTE_SHA" | sudo tee "$LIVE_DIR/RELEASE" >/dev/null -# 3. Start or update the stack. -cd "$LIVE_DIR" -sudo docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans +# 3. Start or update the stack. The live directory belongs to denny and the SSH +# login cannot traverse /home/denny, so the directory change and the compose +# command run together in one shell under the owning identity. +sudo -n -u denny bash -c "cd '$LIVE_DIR' && docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans" # 4. Wait for the container health check. for _ in $(seq 1 30); do