denny/desfoto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: run desfoto deploy compose commands as the directory owner

Browse Source 
The live directory /home/denny/stacks/desfoto belongs to denny, but the SSH
deploy identity cannot traverse /home/denny (0750). Run the directory change
and the compose command together under the owning identity via
'sudo -n -u denny bash -c' instead of a bare 'cd' as the SSH user. Applies to
the deploy, the stack teardown and both rollback paths.
This commit is contained in:
opencode
2026-09-19 16:03:20 +02:00
parent 160ec017eb
commit f69a00c773
1 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
.ocauto/deploy
View File

@@ -39,12 +39,11 @@ if [ "$release_sha" = "rollback" ]; then
sudo cp '$target/nginx.conf' '$live_dir/nginx.conf' sudo cp '$target/nginx.conf' '$live_dir/nginx.conf'
sudo cp '$target/compose.yml' '$live_dir/compose.yml' sudo cp '$target/compose.yml' '$live_dir/compose.yml'
sudo cp '$target/compose.vps.yml' '$live_dir/compose.vps.yml' sudo cp '$target/compose.vps.yml' '$live_dir/compose.vps.yml'
cd '$live_dir' sudo -n -u denny bash -c \"cd '$live_dir' && docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans\"
sudo docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans
else else
echo '[deploy] initial-state snapshot: removing the desfoto stack again' echo '[deploy] initial-state snapshot: removing the desfoto stack again'
if sudo test -d '$live_dir'; then if sudo test -d '$live_dir'; then
( cd '$live_dir' && sudo docker compose -f compose.yml -f compose.vps.yml down --remove-orphans ) sudo -n -u denny bash -c \"cd '$live_dir' && docker compose -f compose.yml -f compose.vps.yml down --remove-orphans\"
fi fi
fi fi
if sudo test -f '$target/docker-compose.yml.stack-backup'; then if sudo test -f '$target/docker-compose.yml.stack-backup'; then
@@ -99,9 +98,10 @@ sudo chown -R denny:denny "$LIVE_DIR"
sudo rm -f "$archive" sudo rm -f "$archive"
printf '%s\n' "$REMOTE_SHA" | sudo tee "$LIVE_DIR/RELEASE" >/dev/null printf '%s\n' "$REMOTE_SHA" | sudo tee "$LIVE_DIR/RELEASE" >/dev/null
# 3. Start or update the stack. # 3. Start or update the stack. The live directory belongs to denny and the SSH
cd "$LIVE_DIR" # login cannot traverse /home/denny, so the directory change and the compose
sudo docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans # command run together in one shell under the owning identity.
sudo -n -u denny bash -c "cd '$LIVE_DIR' && docker compose -f compose.yml -f compose.vps.yml up -d --remove-orphans"
# 4. Wait for the container health check. # 4. Wait for the container health check.
for _ in $(seq 1 30); do for _ in $(seq 1 30); do