diff options
| -rwxr-xr-x | scripts/deploy | 34 |
1 files changed, 31 insertions, 3 deletions
diff --git a/scripts/deploy b/scripts/deploy index 6b3d498..6579839 100755 --- a/scripts/deploy +++ b/scripts/deploy @@ -37,12 +37,40 @@ echo "==> Swapping binary..." mv app ${SITE_DIR}/app echo "==> Setting permissions..." -chown -R www-data:www-data ${SITE_DIR} -find ${SITE_DIR} -type d -exec chmod 755 {} + -find ${SITE_DIR} -type f -exec chmod 644 {} + +# Scope permission fixing to the directories this script actually manages. +# +# This previously ran `find ${SITE_DIR} -type f -exec chmod 644 {} +` across the +# whole site directory and then restored +x on ${SITE_DIR}/app alone. That also +# stripped the execute bit from every sub-service binary under +# ${SITE_DIR}/services/, e.g. services/scout/app. Those services keep running +# from their already-open file, so nothing appears to break — until the next +# reboot, when systemd cannot exec them and they fail with 203/EXEC. Scout was +# down for three and a half weeks that way, serving 502s behind /scout/, because +# the failure is invisible until someone opens the page. +for managed in public templates migrations; do + [ -d "${SITE_DIR}/${managed}" ] || continue + chown -R www-data:www-data "${SITE_DIR}/${managed}" + find "${SITE_DIR}/${managed}" -type d -exec chmod 755 {} + + find "${SITE_DIR}/${managed}" -type f -exec chmod 644 {} + +done + +chown www-data:www-data ${SITE_DIR}/app chmod +x ${SITE_DIR}/app chmod 600 ${SITE_DIR}/.env 2>/dev/null || true +# Belt and braces: re-assert +x on every executable the site depends on. Even +# though the blanket chmod above is gone, a missing execute bit here is what an +# outage looks like, and asserting it costs nothing. +# +# The old blanket chmod took out four binaries in one go — services/scout/app, +# services/hawaii/app, bin/claudomator and bin/claude (which claudomator execs +# via --claude-bin). Only ${SITE_DIR}/app survived, because it was the single +# path the script put the bit back on. Both locations are covered here. +for svc_bin in ${SITE_DIR}/services/*/app ${SITE_DIR}/bin/*; do + [ -f "$svc_bin" ] || continue + chmod +x "$svc_bin" +done + echo "==> Starting service..." systemctl start ${SERVICE} sleep 1 |