1 files changed, 31 insertions, 3 deletions
diff --git a/scripts/deploy b/scripts/deploy
index 6b3d498..6579839 100755
--- a/scripts/deploy
+++ b/scripts/deploy
@@ -37,12 +37,40 @@ echo "==> Swapping binary..."
 mv app ${SITE_DIR}/app
 
 echo "==> Setting permissions..."
-chown -R www-data:www-data ${SITE_DIR}
-find ${SITE_DIR} -type d -exec chmod 755 {} +
-find ${SITE_DIR} -type f -exec chmod 644 {} +
+# Scope permission fixing to the directories this script actually manages.
+#
+# This previously ran `find ${SITE_DIR} -type f -exec chmod 644 {} +` across the
+# whole site directory and then restored +x on ${SITE_DIR}/app alone. That also
+# stripped the execute bit from every sub-service binary under
+# ${SITE_DIR}/services/, e.g. services/scout/app. Those services keep running
+# from their already-open file, so nothing appears to break — until the next
+# reboot, when systemd cannot exec them and they fail with 203/EXEC. Scout was
+# down for three and a half weeks that way, serving 502s behind /scout/, because
+# the failure is invisible until someone opens the page.
+for managed in public templates migrations; do
+    [ -d "${SITE_DIR}/${managed}" ] || continue
+    chown -R www-data:www-data "${SITE_DIR}/${managed}"
+    find "${SITE_DIR}/${managed}" -type d -exec chmod 755 {} +
+    find "${SITE_DIR}/${managed}" -type f -exec chmod 644 {} +
+done
+
+chown www-data:www-data ${SITE_DIR}/app
 chmod +x ${SITE_DIR}/app
 chmod 600 ${SITE_DIR}/.env 2>/dev/null || true
 
+# Belt and braces: re-assert +x on every executable the site depends on. Even
+# though the blanket chmod above is gone, a missing execute bit here is what an
+# outage looks like, and asserting it costs nothing.
+#
+# The old blanket chmod took out four binaries in one go — services/scout/app,
+# services/hawaii/app, bin/claudomator and bin/claude (which claudomator execs
+# via --claude-bin). Only ${SITE_DIR}/app survived, because it was the single
+# path the script put the bit back on. Both locations are covered here.
+for svc_bin in ${SITE_DIR}/services/*/app ${SITE_DIR}/bin/*; do
+    [ -f "$svc_bin" ] || continue
+    chmod +x "$svc_bin"
+done
+
 echo "==> Starting service..."
 systemctl start ${SERVICE}
 sleep 1