PostERG/xamxam
1
0
Fork 0
mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-09-25 01:53:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(deploy): restore www-data ownership after deploy-code to prevent HTTP 500

Browse Source
This commit is contained in:
Pontoporeia
2026-09-18 16:26:49 +02:00
parent 0e009c49d4
commit b1715b210d
4 changed files with 137 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/deployment.md
+16 -8
View File
@@ -104,6 +104,7 @@ If you ever rotate `APP_KEY`, re-encrypt the SMTP password with
| `just deploy-migrate` | Run pending DB migrations on the server |
| `just deploy-env` | Upload `app/.env` (only if the remote `.env` is absent — never overwrites a key) |
| `just deploy-nginx` | Upload + apply + reload nginx config |
| `just deploy-permissions` | Restore `www-data:xamxam` ownership + 2775/664 perms (via `scripts/fix-permissions.sh`, needs sudo) |
| `just deploy-db` | Push local `xamxam.db` → remote (**refuses** if a remote DB already exists) |
| `just deploy-verify-permissions` | Check ownership / permissions on the server |
@@ -182,14 +183,21 @@ Ownership and permissions are applied by `scripts/deploy-server.sh` (run via
- `app/.env`: **640**
`just deploy-code` only rsyncs code (as the SSH/deploy user); it does **not**
set ownership. Ownership is normalised afterwards by `deploy-server.sh`
(`chown -R www-data:xamxam /var/www/xamxam`, setgid dirs, locked DBs). On a
`xamxam` group-writable tree the rsync succeeds, then `deploy-nginx` (within
`just deploy`) fixes ownership/perms. If `deploy-code` reports `Permission
denied` on `storage/` (e.g. a fresh box where the dirs are not yet
`www-data:xamxam` group-writable), re-apply `scripts/setup-server.sh` /
`deploy-server.sh` first, or add `--chown=www-data:xamxam` to the rsync so it
normalises ownership while transferring.
set ownership itself. It therefore finishes by running `just deploy-permissions`
(`scripts/fix-permissions.sh` via sudo) so a standalone `deploy-code` can never
leave the site broken. Ownership is normalised by `deploy-server.sh`
(`chown -R www-data:xamxam /var/www/xamxam`, setgid dirs, locked DBs) too, via
`just deploy-nginx`.
> **Why this matters (HTTP 500):** php-fpm runs as `www-data`. After a plain
> `rsync -az` (run as the deploy user, no `--chown`), synced files/dirs are
> owned by the deploy user, and top-level dirs such as `storage/` lose the
> `www-data` group-write bit. The app opens the SQLite DB in **WAL mode**, so
> www-data must be able to create `xamxam.db-wal` / `xamxam.db-shm` **in**
> `storage/`; without write access there the request fatals → **500**. If this
> ever recurs (e.g. a manual rsync that skipped `deploy-permissions`), run
> `just deploy-permissions` (`sudo chown -R www-data:xamxam` + 2775/664) to
> restore it.
The nginx/`deploy-server.sh` step (`just deploy-nginx`, or
`sudo DEPLOY_USER=$USER bash /tmp/deploy-server.sh` via `just deploy-script`)