mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-09-25 01:53:03 +02:00
14 lines
780 B
Plaintext
14 lines
780 B
Plaintext
# Scoped passwordless sudo for the deploy permission-restore step.
|
|
#
|
|
# `just deploy-permissions` (and thereby `just deploy-code`) resyncs the app
|
|
# tree as the deploy SSH user, then runs `fix-permissions.sh` as root to
|
|
# restore www-data:xamxam ownership. Using an interactive remote pty for that
|
|
# sudo is fragile: `ssh -t` silently drops the pseudo-terminal when the local
|
|
# process stdin is not a TTY, so sudo's password prompt prints but cannot
|
|
# receive keystrokes. Because the script is fixed-path, takes no arguments and
|
|
# only touches /var/www/xamxam, it is safe to whitelist with NOPASSWD.
|
|
#
|
|
# Install via `just deploy-sudoers` (must be run interactively once as a
|
|
# password-lessed sudoer, or with root).
|
|
theophile ALL=(root) NOPASSWD: /bin/bash /tmp/fix-permissions.sh
|