tenseleyflow/shithub / 8a002e5

Browse files

Allow worker repo shared perms

Authored by mfwolffe <wolffemf@dukes.jmu.edu>
SHA
8a002e530e83cd343af64755c4c2dffacc5e2d2c
Parents
0d477a4
Tree
d1d7ccc

3 changed files

StatusFile+-
M .github/workflows/deploy.yml 1 1
M deploy/redeploy.sh 9 2
M deploy/systemd/shithubd-worker.service 7 1
.github/workflows/deploy.ymlmodified
@@ -87,7 +87,7 @@ jobs:
8787
           DEPLOY_USER: ${{ secrets.DEPLOY_USER }}
8888
         run: |
8989
           ssh -o BatchMode=yes "${DEPLOY_USER}@${DEPLOY_HOST}" \
90
-            'bash /root/src/shithub/deploy/redeploy.sh'
90
+            'cd /root/src/shithub && git fetch --quiet origin trunk && git reset --hard origin/trunk && bash deploy/redeploy.sh'
9191
9292
       # Mirror the just-deployed SHA to the self-hosted shithub.sh
9393
       # instance so anyone reading the source on shithub.sh sees the
deploy/redeploy.shmodified
@@ -14,8 +14,9 @@
1414
 #   1. fast-forward the source tree so deploy/ artifacts (this script,
1515
 #      systemd units, env templates) match the binary that just landed
1616
 #   2. atomically swap /usr/local/bin/shithubd
17
-#   3. apply pending migrations BEFORE restart (forward-compat only)
18
-#   4. restart web + worker, assert is-active
17
+#   3. install app systemd unit templates and daemon-reload
18
+#   4. apply pending migrations BEFORE restart (forward-compat only)
19
+#   5. restart web + worker, assert is-active
1920
2021
 set -euo pipefail
2122
@@ -37,6 +38,12 @@ git reset --hard origin/trunk
3738
 chmod 0755 "$NEW"
3839
 mv -f "$NEW" "$BIN"
3940
41
+install -m 0644 deploy/systemd/shithubd-web.service /etc/systemd/system/shithubd-web.service
42
+install -m 0644 deploy/systemd/shithubd-worker.service /etc/systemd/system/shithubd-worker.service
43
+install -m 0644 deploy/systemd/shithubd-cron.service /etc/systemd/system/shithubd-cron.service
44
+install -m 0644 deploy/systemd/shithubd-cron.timer /etc/systemd/system/shithubd-cron.timer
45
+systemctl daemon-reload
46
+
4047
 # Migrations are usually invoked by the web unit's ExecStartPre, which
4148
 # pulls env from /etc/shithub/web.env. Replicate that here so we apply
4249
 # the schema before the restart instead of mid-startup race.
deploy/systemd/shithubd-worker.servicemodified
@@ -25,7 +25,13 @@ ProtectKernelLogs=yes
2525
 ProtectControlGroups=yes
2626
 RestrictNamespaces=yes
2727
 RestrictRealtime=yes
28
-RestrictSUIDSGID=yes
28
+# RestrictSUIDSGID intentionally OFF: org GitHub imports create repos
29
+# from the worker, and `git init --bare --shared=group` calls chmod g+s
30
+# on the directories it creates so cross-user writes inherit the shared
31
+# group. With RestrictSUIDSGID=yes the kernel returns EPERM and git emits
32
+# "Could not make .../branches/ writable by group", leaving imports
33
+# failed before any fetch occurs.
34
+RestrictSUIDSGID=no
2935
 LockPersonality=yes
3036
3137
 [Install]