From c811144d2b8dcd6829fb1dc5abb8de67aaf09a8e Mon Sep 17 00:00:00 2001 From: isaacclad Date: Sun, 7 Jun 2026 19:43:29 +0000 Subject: [PATCH] Document deploy ownership requirements for Gitea CI. The deploy runner must own the app root so it can update the current symlink without sudo. Co-authored-by: Cursor --- DEPLOY.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/DEPLOY.md b/DEPLOY.md index 5ccbe70..e1111e5 100644 --- a/DEPLOY.md +++ b/DEPLOY.md @@ -33,11 +33,17 @@ Grant the app DB user `SELECT` on `ladilldb.platform_settings` only. ```bash sudo install -d -o deploy -g www-data /var/www/ladill-mini +sudo install -d -o deploy -g www-data /var/www/ladill-mini/{releases,shared} sudo mysql -e "CREATE DATABASE ladill_mini CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;" sudo mysql -e "CREATE USER 'ladill_mini'@'127.0.0.1' IDENTIFIED BY '';" sudo mysql -e "GRANT ALL ON ladill_mini.* TO 'ladill_mini'@'127.0.0.1'; FLUSH PRIVILEGES;" +sudo mysql -e "GRANT SELECT ON ladilldb.platform_settings TO 'ladill_mini'@'127.0.0.1'; FLUSH PRIVILEGES;" ``` +The Gitea deploy runner acts as `deploy`. The app root and `current` symlink must be +owned by `deploy` (not root), or the release switch step will fail with +`sudo: a password is required`. + ## 3. Register OIDC client (platform) ```bash