From c0f61166a0895b45aaae9eafa91ad8dd2fad7c77 Mon Sep 17 00:00:00 2001 From: thanhnv Date: Wed, 1 Jul 2026 22:09:53 +0900 Subject: [PATCH] fix(ci): self-heal mysql env-file read access in deploy preflight MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit docker compose reads env_file client-side as the deploy user (ubuntu), so the root-managed /opt/webapps/webapp-mysql.env (mode 600) caused "open ...: permission denied" at `docker compose up`. Extend the deploy preflight to grant docker-group read (chgrp docker + chmod 640) when the deploy user cannot read it — idempotent, self-heals a rebuilt web VPS. The live VPS file was already fixed out-of-band; this prevents recurrence. Co-Authored-By: Claude Opus 4.8 (1M context) --- .gitea/workflows/ci.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index f3116b6..a6875d2 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -183,6 +183,15 @@ jobs: echo "docker group: adding $USER" sudo usermod -aG docker "$USER" fi + # docker compose reads env_file client-side as this user, so the + # root-managed DB secret must be group-readable by the deploy user. + MYSQL_ENV=/opt/webapps/webapp-mysql.env + if [ -f "$MYSQL_ENV" ] && ! [ -r "$MYSQL_ENV" ]; then + echo "mysql env: granting docker-group read" + sudo chgrp docker "$MYSQL_ENV" && sudo chmod 640 "$MYSQL_ENV" + else + echo "mysql env: readable (or absent)" + fi ' # Prove a NEW session can reach the docker daemon before streaming ~GBs. ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \