gitea-admin/CASAN
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): self-heal mysql env-file read access in deploy preflight

Browse Source 
docker compose reads env_file client-side as the deploy user (ubuntu), so
the root-managed /opt/webapps/webapp-mysql.env (mode 600) caused
"open ...: permission denied" at `docker compose up`. Extend the deploy
preflight to grant docker-group read (chgrp docker + chmod 640) when the
deploy user cannot read it — idempotent, self-heals a rebuilt web VPS.
The live VPS file was already fixed out-of-band; this prevents recurrence.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
thanhnv
2026-07-01 22:09:53 +09:00
co-authored by Claude Opus 4.8
parent 82011a0c67
commit c0f61166a0
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+9
View File
@@ -183,6 +183,15 @@ jobs:
echo "docker group: adding $USER" echo "docker group: adding $USER"
sudo usermod -aG docker "$USER" sudo usermod -aG docker "$USER"
fi fi
# docker compose reads env_file client-side as this user, so the
# root-managed DB secret must be group-readable by the deploy user.
MYSQL_ENV=/opt/webapps/webapp-mysql.env
if [ -f "$MYSQL_ENV" ] && ! [ -r "$MYSQL_ENV" ]; then
echo "mysql env: granting docker-group read"
sudo chgrp docker "$MYSQL_ENV" && sudo chmod 640 "$MYSQL_ENV"
else
echo "mysql env: readable (or absent)"
fi
' '
# Prove a NEW session can reach the docker daemon before streaming ~GBs. # Prove a NEW session can reach the docker daemon before streaming ~GBs.
ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \ ssh -i ~/.ssh/deploy_key -o StrictHostKeyChecking=no $WEB_VPS \