SLP_Software/slp-modular-cms
1
0
Fork 0
Code Issues Pull Requests Actions Projects Releases Wiki Activity

Stops mixing gitea-workflow with the generic deploy-user placeholder

Browse Source 
Same account, one name throughout instead of switching partway in.
This commit is contained in:
Sluijsens
2026-07-28 20:08:44 +02:00
parent 366e912e73
commit 25a3de0f1f
2 changed files with 20 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
aidlc-docs/features/gitea-deployment-workflow/operations/deployment/deployment-instructions.md
+9 -8
View File
@@ -45,11 +45,12 @@ it if currently blocked at the `sshd_config` level). This merges the FTP and dep
account — acceptable as a fallback, but worth revisiting later, since it means a website-workspace
author's FTP credential would also be able to run shell commands on the Pi.
The rest of this document uses `<deploy-user>` — substitute the generic account's actual name.
The rest of this document uses `gitea-workflow` as the example account name — rename consistently
if you pick something else.
### 1.3 Enable Lingering (INFRA-U6-01 — do this first, easy to forget)
```bash
sudo loginctl enable-linger <deploy-user>
sudo loginctl enable-linger gitea-workflow
```
Without this, the `systemd --user` service manager is torn down when the deploy SSH session ends,
killing the just-restarted app a few seconds after every successful deploy. This also fixes the
@@ -59,7 +60,7 @@ running independent of any login session.
### 1.4 Directory Skeleton
Deliberately placed under `<deploy-user>`'s **own home directory**, not under
Deliberately placed under `gitea-workflow`'s **own home directory**, not under
`/mnt/storage1/www/html/` — since it's now a separate account from `webadmin`, there is no reason
for the CMS's own release/current/shared structure to live anywhere near the other websites at all,
which directly avoids interfering with them (as you asked in Q2):
@@ -82,7 +83,7 @@ ln -s /mnt/storage1/www/html/slpmodularcms-<env> ~/apps/slpmodularcms-<env>/shar
`deploy-scp.yaml`'s existing logic (`releases/{ts}/wwwroot/web -> ../../../shared/wwwroot-web`)
needs no changes for this — it only ever resolves the symlink chain, it doesn't care how many hops
that chain has. What **does** need attention: `<deploy-user>` needs read + traverse permission on
that chain has. What **does** need attention: `gitea-workflow` needs read + traverse permission on
`/mnt/storage1/www/html/slpmodularcms-<env>/` and its parent directories, which `webadmin` owns.
Simplest fix: put both accounts in a shared group (e.g. `webshared`), `chgrp -R webshared` that
folder, and make sure webadmin's FTP server creates new uploads group-readable (`g+rx`, not just
@@ -199,10 +200,10 @@ change:
|---|---|---|
| `PI_MAIN_ADDRESS` | secret | the Pi's address |
| `PI_MAIN_PORT` | secret | SSH port |
| `PI_MAIN_USERNAME` | secret | `<deploy-user>` — the generic, host-wide deploy account (§ 1.2), **not** `webadmin`; reuse the reference project's if it already has one |
| `PI_MAIN_PASSWORD` | secret | `<deploy-user>`'s password |
| `DEPLOY_PATH_TEST` | variable | `/home/<deploy-user>/apps/slpmodularcms-test` |
| `DEPLOY_PATH_PRODUCTION` | variable | `/home/<deploy-user>/apps/slpmodularcms-production` |
| `PI_MAIN_USERNAME` | secret | `gitea-workflow` — the generic, host-wide deploy account (§ 1.2), **not** `webadmin`; reuse the reference project's if it already has one |
| `PI_MAIN_PASSWORD` | secret | `gitea-workflow`'s password |
| `DEPLOY_PATH_TEST` | variable | `/home/gitea-workflow/apps/slpmodularcms-test` |
| `DEPLOY_PATH_PRODUCTION` | variable | `/home/gitea-workflow/apps/slpmodularcms-production` |
| `SERVICE_NAME_TEST` | variable | `slpmodularcms-test.service` |
| `SERVICE_NAME_PRODUCTION` | variable | `slpmodularcms-production.service` |
| `HEALTH_CHECK_URL_TEST` | variable | `https://test.slpsoftware.nl/health` |