Fixes the account model deploy setup got wrong

webadmin turned out to be FTP-only and belongs to whoever uploads customer websites, not to this pipeline. Switched to a separate deploy account with its own home-directory paths, well away from where the other sites live, and made the persistent website symlink cross into webadmin's territory instead of the other way around.
2026-07-28 19:41:34 +02:00
parent cf80f827ae
commit 2f243f23c3
5 changed files with 157 additions and 20 deletions
@@ -0,0 +1,51 @@
+# Deployment Setup — Clarification Questions
+
+You mentioned `/mnt/storage1/www/html/` as the real path convention, and that `webadmin` (the
+FileZilla account) cannot log in via SSH. `deploy-scp.yaml` (built in U6) needs more than file
+transfer — it runs `mkdir`, `ln -sfn`, `systemctl --user restart`, and the backup script over an SSH
+**shell** command, not just SFTP. That needs a genuinely different kind of access than FileZilla
+uses, so I want to confirm rather than guess.
+
+## Question 1: Which Account Should the Deploy Pipeline Use?
+
+A) `webadmin` is the only account that exists for this Pi's web content — grant it SSH **shell**
+   access (not just SFTP) so the deploy workflow can use it
+B) There's a different, existing account with full SSH shell access already (e.g. whatever the
+   reference `SlpSoftware` project's working pipeline uses) — reuse that one for
+   `PI_MAIN_USERNAME`, keep `webadmin` purely for FileZilla/manual use
+C) Create a brand-new dedicated account for the deploy pipeline, separate from both `webadmin` and
+   whatever the reference project uses
+D) Other (please describe after [Answer]: tag below)
+
+[Answer]: C, dit is het mooiste, maar is dta haalbaar. Anders terugvallen naar optie A
+
+## Question 2: Directory Placement Under `/mnt/storage1/www/html/`
+
+`deployment-instructions.md` currently assumes `~/apps/slpmodularcms-<env>/` as the deploy path —
+that needs to change to match this Pi's real convention. What should the two environments' paths be?
+
+A) `/mnt/storage1/www/html/slpmodularcms-test/` and `/mnt/storage1/www/html/slpmodularcms-production/`
+   — siblings, same naming pattern I already used
+B) A different naming convention is already used for other sites under `html/` — describe the
+   pattern to follow after [Answer]: below
+C) Not sure yet — pick reasonable names, I'll rename if it clashes with something already there
+
+X) Other (please describe after [Answer]: tag below)
+
+[Answer]: X, zou de deploy path niet in de variabelen moeten staan van gitea? En dan vanuit daar bepalen waar de boel komt? Het is eventueel mogelijk een los pad aan te geven naast de html-map zodat het niet in de weg gaat zitten met de (andere) websites
+
+## Question 3: Does `webadmin`'s FileZilla Access Relate to the Website Workspace Contract?
+
+`WEBSITE_WORKSPACE.md` (U7) describes how a separate website-workspace author deploys the public
+site into `wwwroot/web/`. Is `webadmin`/FileZilla actually **that** role — the account a website
+builder uses to upload the customer's site — rather than the account meant to run the CMS's own
+deploy pipeline?
+
+A) Yes — `webadmin` is for website-workspace authors (FTPS into `wwwroot/web/`), completely separate
+   from whatever account runs the CI/CD deploy pipeline
+B) No — `webadmin` was meant to be used for everything, including the CMS deploy pipeline itself
+C) Not decided yet / don't know
+
+X) Other (please describe after [Answer]: tag below)
+
+[Answer]: X, zoals in vraag 1 aangegeven zou het het beste zijn als webadmin is voor het uploaden van websites via filezilla en dat er een apart pipeline gebruiker is.