@@ -53,14 +53,33 @@ while IFS= read -r -d '' path; do
5353 setfacl -m u::rw-,g::r--,g:" $shared_group " :r--,m::r--,o::--- " $path "
5454done < <( find " $TARGET " -path " $data_dir " -prune -o -type f -user " $deploy_user " -print0)
5555
56- # Runtime data is shared read/write between http and deploy. Existing files are
57- # normalized and default ACLs make newly-created paths inherit the same access.
58- sudo -n -u " $runtime_user " find " $data_dir " -type d -exec chmod 2770 {} +
59- sudo -n -u " $runtime_user " find " $data_dir " -type f -exec chmod 0660 {} +
60- sudo -n -u " $runtime_user " setfacl -R -m u::rwX,g::rwX,g:" $shared_group " :rwX,m::rwX,o::--- " $data_dir "
61- sudo -n -u " $runtime_user " find " $data_dir " -type d -exec \
56+ # Runtime data is shared read/write between http and deploy. Normalize paths as
57+ # their actual owner so a file intentionally added by deploy does not make the
58+ # next deployment fail. Default ACLs keep future paths accessible to both.
59+ find " $data_dir " -user " $deploy_user " -exec chgrp " $shared_group " {} +
60+ find " $data_dir " -type d -user " $deploy_user " -exec chmod 2770 {} +
61+ find " $data_dir " -type f -user " $deploy_user " -exec chmod 0660 {} +
62+ find " $data_dir " -user " $deploy_user " -exec \
63+ setfacl -m u::rwX,g::rwX,g:" $shared_group " :rwX,m::rwX,o::--- {} +
64+ find " $data_dir " -type d -user " $deploy_user " -exec \
6265 setfacl -d -m u::rwx,g::rwx,g:" $shared_group " :rwx,m::rwx,o::--- {} +
6366
67+ sudo -n -u " $runtime_user " find " $data_dir " -user " $runtime_user " -exec chgrp " $shared_group " {} +
68+ sudo -n -u " $runtime_user " find " $data_dir " -type d -user " $runtime_user " -exec chmod 2770 {} +
69+ sudo -n -u " $runtime_user " find " $data_dir " -type f -user " $runtime_user " -exec chmod 0660 {} +
70+ sudo -n -u " $runtime_user " find " $data_dir " -user " $runtime_user " -exec \
71+ setfacl -m u::rwX,g::rwX,g:" $shared_group " :rwX,m::rwX,o::--- {} +
72+ sudo -n -u " $runtime_user " find " $data_dir " -type d -user " $runtime_user " -exec \
73+ setfacl -d -m u::rwx,g::rwx,g:" $shared_group " :rwx,m::rwx,o::--- {} +
74+
75+ unexpected_owner=" $( find " $data_dir " ! -user " $deploy_user " ! -user " $runtime_user " -print -quit) "
76+ if [[ -n " $unexpected_owner " ]]; then
77+ echo " unexpected owner beneath data: $unexpected_owner " >&2
78+ stat -c ' %U:%G %a %n' " $unexpected_owner " >&2 || true
79+ echo " repair that path as root, then rerun the deployment" >&2
80+ exit 1
81+ fi
82+
6483# sitemap.xml is runtime-generated but sits outside data.
6584if [[ -e " $TARGET /sitemap.xml" ]]; then
6685 sudo -n -u " $runtime_user " chmod 0660 " $TARGET /sitemap.xml"
0 commit comments