fix: ensure root ownership when syncing staged folders

script/deploy.sh

@@ -142,7 +142,16 @@ deploy_api() {
     if (( dry_run )); then
         printf '\033[2m[dry-run]\033[0m rsync staged -> %s:/\n' "$host" >&2
     else
-        rsync -aHAX --rsync-path="sudo rsync" "$stage/" "${host}:/"
+        rsync \
+            --archive \
+            --hard-links \
+            --acls \
+            --xattrs \
+            --numeric-ids \
+            --chown root:root \
+            --rsync-path 'sudo rsync' \
+            "$stage/" \
+            "${host}:/"
     fi
 
     ssh_run "$host" "sudo bash -s" <<'REMOTE_EOF'
@@ -240,7 +249,16 @@ deploy_worker() {
     if (( dry_run )); then
         printf '\033[2m[dry-run]\033[0m rsync staged -> %s:/\n' "$host" >&2
     else
-        rsync -aHAX --rsync-path="sudo rsync" "$stage/" "${host}:/"
+        rsync \
+            --archive \
+            --hard-links \
+            --acls \
+            --xattrs \
+            --numeric-ids \
+            --chown root:root \
+            --rsync-path 'sudo rsync' \
+            "$stage/" \
+            "${host}:/"
     fi
 
     ssh_run "$host" "sudo bash -s" <<'REMOTE_EOF'
@@ -294,8 +312,27 @@ deploy_web() {
     if (( dry_run )); then
         printf '\033[2m[dry-run]\033[0m rsync staged -> %s:/\n' "$host" >&2
     else
-        rsync -aHAX --delete --rsync-path="sudo rsync" "$stage/var/www/rob.tn/" "${host}:/var/www/rob.tn/"
+        rsync \
-        rsync -aHAX --rsync-path="sudo rsync" "$stage/etc/nginx/conf.d/rob.tn.conf" "${host}:/etc/nginx/conf.d/rob.tn.conf"
+            --archive \
+            --hard-links \
+            --acls \
+            --xattrs \
+            --numeric-ids \
+            --chown root:root \
+            --rsync-path 'sudo rsync' \
+            --delete \
+            "$stage/var/www/rob.tn/" \
+            "${host}:/var/www/rob.tn/"
+        rsync \
+            --archive \
+            --hard-links \
+            --acls \
+            --xattrs \
+            --numeric-ids \
+            --chown root:root \
+            --rsync-path 'sudo rsync' \
+            "$stage/etc/nginx/conf.d/rob.tn.conf" \
+            "${host}:/etc/nginx/conf.d/rob.tn.conf"
     fi
 
     ssh_run "$host" "sudo bash -s" <<'REMOTE_EOF'