From 6555ed2fed668e8ab9cb267b96fef0c205bb81b6 Mon Sep 17 00:00:00 2001 From: rob thijssen Date: Wed, 8 Jul 2026 14:40:02 +0300 Subject: [PATCH] fix(infra): allow modelwatch rsync + restorecon in the deploy sudoers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The scoped /etc/sudoers.d/newsfeed_gitea_ci allowlist only permitted rsync of the api/worker binaries + their configs and a fixed restorecon command. The modelwatch deploy adds a newsfeed-modelwatch binary, a modelwatch.toml, and an extra restorecon path, so `sudo rsync … /usr/local/bin/newsfeed-modelwatch` was refused ("a password is required") and deploy-api failed (rsync code 12). Add the two rsync destinations and extend the restorecon rule to match deploy.yml. As with any new deploy touchpoint, infra-setup.sh must be re-run on the API host (to push the updated sudoers) before the next deploy can succeed. Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP --- script/infra-setup.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/script/infra-setup.sh b/script/infra-setup.sh index 674b3a2..f693683 100755 --- a/script/infra-setup.sh +++ b/script/infra-setup.sh @@ -75,16 +75,18 @@ SUDOERS " } -API_SUDOERS='# Scoped deploy permissions for newsfeed api+worker on this host. +API_SUDOERS='# Scoped deploy permissions for newsfeed api+worker+modelwatch on this host. gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /usr/local/bin/newsfeed-api gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /usr/local/bin/newsfeed-worker +gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /usr/local/bin/newsfeed-modelwatch gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /etc/newsfeed/config.toml gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /etc/newsfeed/worker.toml +gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /etc/newsfeed/modelwatch.toml gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl daemon-reload gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl restart newsfeed-api.service gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl restart newsfeed-worker.service gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl is-active newsfeed-api.service -gitea_ci ALL=(root) NOPASSWD: /usr/sbin/restorecon -R /usr/local/bin/newsfeed-api /usr/local/bin/newsfeed-worker /etc/newsfeed /var/lib/newsfeed' +gitea_ci ALL=(root) NOPASSWD: /usr/sbin/restorecon -R /usr/local/bin/newsfeed-api /usr/local/bin/newsfeed-worker /usr/local/bin/newsfeed-modelwatch /etc/newsfeed /var/lib/newsfeed' WEB_SUDOERS='# Scoped deploy permissions for the newsfeed SPA on the oolon proxy. gitea_ci ALL=(root) NOPASSWD: /usr/bin/rsync * /var/www/newsfeed/