rob thijssen
6555ed2fed
The scoped /etc/sudoers.d/newsfeed_gitea_ci allowlist only permitted rsync of
the api/worker binaries + their configs and a fixed restorecon command. The
modelwatch deploy adds a newsfeed-modelwatch binary, a modelwatch.toml, and an
extra restorecon path, so `sudo rsync … /usr/local/bin/newsfeed-modelwatch`
was refused ("a password is required") and deploy-api failed (rsync code 12).
Add the two rsync destinations and extend the restorecon rule to match deploy.yml.
As with any new deploy touchpoint, infra-setup.sh must be re-run on the API host
(to push the updated sudoers) before the next deploy can succeed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP