From 2e3aff7b178e5d5395ea6f172bc542b6237b6344 Mon Sep 17 00:00:00 2001 From: rob thijssen Date: Fri, 7 Aug 2026 16:25:27 +0300 Subject: [PATCH] fix(infra): drop the proxy web root from bob's restorecon grant MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit sudo matches an argument vector exactly, so the sudoers line and the command the workflow runs have to agree character for character. Moving the dashboard to the proxy shortened the workflow's restorecon to five paths but left the grant listing six, which denies it. /var/www/tireless was never bob's to relabel in any case — the proxy's own grant covers it, and that one is scoped to static files alone. Refs #9 Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_013TxK1CWPkFXqdcXMJ4hVe6 --- script/infra-setup.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/script/infra-setup.sh b/script/infra-setup.sh index be738c9..d0199c3 100755 --- a/script/infra-setup.sh +++ b/script/infra-setup.sh @@ -70,7 +70,7 @@ gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl daemon-reload gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl restart tireless-api.service gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl restart tireless-poller.service gitea_ci ALL=(root) NOPASSWD: /usr/bin/systemctl restart tireless-runner.service -gitea_ci ALL=(root) NOPASSWD: /usr/sbin/restorecon -R /usr/local/bin/tireless-api /usr/local/bin/tireless-worker /usr/local/bin/tireless /etc/tireless /var/lib/tireless /var/www/tireless +gitea_ci ALL=(root) NOPASSWD: /usr/sbin/restorecon -R /usr/local/bin/tireless-api /usr/local/bin/tireless-worker /usr/local/bin/tireless /etc/tireless /var/lib/tireless gitea_ci ALL=(root) NOPASSWD: /usr/sbin/semanage port -l gitea_ci ALL=(root) NOPASSWD: /usr/sbin/semanage port -a -t http_port_t -p tcp ${API_PORT} gitea_ci ALL=(root) NOPASSWD: /usr/bin/firewall-cmd --reload