Skip to content

fix(deploy): create /data/git/.ssh with 0700 before processgit starts #139

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rg4444 merged 1 commit into from
May 23, 2026
Merged

fix(deploy): create /data/git/.ssh with 0700 before processgit starts #139

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion deploy/bootstrap/init-config.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,14 @@ mkdir -p \
/data/gitea/sessions \
/data/gitea/indexers \
/data/git/repositories \
/data/git/lfs
/data/git/lfs \
/data/git/.ssh

@chatgpt-codex-connector chatgpt-codex-connector Bot May 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Run SSH directory provisioning before lock short-circuit

This new /data/git/.ssh creation path only executes when app.ini is regenerated, but the script exits early whenever INSTALL_LOCK=true (deploy/bootstrap/init-config.sh lines 24–27). That means users upgrading from the broken v0.1.2 state (where app.ini already exists and startup failed on missing/invalid .ssh) will still skip these new lines and keep failing at Gitea startup. In practice, the fix works for fresh installs but not for the upgrade/recovery path it is intended to unblock.

Useful? React with 👍 / 👎.


# Gitea's RewriteAllPublicKeys() writes authorized_keys.tmp here on
# every startup (even with zero registered keys, it writes an empty
# file). SSH requires the parent dir to be 0700 owned by the running
# user; otherwise it fails closed with "permission denied".
chmod 0700 /data/git/.ssh

# Generate per-deployment secrets using the bundled gitea binary. These
# are written into the file once and never regenerated — losing them
Expand Down
Loading