From 8eec207f2d8e763d72cb3efa82bbfb5510302409 Mon Sep 17 00:00:00 2001 From: Stan Runge Date: Thu, 8 Oct 2026 21:10:21 +0000 Subject: [PATCH] fix: create deployment backups with allowed Docker permissions --- scripts/deploy-remote.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/deploy-remote.sh b/scripts/deploy-remote.sh index 5a4b00c..e21a27b 100644 --- a/scripts/deploy-remote.sh +++ b/scripts/deploy-remote.sh @@ -48,14 +48,14 @@ backup_dir=/var/backups/personal-website backup_stamp=$(date -u +%Y%m%dT%H%M%SZ) backup_name="${environment_name}-${backup_stamp}-${sha}.dump" sudo docker pull "$backup_image" -sudo install -d -m 0700 "$backup_dir" +# The deploy account can run Docker, but has no general host-file sudo access. +# A bind volume creates the root-owned directory; restrict it before dumping. sudo docker run --rm --network backend --env-file "$environment" \ - --mount "type=bind,source=$backup_dir,target=/backups" \ + --volume "$backup_dir:/backups" \ --env "BACKUP_FILE=$backup_name" "$backup_image" \ - sh -eu -c 'pg_dump --format=custom --no-owner --no-acl --file="/backups/$BACKUP_FILE" "$DB_URL"' + sh -eu -c 'chmod 0700 /backups; umask 077; pg_dump --format=custom --no-owner --no-acl --file="/backups/$BACKUP_FILE" "$DB_URL"' sudo docker run --rm --mount "type=bind,source=$backup_dir,target=/backups" \ "$backup_image" pg_restore --list "/backups/$backup_name" >/dev/null -sudo chmod 0600 "$backup_dir/$backup_name" echo "Verified $environment_name database backup at $backup_dir/$backup_name" run_database_script() {