DarkSingularity/ds-chat
Private
Public Access
3
0
Fork 0
Code Releases 4 Activity

Fix sudoers rule not matching upgrade.sh's actual systemctl status call

Browse Source 
The NOPASSWD rule from 3f only covered the bare `systemctl status
ds-chat` with no arguments, but deploy/upgrade.sh actually calls it with
`--no-pager -l`. Sudoers matches commands on the exact argument string
unless a wildcard is present, so the extra flags fell through to a
password prompt on every upgrade run -- one that can never actually be
satisfied, since ds-chat correctly has no password at all (a nologin
system account). Added a wildcarded pattern alongside the exact one so
upgrade.sh's real invocation matches.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
ksmith
2026-08-15 23:15:09 -06:00
co-authored by Claude Sonnet 5
parent 691f597597
commit caeff5d6f0
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
DEPLOYMENT.md
+10 -1
View File
@@ -254,12 +254,21 @@ curl -s http://127.0.0.1:8000/api/health # expect {"status":"ok"}
### 3f. Let `ds-chat` restart its own service (needed for `deploy/upgrade.sh`) ### 3f. Let `ds-chat` restart its own service (needed for `deploy/upgrade.sh`)
```bash ```bash
echo 'ds-chat ALL=(root) NOPASSWD: /usr/bin/systemctl restart ds-chat, /usr/bin/systemctl status ds-chat' \ echo 'ds-chat ALL=(root) NOPASSWD: /usr/bin/systemctl restart ds-chat, /usr/bin/systemctl status ds-chat, /usr/bin/systemctl status ds-chat *' \
| sudo tee /etc/sudoers.d/ds-chat | sudo tee /etc/sudoers.d/ds-chat
sudo chmod 0440 /etc/sudoers.d/ds-chat sudo chmod 0440 /etc/sudoers.d/ds-chat
sudo visudo -cf /etc/sudoers.d/ds-chat # validates syntax before it's live sudo visudo -cf /etc/sudoers.d/ds-chat # validates syntax before it's live
``` ```
The third pattern (`... status ds-chat *`) matters, not just the bare one:
`deploy/upgrade.sh` actually calls `systemctl status ds-chat --no-pager -l`,
and sudoers matches commands on the *exact* argument string unless a
wildcard is present — the bare `status ds-chat` entry alone doesn't cover
those extra flags, so without this it silently falls back to a password
prompt on every upgrade. Since `ds-chat` has no password (correctly — it's
a `nologin` system account), that prompt can never actually be satisfied,
only worked around with Ctrl+C after the (already-succeeded) upgrade.
### 3g. Firewall ### 3g. Firewall
Only Nginx Proxy Manager's address may reach port 8000: Only Nginx Proxy Manager's address may reach port 8000: