From 2dabdf0ae132c3bda8be397bcd5b900c85b4e25b Mon Sep 17 00:00:00 2001 From: Simone Date: Fri, 24 Jul 2026 22:04:17 +0200 Subject: [PATCH] fix(web): backup directory permissions, prevent recurrence /var/lib/ci/backups was root:root because ci-backup-template.service runs as root and mkdir(exist_ok=True) created it before ci-runner ever touched it, so every 7z backup failed with errno=13. Chown to ci-runner:ci-runner + 750, and stop the drift from coming back: the setup script now creates+chmods the dir, and the systemd unit gets an ExecStartPre that (re)installs it with the right owner on every start. --- deploy/systemd/ci-backup-template.service | 7 +++++++ setup-host-linux.sh | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/deploy/systemd/ci-backup-template.service b/deploy/systemd/ci-backup-template.service index 7dbcc48..5575011 100644 --- a/deploy/systemd/ci-backup-template.service +++ b/deploy/systemd/ci-backup-template.service @@ -8,6 +8,13 @@ Type=oneshot User=root EnvironmentFile=/etc/ci/environment WorkingDirectory=/opt/ci/local-ci-cd-system +# This service runs as root (to restart act-runner.service via ExecStopPost), +# but the backups dir is shared with ci-web.service, which runs as ci-runner +# and offers a manual "backup template" action. Guarantee the dir exists owned +# by ci-runner *before* the root-owned backup writes into it, otherwise a first +# root run would create /var/lib/ci/backups as root:root and lock ci-runner +# (the web UI) out with errno=13. Idempotent; -o/-g re-assert ownership. +ExecStartPre=/usr/bin/install -d -o ci-runner -g ci-runner -m 750 /var/lib/ci/backups # --keep-count 1: three generations of Windows templates cost ~195 GB and the # archives were byte-identical between runs (the templates rarely change), so # the extra generations bought nothing. --exclude WinBuildTest: retired test diff --git a/setup-host-linux.sh b/setup-host-linux.sh index 324ff94..c27867f 100755 --- a/setup-host-linux.sh +++ b/setup-host-linux.sh @@ -196,13 +196,13 @@ for pkg in p7zip-full xorriso genisoimage; do done mkdir -p \ - "$CI_ROOT"/{build-vms,artifacts,templates,keys,logs,runner,iso} \ + "$CI_ROOT"/{build-vms,artifacts,templates,backups,keys,logs,runner,iso} \ "$OPT_CI" \ /etc/ci/keys chown -R "$CI_USER:$CI_USER" "$CI_ROOT" "$OPT_CI" chmod 750 "$CI_ROOT" "$OPT_CI" -for d in build-vms artifacts templates keys logs runner iso; do +for d in build-vms artifacts templates backups keys logs runner iso; do chmod 750 "$CI_ROOT/$d" done chmod 700 /etc/ci/keys