Omar Sobh
8f29cf8e44
Move the running stack off root ownership. The systemd service now runs as User=clawmates:clawmates with WorkingDirectory=/opt/clawmates, and the script's COMPOSE_DIR default follows. This closes the "rootful compose stack" ask from the original ship-readiness audit — deploys no longer require any part of the pipeline to run as root beyond docker access (the clawmates user gets that via the docker group). Docker-managed volumes (pgdata, broker_run, broker_key, brains, filedata) stay put; the compose project name is unchanged so docker resolves them to the same physical volumes. The old /root/clawmates directory stays in place as an emergency rollback for a week, then gets removed as follow-up.
15 lines
323 B
Desktop File
15 lines
323 B
Desktop File
[Unit]
|
|
Description=Clawmates rolling deploy (pull :latest, roll on drift)
|
|
Wants=docker.service
|
|
After=docker.service network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
User=clawmates
|
|
Group=clawmates
|
|
WorkingDirectory=/opt/clawmates
|
|
ExecStart=/usr/local/bin/clawmates-deploy.sh
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
Nice=10
|