halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions

docs(deploy): the sidecars' root steps name deploy's folders in full

Browse source 
Step 1 of both sidecars changed into deploy's home before its sudo
commands, but Ubuntu closes a home to other users, so the operator's
own user, the one with sudo, gets "Permission denied" there (found
setting up LanguageTool on learn.halkyon.eu's server, 26 Oct). sudo
reaches the folders by their full paths, which the shell makes of
~deploy without entering it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-10-26 12:18:46 +01:00
commit db7f6c0ab2
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 11 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

20
deploy/sidecars/README.md
View file

@ -36,15 +36,18 @@ Steps, in order; ✱ marks a step as root.
sudo): the user and group ID 61096 are Jellyfin's alone, as the compose file runs it sudo): the user and group ID 61096 are Jellyfin's alone, as the compose file runs it
(`useradd` warns that the ID lies above the system range, which is meant: it must (`useradd` warns that the ID lies above the system range, which is meant: it must
not meet a container's IDs); the media folder is `deploy`'s, so it can copy files not meet a container's IDs); the media folder is `deploy`'s, so it can copy files
in, readable by all. in, readable by all. The folders are named in full: `deploy`'s home is closed to
other users (Ubuntu's default), so a user with sudo can't `cd` into it, but `sudo`
reaches it by its path, which the shell makes of `~deploy` without entering it.
```sh ```sh
sudo groupadd --system --gid 61096 jellyfin sudo groupadd --system --gid 61096 jellyfin
sudo useradd --system --uid 61096 --gid 61096 --no-create-home --shell /usr/sbin/nologin jellyfin sudo useradd --system --uid 61096 --gid 61096 --no-create-home --shell /usr/sbin/nologin jellyfin
cd ~deploy/halkyon-learn/deploy sudo mkdir -p ~deploy/halkyon-learn/deploy/jellyfin/config \
sudo mkdir -p jellyfin/config jellyfin/cache jellyfin/media ~deploy/halkyon-learn/deploy/jellyfin/cache ~deploy/halkyon-learn/deploy/jellyfin/media
sudo chown -R jellyfin:jellyfin jellyfin/config jellyfin/cache sudo chown -R jellyfin:jellyfin ~deploy/halkyon-learn/deploy/jellyfin/config \
sudo chown -R deploy:deploy jellyfin/media ~deploy/halkyon-learn/deploy/jellyfin/cache
sudo chown -R deploy:deploy ~deploy/halkyon-learn/deploy/jellyfin/media
``` ```
2. **DNS** (the operator, at the domain's DNS): the Jellyfin domain, such as 2. **DNS** (the operator, at the domain's DNS): the Jellyfin domain, such as
@ -116,14 +119,13 @@ Steps, in order; ✱ marks a step as root.
1. ✱ **Its user and folder** (the operator, on the instance's server, as a user with 1. ✱ **Its user and folder** (the operator, on the instance's server, as a user with
sudo): the user and group ID 61081 are LanguageTool's alone, as the compose file runs sudo): the user and group ID 61081 are LanguageTool's alone, as the compose file runs
it (`useradd` warns that the ID lies above the system range, which is meant: it must it (`useradd` warns that the ID lies above the system range, which is meant: it must
not meet a container's IDs). not meet a container's IDs). The folder is named in full, as Jellyfin's.
```sh ```sh
sudo groupadd --system --gid 61081 languagetool sudo groupadd --system --gid 61081 languagetool
sudo useradd --system --uid 61081 --gid 61081 --no-create-home --shell /usr/sbin/nologin languagetool sudo useradd --system --uid 61081 --gid 61081 --no-create-home --shell /usr/sbin/nologin languagetool
cd ~deploy/halkyon-learn/deploy sudo mkdir -p ~deploy/halkyon-learn/deploy/languagetool/fasttext
sudo mkdir -p languagetool/fasttext sudo chown -R languagetool:languagetool ~deploy/halkyon-learn/deploy/languagetool
sudo chown -R languagetool:languagetool languagetool
``` ```
2. **Switch it on** (the operator, on the instance's server, as `deploy`): in 2. **Switch it on** (the operator, on the instance's server, as `deploy`): in