bug: deploy.sh runs as root but needs to switch to alpha user #137

New issue

Closed

opened 2026-02-27 10:53:39 +00:00 by Zeus · 0 comments

Zeus commented

2026-02-27 10:53:39 +00:00

Collaborator

Bug

The CI deploy workflow SSH's in as root (forced by command= in authorized_keys). The deploy.sh script needs to handle this by switching to the alpha user via sudo -u alpha.

Additionally, the deploy script uses git fetch forgejo main but the systemd service does not load the PPQ_API_KEY environment variable when not started via the env file.

Workarounds Applied

deploy.sh checks whoami and exec's sudo -u alpha if root
Environment loaded from secrets/cobot.env
File ownership must be correct (chown -R alpha:alpha)

Expected

Deploy should handle the root→alpha user switch cleanly and ensure the service restarts with proper environment.

## Bug The CI deploy workflow SSH's in as root (forced by `command=` in authorized_keys). The deploy.sh script needs to handle this by switching to the alpha user via `sudo -u alpha`. Additionally, the deploy script uses `git fetch forgejo main` but the systemd service does not load the PPQ_API_KEY environment variable when not started via the env file. ## Workarounds Applied 1. deploy.sh checks `whoami` and exec's `sudo -u alpha` if root 2. Environment loaded from secrets/cobot.env 3. File ownership must be correct (`chown -R alpha:alpha`) ## Expected Deploy should handle the root→alpha user switch cleanly and ensure the service restarts with proper environment.