6 Commits

Include renames

Author	SHA1	Message	Date
Bendik Aagaard Lynghaug	70a7586471	Drop sudo from the deploy workflow - NoNewPrivileges blocks it outright ... sudo needs setuid escalation, which the runner's own unit disables entirely via NoNewPrivileges=yes (unconditionally, independent of any sudoers config - the earlier sudoers.d/deploy-runner grant was never going to work). Caddy reload already works via the runner's existing docker group membership; the service restart now goes through plain systemctl (talks to PID1 over D-Bus, no escalation needed), authorized by a new polkit rule scoped to deploy-runner + app@*.service.	2026-08-04 20:36:54 +02:00
Bendik Aagaard Lynghaug	634e8dcdfa	Fix Ship release: site-root is project-relative, not CARGO_TARGET_DIR ... cp was looking for the site bundle under $CARGO_TARGET_DIR/site, but site-root = "target/site" in Cargo.toml is resolved relative to the project directory regardless of CARGO_TARGET_DIR - only the plain cargo build outputs (release/, front/) actually move when that's overridden.	2026-08-04 20:31:58 +02:00
Bendik Aagaard Lynghaug	6ac64eeb8f	Redirect cargo-leptos's tool cache out of act-runner-bare's StateDirectory ... wasm-bindgen/wasm-opt binaries cargo-leptos downloads under XDG_CACHE_HOME ended up owned by the kernel's overflow "nobody" uid inside systemd's StateDirectory for this unit - a quirk of that specific path, not anything about our shared-cache setup (CARGO_TARGET_DIR elsewhere is owned correctly). Pointing XDG_CACHE_HOME at our own shared /var/local/leptos-cache sidesteps it; verified with a clean checkout + a from-scratch env matching the workflow's exactly.	2026-08-04 20:30:09 +02:00
Bendik Aagaard Lynghaug	abe13c139c	Give CI its own SCCACHE_SERVER_PORT ... Sharing the default port meant whichever context's server happened to be running (usually the interactive shell's, via rust-analyzer's background cargo checks) silently served the other's build requests too - and since sccache's server writes outputs under its own user, that meant permission-denied for whichever context didn't own it. Separate ports keep the server processes apart; SCCACHE_DIR is what's actually shared, giving real cache hits across both.	2026-08-04 13:30:39 +02:00
Bendik Aagaard Lynghaug	76d101b7a8	Share sccache between manual dev builds and CI ... SCCACHE_DIR/CARGO_TARGET_DIR now point at /var/local/sccache and /var/local/cargo-target, shared with the interactive dev shell via a new `builders` group, instead of the CI job hitting a leftover personal sccache server it had no permission to write build output for.	2026-08-04 13:27:22 +02:00
Bendik Aagaard LynghaugandClaude Sonnet 5	286fdbf67f	Load content from Gitea directly, drop the local clone; add deploy workflow ... load_questions_from_gitea (content.rs) fetches question YAML straight from the questions repo's public Gitea contents API at startup instead of scanning a local directory - one fewer moving part in production (no git clone to keep in sync, no separate questions-repo deploy workflow). Still just an in-memory startup load, same as before - served from RAM for every request, no per-request network call. Verified against the real repo (all 5 questions fetch correctly). CONTENT_DIR is replaced by CONTENT_REPO/CONTENT_BRANCH, defaulting to the real questions repo so local dev needs no env override. Also adds .gitea/workflows/deploy.yml: builds with cargo-leptos, ships the release under /srv/app/uhhm-portal (the generic app@.service deploy layout), writes /etc/app/uhhm-portal.env from this repo's own Actions Variables/Secrets, restarts the service, and drops this app's Caddy routing snippet into services.d/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-31 06:10:06 +02:00