Bendik Aagaard Lynghaug
70a7586471
Deploy / deploy (push) Failing after 27s
sudo needs setuid escalation, which the runner's own unit disables entirely via NoNewPrivileges=yes (unconditionally, independent of any sudoers config - the earlier sudoers.d/deploy-runner grant was never going to work). Caddy reload already works via the runner's existing docker group membership; the service restart now goes through plain systemctl (talks to PID1 over D-Bus, no escalation needed), authorized by a new polkit rule scoped to deploy-runner + app@*.service.