From 1bb73aa37ad6cd00c3b1a3f712dfc9bd11590a6a Mon Sep 17 00:00:00 2001 From: Bendik Aagaard Lynghaug Date: Sun, 30 Aug 2026 12:09:14 +0200 Subject: [PATCH] Deploy enables the instance unit A host reboot on 2026-08-30 left the instance down: deploys only ever started it. enable is best-effort until the host's polkit rule grants manage-unit-files to deploy-runner. Co-Authored-By: Claude Fable 5 --- .gitea/workflows/deploy.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 1be0af5..f1c0c77 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -85,9 +85,16 @@ jobs: # No sudo: the runner's unit sets NoNewPrivileges=yes - systemctl # talks to PID1 over D-Bus, authorized by the polkit rule scoped # to deploy-runner + the app@* unit pattern. + # enable: the unit must come back after a host reboot (2026-08-30 a + # reboot left both portal instances down - deploys had only ever + # started them). Needs the manage-unit-files polkit grant; until + # that's on the host the enable is reported and skipped, never a + # failed deploy. - name: Activate and restart run: | ln -sfn "/srv/app/$INSTANCE/releases/$PORTAL_RELEASE" /srv/app/$INSTANCE/current + systemctl enable app@$INSTANCE.service \ + || echo "::warning::could not enable app@$INSTANCE (polkit) - unit will not survive a reboot" systemctl restart app@$INSTANCE.service # Apex and www are separate cookie scopes (no shared Domain