eleven / messenger Public

deploy: ops dev deploy — hand the staging dir back to the ssh user (#1269)

The 2026-07-21 hardening pass root-chowned /opt/lchat (incoming included),
so the verb's plain scp as the box's ssh user started failing with
Permission denied on every stage. The mkdir line now also chowns incoming
to the remote user — the swap that follows is sudo either way, so nothing
privileged moves.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Paul Campbell 3 months ago 9026acc527f0c41dbed7f4d442ab8cb728a6899b parent 3685c1c

1 file changed, +4 −2

deploy/ops-dev.sh +4 −2

diff --git a/deploy/ops-dev.sh b/deploy/ops-dev.sh

index d8639a8..585b046 100755

--- a/deploy/ops-dev.sh

+++ b/deploy/ops-dev.sh

@@ -387,11 +387,13 @@ deploy)

# An SSH hang here usually means you are outside the security group's

# /32 allowlist, not that the box is down: run `ops doctor dev`.

if [ "$t" = ie ]; then

- ssh_ie "$box" 'sudo mkdir -p /opt/lchat/incoming'

+ # The hardening pass roots /opt/lchat — hand the staging dir back to

+ # the ssh user so plain scp can write it (the swap is sudo either way).

+ ssh_ie "$box" 'sudo mkdir -p /opt/lchat/incoming && sudo chown "$(id -un)" /opt/lchat/incoming'

scp_ie -q "$tmp/lchat-$t" "$box:/opt/lchat/incoming/lchat-new"

[ "$with_home" = yes ] && scp_ie -q "$tmp/home-$t" "$box:/opt/lchat/incoming/home-new"

else

- ssh -o ConnectTimeout=10 "$box" 'sudo mkdir -p /opt/lchat/incoming'

+ ssh -o ConnectTimeout=10 "$box" 'sudo mkdir -p /opt/lchat/incoming && sudo chown "$(id -un)" /opt/lchat/incoming'

scp -q "$tmp/lchat-$t" "$box:/opt/lchat/incoming/lchat-new"

[ "$with_home" = yes ] && scp -q "$tmp/home-$t" "$box:/opt/lchat/incoming/home-new"