Skip to content
This repository was archived by the owner on Sep 8, 2026. It is now read-only.

fix(deploy): autodeploy works under systemctl --user + ignores untracked runtime files #190

Merged
github-actions merged 1 commit into from
Aug 13, 2026
Merged

fix(deploy): autodeploy works under systemctl --user + ignores untracked runtime files #190

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions deploy/hermes-agent-autodeploy.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,13 +49,18 @@ StandardOutput=journal
StandardError=journal
SyslogIdentifier=hermes-agent-autodeploy

# --- Hardening (mirrors hermes-gateway.service) ---
# --- Hardening ---
# This subset is safe in BOTH system and rootless `systemctl --user` scopes.
NoNewPrivileges=yes
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
# The capability/kernel/cgroup/SUID directives below are valid only for a
# SYSTEM-level install (root manager). Under `systemctl --user` they fail the
# unit at start with status=218/CAPABILITIES ("Failed to drop capabilities"),
# so they are left commented. Uncomment them for a dedicated-host system unit:
# ProtectKernelTunables=yes
# ProtectKernelModules=yes
# ProtectControlGroups=yes
# RestrictSUIDSGID=yes

[Install]
WantedBy=multi-user.target
13 changes: 9 additions & 4 deletions deploy/hermes-agent-autodeploy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,10 +63,15 @@ if ! flock -n 9; then
exit 0
fi

# Refuse to touch a dirty tree — a local edit means someone is mid-change, and
# a fast-forward could silently discard or conflict with it.
if [ -n "$(git status --porcelain)" ]; then
fail "working tree at $REPO_DIR is dirty; refusing to auto-pull (resolve by hand)"
# Refuse to touch a tree with modified TRACKED files — a local edit means
# someone is mid-change, and a fast-forward could silently discard or conflict
# with it. Untracked files are deliberately ignored: a live gateway writes
# runtime state inside the checkout (e.g. cron/executions.db), which would
# otherwise trip this guard on every host, forever. Untracked files never
# block a fast-forward unless an incoming commit would overwrite one, and git
# errors on that case on its own.
if [ -n "$(git status --porcelain --untracked-files=no)" ]; then
fail "tracked files at $REPO_DIR are modified; refusing to auto-pull (commit/stash by hand)"
fi

git fetch --quiet origin "$BRANCH" || fail "git fetch origin $BRANCH failed"
Expand Down
Loading