From 1b8472112cef2f6f7a59eeb4c43682d03eda1db5 Mon Sep 17 00:00:00 2001 From: hellcat Date: Tue, 13 Oct 2026 20:00:56 +0800 Subject: [PATCH] Allow Nginx traversal only to isolated ACME webroot --- scripts/gateway-admin-proxy/deploy.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scripts/gateway-admin-proxy/deploy.py b/scripts/gateway-admin-proxy/deploy.py index 973647c..f40d6d4 100644 --- a/scripts/gateway-admin-proxy/deploy.py +++ b/scripts/gateway-admin-proxy/deploy.py @@ -55,7 +55,9 @@ def main(): os.umask(0o077) subprocess.run(['nginx', '-t'], check=True, capture_output=True) state_path = pathlib.Path('/var/lib/gateway-admin-proxy/state.json') - state_path.parent.mkdir(parents=True, mode=0o700, exist_ok=True) + # Workers need traversal to the ACME webroot; private state stays 0600. + state_path.parent.mkdir(parents=True, mode=0o711, exist_ok=True) + state_path.parent.chmod(0o711) old_state = json.loads(state_path.read_text()) if state_path.exists() else {'files': {}} if old_state.get('role', args.role) != args.role: parser.error('Deployment role differs from existing state') @@ -123,6 +125,7 @@ def main(): temp.chmod(modes[str(path)]) os.replace(temp, path) pathlib.Path(render.ACME).mkdir(parents=True, mode=0o755, exist_ok=True) + pathlib.Path(render.ACME).chmod(0o755) subprocess.run(['nginx', '-t'], check=True, capture_output=True) subprocess.run(['systemctl', 'reload', 'nginx'], check=True) except Exception: