lexton-it/NextWks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

refuse to run under sudo, update README/AGENT.md to match

Browse source
This commit is contained in:
Claus Lohmar 2026-07-11 08:47:54 +01:00
parent b060e23a1d
commit 3df375e047
3 changed files with 16 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
AGENT.md
View file

@ -35,7 +35,7 @@ The old `deploy.sh` and `install.sh` are deprecated.
5. Commit: `git add -A && git commit -m "description"` 5. Commit: `git add -A && git commit -m "description"`
6. Tag: `git tag v$(cat VERSION)` 6. Tag: `git tag v$(cat VERSION)`
7. Push: `git push origin main --tags` 7. Push: `git push origin main --tags`
8. Deploy: `sudo bash ~/nextwks.sh --update` 8. Deploy: `./nextwks.sh --update` (no sudo — script handles it per-command)
> **Note:** The deploy script is downloaded by users via `curl` from the repo. For production deployment, users run: > **Note:** The deploy script is downloaded by users via `curl` from the repo. For production deployment, users run:
> ```bash > ```bash

10
README.md
View file

@ -31,8 +31,8 @@ app.nextwks.eu :443 auth.nextwks.eu :443
curl -o ~/nextwks.sh https://git.lohmar.co.uk/lexton-it/NextWks/raw/branch/main/tools/nextwks.sh curl -o ~/nextwks.sh https://git.lohmar.co.uk/lexton-it/NextWks/raw/branch/main/tools/nextwks.sh
chmod +x ~/nextwks.sh chmod +x ~/nextwks.sh
# Run the installer # Run the installer (no sudo — it'll ask only where needed)
sudo bash ~/nextwks.sh --install ./nextwks.sh --install
``` ```
Prompts for domain, TLS email, and admin credentials. Installs deps (Go, Podman, git), Prompts for domain, TLS email, and admin credentials. Installs deps (Go, Podman, git),
@ -67,10 +67,10 @@ The script stays in `~/nextwks.sh` for future updates.
```bash ```bash
# Smart update (pull, build, copy, restart) # Smart update (pull, build, copy, restart)
sudo bash ~/nextwks.sh --update ./nextwks.sh --update
# Full redeploy (tear down, rebuild from scratch with saved secrets) # Full redeploy (tear down, rebuild from scratch with saved secrets)
sudo bash ~/nextwks.sh --destroy ./nextwks.sh --destroy
``` ```
## Workflow (Development) ## Workflow (Development)
@ -78,7 +78,7 @@ sudo bash ~/nextwks.sh --destroy
1. Edit code in your clone. 1. Edit code in your clone.
2. Bump `VERSION`, update `CHANGELOG.md`. 2. Bump `VERSION`, update `CHANGELOG.md`.
3. `git commit -m "message" && git tag v$(cat VERSION) && git push origin main --tags` 3. `git commit -m "message" && git tag v$(cat VERSION) && git push origin main --tags`
4. On the server: `sudo bash ~/nextwks.sh --update` 4. On the server: `./nextwks.sh --update`
The script clones fresh from git every time — no stale repos, no permissions issues. The script clones fresh from git every time — no stale repos, no permissions issues.

12
tools/nextwks.sh
View file

@ -21,9 +21,17 @@ usage() {
MODE="${1#--}" MODE="${1#--}"
case "$MODE" in install|update|destroy) ;; *) usage ;; esac case "$MODE" in install|update|destroy) ;; *) usage ;; esac
# Helper: run with sudo only for commands that need it # MUST NOT run as root — podman must be rootless
if [ "$(id -u)" -eq 0 ]; then
echo "ERROR: Do NOT run this script with sudo or as root."
echo " Run it as your normal user: ./nextwks.sh --$MODE"
echo " The script will prompt for sudo only where needed (apt, /opt/, iptables)."
exit 1
fi
# Helper: run with sudo for operations that need root
maybe_sudo() { maybe_sudo() {
if [ "$(id -u)" -eq 0 ]; then "$@"; else sudo "$@"; fi sudo "$@"
} }
# --- Load existing env (if any), skip if unreadable --- # --- Load existing env (if any), skip if unreadable ---