lukas/webmail-client
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deploy: explain the root-owned env file instead of leaking "Permission denied"

Browse Source 
init runs as root on a NAS, so docker/.env.prod is mode 600 owned by root and
the data directories are root-owned. Running any subcommand as a normal user
produced a bare redirect error naming an internal line number, with no hint
about the cause.

require_env now checks readability first and says who you are running as, the
exact sudo command to repeat, and that `sudo -i` avoids it for the session.
Docs note it beside the show-key step and above the command reference.

Reproduced with a root-owned 600 env file read as a normal user; the message
is what that case now prints.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nux3LCu4zP9nih4BRhPyHw
This commit is contained in:
lukas
2026-09-14 19:29:22 +02:00
co-authored by Claude Opus 5
parent 24031f1daa
commit 7f6b76ec12
2 changed files with 22 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/nas-install.md
+11 -2
View File
@@ -144,7 +144,12 @@ bash deploy/webmail.sh show-key > /volume1/docker/webmail/MASTER_KEY.txt
```
Run it, open `MASTER_KEY.txt` in File Station, copy the key into your password
manager, then **delete the file**. Skipping this is the one mistake with no
manager, then **delete the file**.
> Doing this from an SSH shell instead? `init` created that file as root with
> mode 600, so run it as root or you get "Permission denied":
> `sudo bash deploy/webmail.sh show-key`. The same goes for every other command
> here — the data directories are root-owned, so start with `sudo -i`. Skipping this is the one mistake with no
recovery: without that key, no backup can decrypt your saved mail-account
passwords.
@@ -415,8 +420,12 @@ per container, so they can't fill the volume.
## 9. Command reference
Run these as root (`sudo -i` first): the env file is mode 600 and the data
directories are root-owned.
```
./deploy/webmail.sh init create data dirs + generate secrets
./deploy/webmail.sh init [flags] create data dirs + generate secrets
./deploy/webmail.sh show-key print MASTER_KEY so you can back it up
./deploy/webmail.sh doctor pre-flight checks
./deploy/webmail.sh up [--meili] start everything
./deploy/webmail.sh down stop (data untouched)