From 2adeae555d9e792afa541260f2c2c604e47cf5d4 Mon Sep 17 00:00:00 2001
From: root <root@claude.hynesy.com>
Date: Mon, 1 Jun 2026 10:06:29 +1000
Subject: [PATCH] fix(deploy): push-workers.sh chowns + preserves .env
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rsync ran as root over SSH so files landed root-owned, but workers run
as voidworkers — the service couldn't even reach the venv binary.
Now: chown -R voidworkers after rsync, run venv create + pip install
under `su voidworkers -c`. Also excludes .env, .gitignore, .pytest_cache
so they survive across deploys.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 deploy/push-workers.sh | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/deploy/push-workers.sh b/deploy/push-workers.sh
index d5e84d7..1782728 100755
--- a/deploy/push-workers.sh
+++ b/deploy/push-workers.sh
@@ -12,16 +12,23 @@ rsync -avz --delete \
   --exclude __pycache__ \
   --exclude '*.egg-info' \
   --exclude tests \
+  --exclude .env \
+  --exclude .gitignore \
+  --exclude .pytest_cache \
   workers/ "$TARGET:$REMOTE_DIR/"
 
 ssh "$TARGET" "
-  cd $REMOTE_DIR
-  if [ ! -d venv ]; then
-    python3.12 -m venv venv
-  fi
-  . venv/bin/activate
-  pip install --quiet --upgrade pip
-  pip install --quiet -e '.[all]'
+  # rsync runs as root → files land root-owned. Workers run as voidworkers.
+  chown -R voidworkers: $REMOTE_DIR
+  su voidworkers -c '
+    cd $REMOTE_DIR
+    if [ ! -d venv ]; then
+      python3 -m venv venv
+    fi
+    . venv/bin/activate
+    pip install --quiet --upgrade pip
+    pip install --quiet -e \".[all]\"
+  '
   systemctl restart void-workers
 "
 echo "Workers deployed."