PapaTramp/security-alert-center
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(deploy): конфиг в /opt/security-alert-center/config (sac:sac)

Browse Source 
Убирает ошибку Permission denied при каталоге /etc root:root.
This commit is contained in:
PTah
2026-05-26 20:59:44 +10:00
parent 38c137cbd3
commit 539126b75e
8 changed files with 35 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/README.md
+1 -1
View File
@@ -11,7 +11,7 @@ FastAPI + PostgreSQL + Alembic.
```bash
cd /opt/security-alert-center/backend
python3.12 -m venv .venv && .venv/bin/pip install -r requirements.txt
# /etc/security-alert-center/sac-api.env — см. deploy/env.native.example
# /opt/security-alert-center/config/sac-api.env — см. deploy/env.native.example
alembic upgrade head
systemctl start sac-api
```
deploy/.env.example
+1 -1
View File
@@ -1,5 +1,5 @@
# Только для Docker Compose (см. docs/install-ubuntu-24.04-docker.md).
# Production native: deploy/env.native.example → /etc/security-alert-center/sac-api.env
# Production native: deploy/env.native.example → /opt/security-alert-center/config/sac-api.env
# PostgreSQL
POSTGRES_USER=sac
deploy/README.md
+1 -1
View File
@@ -3,7 +3,7 @@
## Production (native) — основной путь
1. [docs/install-ubuntu-24.04-native.md](../docs/install-ubuntu-24.04-native.md)
2. `deploy/env.native.example` → `/etc/security-alert-center/sac-api.env`
2. `deploy/env.native.example` → `/opt/security-alert-center/config/sac-api.env`
3. `deploy/systemd/sac-api.service` → `/etc/systemd/system/`
4. `deploy/nginx/sac.conf.example` → `/etc/nginx/sites-available/sac`
deploy/env.native.example
+3 -3
View File
@@ -1,6 +1,6 @@
# Native (systemd): скопировать в /etc/security-alert-center/sac-api.env
# sudo chown root:sac /etc/security-alert-center/sac-api.env
# sudo chmod 640 /etc/security-alert-center/sac-api.env
# Native: /opt/security-alert-center/config/sac-api.env
# sudo chown sac:sac /opt/security-alert-center/config/sac-api.env
# sudo chmod 600 /opt/security-alert-center/config/sac-api.env
DATABASE_URL=postgresql+psycopg2://sac:CHANGE_ME_POSTGRES_PASSWORD@127.0.0.1:5432/sac
deploy/systemd/sac-api.service
+1 -1
View File
@@ -10,7 +10,7 @@ Type=simple
User=sac
Group=sac
WorkingDirectory=/opt/security-alert-center/backend
EnvironmentFile=/etc/security-alert-center/sac-api.env
EnvironmentFile=/opt/security-alert-center/config/sac-api.env
Environment=PYTHONPATH=/opt/security-alert-center/backend
ExecStart=/opt/security-alert-center/backend/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000
Restart=on-failure
docs/deployment.md
+2 -2
View File
@@ -14,7 +14,7 @@
```
deploy/
env.native.example → /etc/security-alert-center/sac-api.env
env.native.example → /opt/security-alert-center/config/sac-api.env
systemd/sac-api.service → /etc/systemd/system/
nginx/sac.conf.example → /etc/nginx/sites-available/sac
```
@@ -106,7 +106,7 @@ curl -sS https://sac.kalinamall.ru/health
```bash
cd /opt/security-alert-center && sudo -u sac git pull
sudo -u sac backend/.venv/bin/pip install -r backend/requirements.txt
sudo -u sac bash -c 'set -a; source /etc/security-alert-center/sac-api.env; set +a; cd backend && .venv/bin/alembic upgrade head'
sudo -u sac bash -c 'set -a; source /opt/security-alert-center/config/sac-api.env; set +a; cd backend && .venv/bin/alembic upgrade head'
sudo systemctl restart sac-api
```
docs/install-ubuntu-24.04-native.md
+25 -29
View File
@@ -118,17 +118,26 @@ sudo -u sac .venv/bin/pip install -r requirements.txt
---
## 6. Конфигурация `/etc/security-alert-center`
## 6. Конфигурация
Файл лежит **в каталоге приложения** (владелец `sac`) — так проще, чем права на `/etc/...`.
```bash
sudo mkdir -p /etc/security-alert-center
sudo cp /opt/security-alert-center/deploy/env.native.example /etc/security-alert-center/sac-api.env
sudo nano /etc/security-alert-center/sac-api.env
# Каталог и файл: группа sac должна иметь доступ (иначе Permission denied у пользователя sac)
sudo chown root:sac /etc/security-alert-center
sudo chmod 750 /etc/security-alert-center
sudo chown root:sac /etc/security-alert-center/sac-api.env
sudo chmod 640 /etc/security-alert-center/sac-api.env
sudo mkdir -p /opt/security-alert-center/config
sudo cp /opt/security-alert-center/deploy/env.native.example \
/opt/security-alert-center/config/sac-api.env
sudo nano /opt/security-alert-center/config/sac-api.env
sudo chown sac:sac /opt/security-alert-center/config/sac-api.env
sudo chmod 600 /opt/security-alert-center/config/sac-api.env
```
Если уже создавали `/etc/security-alert-center/sac-api.env` — перенесите:
```bash
sudo mkdir -p /opt/security-alert-center/config
sudo cp /etc/security-alert-center/sac-api.env /opt/security-alert-center/config/sac-api.env
sudo chown sac:sac /opt/security-alert-center/config/sac-api.env
sudo chmod 600 /opt/security-alert-center/config/sac-api.env
```
Обязательно задать:
@@ -146,29 +155,16 @@ sudo chmod 640 /etc/security-alert-center/sac-api.env
Проверка, что `sac` читает конфиг (должно быть без `Permission denied`):
```bash
sudo -u sac test -r /etc/security-alert-center/sac-api.env && echo OK
ls -la /opt/security-alert-center/config/sac-api.env
# должно быть: -rw------- sac sac
sudo -u sac test -r /opt/security-alert-center/config/sac-api.env && echo OK
```
Миграции:
```bash
cd /opt/security-alert-center/backend
sudo -u sac bash -c 'set -a; source /etc/security-alert-center/sac-api.env; set +a; .venv/bin/alembic upgrade head'
```
Если снова `Permission denied` — проверьте **каталог** (не только файл):
```bash
namei -l /etc/security-alert-center/sac-api.env
# у каталога security-alert-center должны быть root:sac и drwxr-x---
sudo chown root:sac /etc/security-alert-center
sudo chmod 750 /etc/security-alert-center
```
Разовый обход для миграции (от root, если срочно):
```bash
sudo bash -c 'set -a; source /etc/security-alert-center/sac-api.env; set +a; cd /opt/security-alert-center/backend && .venv/bin/alembic upgrade head'
sudo -u sac bash -c 'set -a; source /opt/security-alert-center/config/sac-api.env; set +a; .venv/bin/alembic upgrade head'
```
---
@@ -268,7 +264,7 @@ EOF
cd /opt/security-alert-center
sudo -u sac git pull
sudo -u sac backend/.venv/bin/pip install -r backend/requirements.txt
sudo -u sac bash -c 'set -a; source /etc/security-alert-center/sac-api.env; set +a; cd backend && .venv/bin/alembic upgrade head'
sudo -u sac bash -c 'set -a; source /opt/security-alert-center/config/sac-api.env; set +a; cd backend && .venv/bin/alembic upgrade head'
sudo systemctl restart sac-api
```
@@ -280,7 +276,7 @@ sudo systemctl restart sac-api
- [ ] ufw: 22, 80, 443
- [ ] PostgreSQL: БД `sac`, пользователь `sac`
- [ ] venv, зависимости установлены
- [ ] `/etc/security-alert-center/sac-api.env`, chmod 600
- [ ] `/opt/security-alert-center/config/sac-api.env`, владелец `sac:sac`, chmod 600
- [ ] `alembic upgrade head` без ошибок
- [ ] `sac-api` active (systemd)
- [ ] nginx + TLS
@@ -293,7 +289,7 @@ sudo systemctl restart sac-api
| Симптом | Действие |
|---------|----------|
| `sac-api.env: Permission denied` | `chown root:sac` и `chmod 750` на **каталог** `/etc/security-alert-center`, `chmod 640` на файл |
| `sac-api.env: Permission denied` | Конфиг в `/opt/security-alert-center/config/`, `chown sac:sac`, `chmod 600`. Не используйте `/etc/...` с каталогом `root:root` |
| `password authentication failed for user sac` | Пароль в `DATABASE_URL` ≠ пароль в PostgreSQL; или `.env` не прочитан (тогда берётся дефолт `sac:sac`). Исправить пароль: `sudo -u postgres psql -c "ALTER USER sac PASSWORD '...';"` и обновить `DATABASE_URL` |
| `database: error` / SQLAlchemy connect | `systemctl status postgresql`; проверить `DATABASE_URL` после успешного `source` |
| 401 ingest | ключ в `Authorization: Bearer`; проверить `SAC_BOOTSTRAP_API_KEY` |
docs/install-ubuntu-24.04.md
+1 -1
View File
@@ -15,7 +15,7 @@
# см. полный чеклист в native-руководстве
sudo apt update && sudo apt install -y git postgresql nginx python3.12 python3.12-venv
sudo git clone https://git.kalinamall.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
# … PostgreSQL, venv, /etc/security-alert-center/sac-api.env, systemd, nginx
# … PostgreSQL, venv, config/sac-api.env, systemd, nginx
```
## См. также