From 18b0242fdf5803eccc64ae00594e2d7a59687b0f Mon Sep 17 00:00:00 2001
From: Dmitry <ada.dmitry@gmail.com>
Date: Sat, 30 May 2026 14:46:47 +0300
Subject: [PATCH] Ensure /opt/services ownership on deploy

---
 .gitea/workflows/deploy-cloud-pc.yml       | 3 ++-
 .gitea/workflows/deploy-mini-pc.yml        | 3 ++-
 .gitea/workflows/deploy-ru-vps.yml         | 3 ++-
 .gitea/workflows/nixos-switch-cloud-pc.yml | 3 ++-
 .gitea/workflows/nixos-switch-mini-pc.yml  | 3 ++-
 nixos/modules/base.nix                     | 1 +
 6 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/deploy-cloud-pc.yml b/.gitea/workflows/deploy-cloud-pc.yml
index 3eaad8b..e0b572e 100644
--- a/.gitea/workflows/deploy-cloud-pc.yml
+++ b/.gitea/workflows/deploy-cloud-pc.yml
@@ -21,7 +21,8 @@ jobs:
       - name: Sync repo
         run: |
           git config --global --replace-all safe.directory /opt/services
-          git -C /opt/services pull --ff-only
+          git -C /opt/services pull origin main --ff-only
+          chown -R ada:users /opt/services
 
       - name: Deploy stacks
         run: /opt/services/scripts/deploy.sh cloud-pc "${{ inputs.stack }}"
diff --git a/.gitea/workflows/deploy-mini-pc.yml b/.gitea/workflows/deploy-mini-pc.yml
index 0d576f0..aa7c37d 100644
--- a/.gitea/workflows/deploy-mini-pc.yml
+++ b/.gitea/workflows/deploy-mini-pc.yml
@@ -21,7 +21,8 @@ jobs:
       - name: Sync repo
         run: |
           git config --global --replace-all safe.directory /opt/services
-          git -C /opt/services pull --ff-only
+          git -C /opt/services pull origin main --ff-only
+          chown -R ada:users /opt/services
 
       - name: Deploy stacks
         run: /opt/services/scripts/deploy.sh mini-pc "${{ inputs.stack }}"
diff --git a/.gitea/workflows/deploy-ru-vps.yml b/.gitea/workflows/deploy-ru-vps.yml
index 4aabb89..e5d6629 100644
--- a/.gitea/workflows/deploy-ru-vps.yml
+++ b/.gitea/workflows/deploy-ru-vps.yml
@@ -21,7 +21,8 @@ jobs:
       - name: Sync repo
         run: |
           git config --global --replace-all safe.directory /opt/services
-          git -C /opt/services pull --ff-only
+          git -C /opt/services pull origin main --ff-only
+          chown -R ada:users /opt/services
 
       - name: Deploy stacks
         run: /opt/services/scripts/deploy.sh ru-vps "${{ inputs.stack }}"
diff --git a/.gitea/workflows/nixos-switch-cloud-pc.yml b/.gitea/workflows/nixos-switch-cloud-pc.yml
index 3e0fa4a..414d485 100644
--- a/.gitea/workflows/nixos-switch-cloud-pc.yml
+++ b/.gitea/workflows/nixos-switch-cloud-pc.yml
@@ -17,7 +17,8 @@ jobs:
       - name: Sync repo
         run: |
           git config --global --replace-all safe.directory /opt/services
-          git -C /opt/services pull --ff-only
+          git -C /opt/services pull origin main --ff-only
+          chown -R ada:users /opt/services
 
       - name: Switch NixOS generation
         env:
diff --git a/.gitea/workflows/nixos-switch-mini-pc.yml b/.gitea/workflows/nixos-switch-mini-pc.yml
index b9e2bce..2095573 100644
--- a/.gitea/workflows/nixos-switch-mini-pc.yml
+++ b/.gitea/workflows/nixos-switch-mini-pc.yml
@@ -17,7 +17,8 @@ jobs:
       - name: Sync repo
         run: |
           git config --global --replace-all safe.directory /opt/services
-          git -C /opt/services pull --ff-only
+          git -C /opt/services pull origin main --ff-only
+          chown -R ada:users /opt/services
 
       - name: Switch NixOS generation
         env:
diff --git a/nixos/modules/base.nix b/nixos/modules/base.nix
index 0875da4..65edd13 100644
--- a/nixos/modules/base.nix
+++ b/nixos/modules/base.nix
@@ -66,6 +66,7 @@
 
   systemd.tmpfiles.rules = [
     "d /opt/services 0755 ada users - -"
+    "Z /opt/services - ada users - -"
     "d /opt/data 0755 ada users - -"
     "d /opt/configs 0755 ada users - -"
   ];