From c11b9c8be966c1218259ac52e655b13ba33a9231 Mon Sep 17 00:00:00 2001
From: svemagie <869694+svemagie@users.noreply.github.com>
Date: Mon, 8 Jun 2026 21:48:56 +0200
Subject: [PATCH] deploy: normalize dir perms via rsync --chmod
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix /photos/ returning 404 — the photos dir on the server ended up mode 700
(drwx------), so nginx (running as www) could not traverse it. All URLs
under /photos/ returned 404 despite content being present.

Add -p + --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r so future rsyncs normalize
permissions on every transferred entry, preventing recurrence.
---
 .github/workflows/deploy.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 7723fe4..63666bd 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -173,7 +173,8 @@ jobs:
       - name: Deploy via rsync
         run: |
           cp .env _site/.env
-          rsync -rl --delete \
+          rsync -rlp --delete \
+            --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r \
             --exclude='content/.indiekit/' \
             --exclude='og/' \
             --exclude='fonts/' \
@@ -183,11 +184,13 @@ jobs:
 
       - name: Sync OG images and fonts
         run: |
-          rsync -rl --ignore-existing \
+          rsync -rlp --ignore-existing \
+            --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r \
             -e "ssh -p 222" \
             _site/og/ \
             ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/usr/local/bastille/jails/web/root/usr/local/www/blog/og/
-          rsync -rl --ignore-existing \
+          rsync -rlp --ignore-existing \
+            --chmod=Du=rwx,Dgo=rx,Fu=rw,Fgo=r \
             -e "ssh -p 222" \
             _site/fonts/ \
             ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:/usr/local/bastille/jails/web/root/usr/local/www/blog/fonts/