From a29a1f461b4679f21dbd5752f13a75699ba9e249 Mon Sep 17 00:00:00 2001 From: Do Siki Date: Wed, 19 Aug 2026 15:16:00 +0200 Subject: [PATCH] fix(cms): detach and audit the publish-triggered deploy (systemd-safe) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A CMS publish's background deploy silently never ran under systemd (naive 'cmd &' child died with the spawning shell; no log, no trace — the site kept serving stale content). The spawn now uses setsid+nohup+stdin-null so it survives any parent exit, and writes deploy_spawned / deploy_exec_exit audit entries so a failed spawn can never be silent again. Closes MITHOME-72 --- content-editor.js | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/content-editor.js b/content-editor.js index c14f26b..723017c 100644 --- a/content-editor.js +++ b/content-editor.js @@ -305,9 +305,21 @@ const server = http.createServer(async (req, res) => { // trigger a rebuild. Deploy only the explicitly configured environment; // never default to production. Overridable for tests. if (outcome.hadChanges) { + // WHY setsid+nohup+stdin-null: under systemd the naive `cmd &` child died + // together with the spawning shell (observed: the deploy never ran after a + // CMS publish, leaving the site on stale content). Full detachment makes it + // survive; the audit entries make the spawn observable instead of silent. const deployCmd = process.env.CONTENT_EDITOR_DEPLOY_CMD - || `cd ../../../ && ./deploy.sh ${CMS_DEPLOY_ENV} > deploy.log 2>&1 &`; - exec(deployCmd); + || `cd ../../../ && setsid nohup ./deploy.sh ${CMS_DEPLOY_ENV} > deploy.log 2>&1 < /dev/null &`; + writeAudit('deploy_spawned', { clientAddress, user: CMS_USER, env: CMS_DEPLOY_ENV }); + exec(deployCmd, deployError => { + writeAudit('deploy_exec_exit', { + clientAddress, + user: CMS_USER, + result: deployError ? 'error' : 'shell_exited', + error: deployError ? String(deployError.message).slice(0, 300) : undefined, + }); + }); } res.end(JSON.stringify({ ok: true, output: outcome.output })); });