posts fix

.forgejo/workflows/deploy.yaml

@@ -255,6 +255,18 @@ jobs:
         # database and bank credentials.
         run: |
           set -eu
+          # The inverse guard: everything that IS meant to be served must be
+          # world-readable. Caddy and catcrafts-server run as their own users,
+          # so a 0600 file (mktemp's default, once shipped by fetch-posts.sh)
+          # deploys "successfully" and then 403s / renders an empty page.
+          # (/deploy-app/content gets the same check in its own deploy step,
+          # after its rsync — here it would still hold the previous run.)
+          unreadable=$(find /deploy -type f ! -perm -o+r -print 2>/dev/null || true)
+          if [ -n "$unreadable" ]; then
+            echo "ERROR: deployed files not world-readable (host services cannot serve them):" >&2
+            echo "$unreadable" >&2
+            exit 1
+          fi
           bad=$(find /deploy -maxdepth 1 \( -name '*.db' -o -name '*.db-*' \
                 -o -name '*.pem' -o -name '*.key' -o -name '*.env' \
                 -o -name '.*' ! -name '.' \) -print 2>/dev/null || true)
@@ -305,6 +317,14 @@ jobs:
           fi
           install -m 0755 "$MSQ" /deploy-app/libmsquic.so.2.new
           mv -f /deploy-app/libmsquic.so.2.new /deploy-app/libmsquic.so.2
+          # Same world-readable guard as the web root: the server runs as its
+          # own user, and a 0600 content file renders as an empty page.
+          unreadable=$(find /deploy-app/content -type f ! -perm -o+r -print 2>/dev/null || true)
+          if [ -n "$unreadable" ]; then
+            echo "ERROR: deployed content not world-readable:" >&2
+            echo "$unreadable" >&2
+            exit 1
+          fi
           # Swap the binary into place atomically, so a request arriving mid-copy
           # never hits a truncated executable.
           mv -f /deploy-app/catcrafts-server.new /deploy-app/catcrafts-server