arcane: fix projects/builds dir ownership for non-root container UID

install/outline-install.sh

@@ -28,23 +28,21 @@ fetch_and_deploy_gh_release "outline" "outline/outline" "tarball"
 
 msg_info "Configuring Outline (Patience)"
 SECRET_KEY="$(openssl rand -hex 32)"
-UTILS_SECRET="$(openssl rand -hex 32)"
 cd /opt/outline
 cp .env.sample .env
 export NODE_ENV=development
-sed -i "s#^NODE_ENV=.*#NODE_ENV=development#" /opt/outline/.env
-sed -i "s#^SECRET_KEY=.*#SECRET_KEY=${SECRET_KEY}#" /opt/outline/.env
-sed -i "s#^UTILS_SECRET=.*#UTILS_SECRET=${UTILS_SECRET}#" /opt/outline/.env
-sed -i "s#^DATABASE_URL=.*#DATABASE_URL=postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}#" /opt/outline/.env
-sed -i "s#^REDIS_URL=.*#REDIS_URL=redis://localhost:6379#" /opt/outline/.env
-sed -i "s#^URL=.*#URL=http://${LOCAL_IP}#" /opt/outline/.env
-sed -i "s#^FORCE_HTTPS=.*#FORCE_HTTPS=false#" /opt/outline/.env
+sed -i 's/NODE_ENV=production/NODE_ENV=development/g' /opt/outline/.env
+sed -i "s/generate_a_new_key/${SECRET_KEY}/g" /opt/outline/.env
+sed -i "s/user:pass@postgres/${PG_DB_USER}:${PG_DB_PASS}@localhost/g" /opt/outline/.env
+sed -i 's/redis:6379/localhost:6379/g' /opt/outline/.env
+sed -i "5s#URL=#URL=http://${LOCAL_IP}#g" /opt/outline/.env
+sed -i 's/FORCE_HTTPS=true/FORCE_HTTPS=false/g' /opt/outline/.env
 export NODE_OPTIONS="--max-old-space-size=3584"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 
 $STD yarn install --immutable
 export NODE_ENV=production
-sed -i "s#^NODE_ENV=.*#NODE_ENV=production#" /opt/outline/.env
+sed -i 's/NODE_ENV=development/NODE_ENV=production/g' /opt/outline/.env
 $STD yarn build
 msg_ok "Configured Outline"
 

tools/addon/arcane.sh

@@ -59,6 +59,8 @@ function uninstall() {
 # UPDATE
 # ==============================================================================
 function update() {
+  chown -R 65532:65532 /etc/arcane/projects /etc/arcane/builds 2>/dev/null || true
+
   msg_info "Pulling latest ${APP} image"
   cd "$INSTALL_PATH"
   $STD docker compose pull
@@ -83,15 +85,25 @@ function install() {
   msg_ok "Created ${INSTALL_PATH}"
 
   # Generate secrets and config values
-  local ENCRYPTION_KEY JWT_SECRET PROJ_DIR
+  local ENCRYPTION_KEY JWT_SECRET PROJ_DIR BUILDS_DIR
   ENCRYPTION_KEY=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c32)
   JWT_SECRET=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c32)
   PROJ_DIR="/etc/arcane/projects"
+  BUILDS_DIR="/etc/arcane/builds"
 
+  # Arcane drops root and runs as UID/GID 65532 by default (Dockerfile default,
+  # see backend/pkg/libarcane/startup/runtime_identity.go), so bind-mounted
+  # host directories must be owned by that UID or the container can't write to them.
   msg_info "Creating stacks directory"
   mkdir -p "$PROJ_DIR"
+  chown -R 65532:65532 "$PROJ_DIR"
   msg_ok "Created ${PROJ_DIR}"
 
+  msg_info "Creating builds directory"
+  mkdir -p "$BUILDS_DIR"
+  chown -R 65532:65532 "$BUILDS_DIR"
+  msg_ok "Created ${BUILDS_DIR}"
+
   msg_info "Downloading Docker Compose file"
   curl -fsSL "https://raw.githubusercontent.com/getarcaneapp/arcane/refs/heads/main/docker/examples/compose.basic.yaml" -o "$COMPOSE_FILE"
   msg_ok "Downloaded Docker Compose file"
@@ -103,6 +115,7 @@ function install() {
 
   msg_info "Configuring compose and env files"
   sed -i '/^[[:space:]]*#/!s|/host/path/to/projects|'"$PROJ_DIR"'|g' "$COMPOSE_FILE"
+  sed -i '/^[[:space:]]*#/!s|/host/path/to/builds|'"$BUILDS_DIR"'|g' "$COMPOSE_FILE"
   sed -i '/^[[:space:]]*#/!s|ENCRYPTION_KEY=.*|ENCRYPTION_KEY='"$ENCRYPTION_KEY"'|g' "$COMPOSE_FILE"
   sed -i '/^[[:space:]]*#/!s|JWT_SECRET=.*|JWT_SECRET='"$JWT_SECRET"'|g' "$COMPOSE_FILE"
   sed -i '/^[[:space:]]*#/!s|APP_URL=.*|APP_URL=http://localhost:'"$DEFAULT_PORT"'|g' "$ENV_FILE"