From 057568974de6fce12b1e035d5ee87bfd1849af90 Mon Sep 17 00:00:00 2001
From: Anton Afanasyeu <a.afanasieff@gmail.com>
Date: Sun, 9 Aug 2026 11:03:38 +0200
Subject: [PATCH] Deploy: stop rsync --delete from wiping builder builds/
 artifacts.

Exclude builds/ and .docker from broadcast sync; re-run prepare-be-builder-dirs
after deploy so nobody retains write access to artifact trees.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../backend/scripts/prepare-be-builder-dirs.sh     | 11 ++++++++++-
 sim/cluster0/scripts/deploy-ac-broadcast.sh        | 14 +++++++++++++-
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/sim/cluster0/lab-seeds/backend/scripts/prepare-be-builder-dirs.sh b/sim/cluster0/lab-seeds/backend/scripts/prepare-be-builder-dirs.sh
index 098722f..d5cc7c5 100755
--- a/sim/cluster0/lab-seeds/backend/scripts/prepare-be-builder-dirs.sh
+++ b/sim/cluster0/lab-seeds/backend/scripts/prepare-be-builder-dirs.sh
@@ -12,12 +12,21 @@ DOWNLOADS="${2:-/var/www/localhost/htdocs/apps/app/androidcast_project/downloads
 OTA_ROOT="${3:-/var/www/localhost/htdocs/apps/app/androidcast_project/ota-artifacts}"
 
 mkdir -p "${BUILDS}" "${DOCKER_HOME}/.docker" "${DOWNLOADS}" "${OTA_ROOT}/v0/ota/channel"
-chown -R nginx:nginx "${BROADCAST_ROOT}" "${DOWNLOADS}" "${OTA_ROOT}" 2>/dev/null || true
+
+# Do not chown -R broadcast root: that resets builds/* to nginx and breaks PHP-FPM (nobody).
+for _d in config bin deploy sql src public; do
+  if [ -d "${BROADCAST_ROOT}/${_d}" ]; then
+    chown -R nginx:nginx "${BROADCAST_ROOT}/${_d}" 2>/dev/null || true
+  fi
+done
+chown -R nginx:nginx "${DOWNLOADS}" "${OTA_ROOT}" 2>/dev/null || true
 chmod -R 775 "${DOWNLOADS}" "${OTA_ROOT}" 2>/dev/null || true
 
 # PHP-FPM www pool is often nobody; artifact dirs must be writable by that user.
 chown nobody:nginx "${BUILDS}" 2>/dev/null || true
 chmod 2775 "${BUILDS}" 2>/dev/null || true
+find "${BUILDS}" -mindepth 1 -maxdepth 1 -type d -exec chown nobody:nginx {} \; 2>/dev/null || true
+find "${BUILDS}" -mindepth 1 -maxdepth 1 -type d -exec chmod 2775 {} \; 2>/dev/null || true
 chown nobody:nobody "${DOCKER_HOME}/.docker" 2>/dev/null || true
 chmod 775 "${DOCKER_HOME}/.docker" 2>/dev/null || true
 
diff --git a/sim/cluster0/scripts/deploy-ac-broadcast.sh b/sim/cluster0/scripts/deploy-ac-broadcast.sh
index fb5c471..5ac21ee 100755
--- a/sim/cluster0/scripts/deploy-ac-broadcast.sh
+++ b/sim/cluster0/scripts/deploy-ac-broadcast.sh
@@ -21,10 +21,12 @@ else
 fi
 
 log "deploy ac-ms-broadcast → ${BROADCAST_DEST}"
-mkdir -p "$BROADCAST_DEST"
+mkdir -p "$BROADCAST_DEST/builds" "$BROADCAST_DEST/.docker"
 rsync -a --delete \
   --exclude='.git' \
   --exclude='config/config.php' \
+  --exclude='builds/' \
+  --exclude='.docker/' \
   "${BROADCAST_SRC}/" "${BROADCAST_DEST}/" 2>/dev/null || \
   { mkdir -p "$BROADCAST_DEST"; cp -r "${BROADCAST_SRC}/." "${BROADCAST_DEST}/"; }
 
@@ -66,6 +68,16 @@ return [
 PHPEOF
 
 chown -R nginx:nginx "$BROADCAST_DEST" 2>/dev/null || true
+# Preserve builder artifact ownership (PHP-FPM user nobody).
+PREP="${ROOT}/lab-seeds/backend/scripts/prepare-be-builder-dirs.sh"
+if [ -f "$PREP" ]; then
+  sh "$PREP" "$BROADCAST_DEST"
+else
+  chown nobody:nginx "$BROADCAST_DEST/builds" 2>/dev/null || true
+  chmod 2775 "$BROADCAST_DEST/builds" 2>/dev/null || true
+  chown nobody:nobody "$BROADCAST_DEST/.docker" 2>/dev/null || true
+  chmod 775 "$BROADCAST_DEST/.docker" 2>/dev/null || true
+fi
 
 # DB schema + user — primary node only
 if is_primary_node; then