From 25cb0e1a5d5eb8cadf1ea41c161b15cf77bb6cb7 Mon Sep 17 00:00:00 2001
From: Alexander Schmidt <alexander@schmidt.eco>
Date: Fri, 27 Mar 2026 07:55:54 +0100
Subject: [PATCH] Fix deploy permissions and exclude credentials

- Add --chmod=D755,F644 to rsync (HestiaCP PHP-FPM needs world-readable)
- Exclude scripts/.deploy.env from deploy (contains server credentials)
---
 scripts/deploy.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index fab7b84..3bff4e6 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -120,11 +120,12 @@ if [[ "$DRY_RUN" == "1" ]]; then
   echo "Running in dry-run mode (DEPLOY_DRY_RUN=1)."
 fi
 
-rsync -avz --delete \
+rsync -avz --delete --chmod=D755,F644 \
   ${RSYNC_DRY_RUN} \
   --exclude '.git' \
   --exclude 'node_modules' \
   --exclude 'data/' \
+  --exclude 'scripts/.deploy.env' \
   ./ "$HOST:$TARGET"
 
 echo "Deploy complete (data/ preserved)."