tighter permissions fix permisssions

.env.example

@@ -1,3 +1,3 @@
 KJV_SERMON_DB="./data/sermons.db"
 # this does not do anything unless sermon_analyzer.py is running in tcp socket mode as a separate process
-KJV_SECRET_API_KEY="testing"
+KJV_SECRET_API_KEY="change-me"

.env.sample

@@ -1 +0,0 @@
-KJV_SERMON_DB="/home/tyler/kjv-api/sermon-analyzer/data/sermons.db"

.gitignore

@@ -3,3 +3,4 @@ logs/*.log
 data/shortcodes.db
 data/seq.db
 data/sermons.db
+.env

install.sh

@@ -8,27 +8,82 @@ fi
 
 script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 
+dest=/opt/kjv-api
+
 echo "Attempting to install dependancies"
-apt install python3-flask sqlite3 libhunspell-dev python3-hunspell uwsgi-core uwsgi-plugin-python3 python3-requests python3-dotenv curl
+apt install python3-flask sqlite3 libhunspell-dev python3-hunspell uwsgi-core uwsgi-plugin-python3 python3-requests python3-dotenv curl rsync
 
-echo "Creating new user kjv with no login shell"
-useradd -r -s /bin/false kjv
+if id kjv >/dev/null 2>&1; then
+  echo "User kjv already exists, leaving it alone"
+else
+  echo "Creating new user kjv with no login shell"
+  useradd -r -s /bin/false kjv
+fi
 
-echo "Creating destination directory: /opt/kjv-api"
-mkdir /opt/kjv-api
+# Stop a running install so files are not swapped underneath it
+if systemctl is-active --quiet kjv-api.service; then
+  echo "Stopping running kjv-api service for the update"
+  systemctl stop kjv-api.service
+fi
 
-echo "Copying server files to /opt/kjv-api"
-cp -r "${script_dir}"/. /opt/kjv-api
+mkdir -p "$dest"
 
-echo "Setting ownership to kjv user"
-chown -R kjv:kjv /opt/kjv-api
+# Never overwrite local state on a re-run: the .env, the runtime databases
+# (seq/shortcodes/sermons, including any -wal/-shm files), logs, and dev cruft.
+# Files are only added or updated, never deleted.
+if [[ "$script_dir" == "$dest" ]]; then
+  echo "Running from $dest, nothing to copy"
+else
+  echo "Copying server files to $dest (existing .env, databases and logs are kept)"
+  rsync -rlt \
+    --exclude='.git/' --exclude='__pycache__/' --exclude='*.pyc' \
+    --exclude='/.env' \
+    --exclude='/data/seq.db*' --exclude='/data/shortcodes.db*' --exclude='/data/sermons.db*' \
+    --exclude='/logs/*' \
+    "${script_dir}"/ "$dest"/
+fi
+
+mkdir -p "$dest/logs" "$dest/data"
+
+if [[ ! -f "$dest/.env" ]]; then
+  echo "Creating $dest/.env from .env.example (edit it to set real values)"
+  cp "$dest/.env.example" "$dest/.env"
+else
+  echo "Keeping existing $dest/.env"
+fi
+
+echo "Setting permissions (code read-only to kjv; only logs/ and data/ writable)"
+chown -R root:root "$dest"
+find "$dest" -type d -exec chmod 755 {} +
+find "$dest" -type f -exec chmod 644 {} +
+chmod 755 "$dest"/*.sh
+chown root:kjv "$dest/.env"
+chmod 640 "$dest/.env"
+# SQLite needs a writable directory for journal files
+chown kjv:kjv "$dest/logs" "$dest/data"
+chmod 750 "$dest/logs" "$dest/data"
+chown -R kjv:kjv "$dest/logs"
+chmod -R u+rwX,g+rX,o-rwx "$dest/logs"
+# Runtime-written databases belong to kjv; shipped read-only databases stay root-owned
+for db in "$dest"/data/seq.db* "$dest"/data/shortcodes.db*; do
+  if [[ -f "$db" ]]; then
+    chown kjv:kjv "$db"
+    chmod 640 "$db"
+  fi
+done
 
 echo "Installing systemd service task"
-cp "/opt/kjv-api/install/kjv-api.service" "/etc/systemd/system/kjv-api.service"
+unit=/etc/systemd/system/kjv-api.service
+if [[ -f "$unit" ]] && ! cmp -s "$dest/install/kjv-api.service" "$unit"; then
+  echo "Existing service file differs, saving it as $unit.bak"
+  cp "$unit" "$unit.bak"
+fi
+cp "$dest/install/kjv-api.service" "$unit"
+systemctl daemon-reload
 
 echo "Enabling auto-start and starting kjv-api"
 systemctl enable kjv-api.service
-systemctl start kjv-api.service
+systemctl restart kjv-api.service
 
 echo "Waiting for the service to initialize"
 sleep 3