From c40e8d5c0e9782892c1853db31b53e0dab78c7dc Mon Sep 17 00:00:00 2001
From: Tyler <tyler@dinsmoor.us>
Date: Mon, 19 Oct 2026 18:34:40 -0700
Subject: [PATCH] tighter permissions fix permisssions

---
 .env => .env.example |  2 +-
 .env.sample          |  1 -
 .gitignore           |  1 +
 install.sh           | 77 +++++++++++++++++++++++++++++++++++++-------
 4 files changed, 68 insertions(+), 13 deletions(-)
 rename .env => .env.example (81%)
 delete mode 100644 .env.sample

diff --git a/.env b/.env.example
similarity index 81%
rename from .env
rename to .env.example
index 4743f61..8fc4956 100644
--- a/.env
+++ b/.env.example
@@ -1,3 +1,3 @@
 KJV_SERMON_DB="./data/sermons.db"
 # this does not do anything unless sermon_analyzer.py is running in tcp socket mode as a separate process
-KJV_SECRET_API_KEY="testing"
+KJV_SECRET_API_KEY="change-me"
diff --git a/.env.sample b/.env.sample
deleted file mode 100644
index c5f2edf..0000000
--- a/.env.sample
+++ /dev/null
@@ -1 +0,0 @@
-KJV_SERMON_DB="/home/tyler/kjv-api/sermon-analyzer/data/sermons.db"
diff --git a/.gitignore b/.gitignore
index c27414f..08b9184 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,4 @@ logs/*.log
 data/shortcodes.db
 data/seq.db
 data/sermons.db
+.env
diff --git a/install.sh b/install.sh
index ec7dea6..87d7e43 100755
--- a/install.sh
+++ b/install.sh
@@ -8,27 +8,82 @@ fi
 
 script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 
+dest=/opt/kjv-api
+
 echo "Attempting to install dependancies"
-apt install python3-flask sqlite3 libhunspell-dev python3-hunspell uwsgi-core uwsgi-plugin-python3 python3-requests python3-dotenv curl
+apt install python3-flask sqlite3 libhunspell-dev python3-hunspell uwsgi-core uwsgi-plugin-python3 python3-requests python3-dotenv curl rsync
 
-echo "Creating new user kjv with no login shell"
-useradd -r -s /bin/false kjv
+if id kjv >/dev/null 2>&1; then
+  echo "User kjv already exists, leaving it alone"
+else
+  echo "Creating new user kjv with no login shell"
+  useradd -r -s /bin/false kjv
+fi
 
-echo "Creating destination directory: /opt/kjv-api"
-mkdir /opt/kjv-api
+# Stop a running install so files are not swapped underneath it
+if systemctl is-active --quiet kjv-api.service; then
+  echo "Stopping running kjv-api service for the update"
+  systemctl stop kjv-api.service
+fi
 
-echo "Copying server files to /opt/kjv-api"
-cp -r "${script_dir}"/. /opt/kjv-api
+mkdir -p "$dest"
 
-echo "Setting ownership to kjv user"
-chown -R kjv:kjv /opt/kjv-api
+# Never overwrite local state on a re-run: the .env, the runtime databases
+# (seq/shortcodes/sermons, including any -wal/-shm files), logs, and dev cruft.
+# Files are only added or updated, never deleted.
+if [[ "$script_dir" == "$dest" ]]; then
+  echo "Running from $dest, nothing to copy"
+else
+  echo "Copying server files to $dest (existing .env, databases and logs are kept)"
+  rsync -rlt \
+    --exclude='.git/' --exclude='__pycache__/' --exclude='*.pyc' \
+    --exclude='/.env' \
+    --exclude='/data/seq.db*' --exclude='/data/shortcodes.db*' --exclude='/data/sermons.db*' \
+    --exclude='/logs/*' \
+    "${script_dir}"/ "$dest"/
+fi
+
+mkdir -p "$dest/logs" "$dest/data"
+
+if [[ ! -f "$dest/.env" ]]; then
+  echo "Creating $dest/.env from .env.example (edit it to set real values)"
+  cp "$dest/.env.example" "$dest/.env"
+else
+  echo "Keeping existing $dest/.env"
+fi
+
+echo "Setting permissions (code read-only to kjv; only logs/ and data/ writable)"
+chown -R root:root "$dest"
+find "$dest" -type d -exec chmod 755 {} +
+find "$dest" -type f -exec chmod 644 {} +
+chmod 755 "$dest"/*.sh
+chown root:kjv "$dest/.env"
+chmod 640 "$dest/.env"
+# SQLite needs a writable directory for journal files
+chown kjv:kjv "$dest/logs" "$dest/data"
+chmod 750 "$dest/logs" "$dest/data"
+chown -R kjv:kjv "$dest/logs"
+chmod -R u+rwX,g+rX,o-rwx "$dest/logs"
+# Runtime-written databases belong to kjv; shipped read-only databases stay root-owned
+for db in "$dest"/data/seq.db* "$dest"/data/shortcodes.db*; do
+  if [[ -f "$db" ]]; then
+    chown kjv:kjv "$db"
+    chmod 640 "$db"
+  fi
+done
 
 echo "Installing systemd service task"
-cp "/opt/kjv-api/install/kjv-api.service" "/etc/systemd/system/kjv-api.service"
+unit=/etc/systemd/system/kjv-api.service
+if [[ -f "$unit" ]] && ! cmp -s "$dest/install/kjv-api.service" "$unit"; then
+  echo "Existing service file differs, saving it as $unit.bak"
+  cp "$unit" "$unit.bak"
+fi
+cp "$dest/install/kjv-api.service" "$unit"
+systemctl daemon-reload
 
 echo "Enabling auto-start and starting kjv-api"
 systemctl enable kjv-api.service
-systemctl start kjv-api.service
+systemctl restart kjv-api.service
 
 echo "Waiting for the service to initialize"
 sleep 3