From 8a7616ea0452f61c08eb2cf42b9c1d6058398c0e Mon Sep 17 00:00:00 2001
From: jenkins <jenkins@bstein.dev>
Date: Thu, 13 Aug 2026 20:26:43 -0300
Subject: [PATCH] gitea: enforce SSH directory modes

---
 services/gitea/deployment.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/services/gitea/deployment.yaml b/services/gitea/deployment.yaml
index ff2c98b65..ab0fe963a 100644
--- a/services/gitea/deployment.yaml
+++ b/services/gitea/deployment.yaml
@@ -228,6 +228,15 @@ spec:
           args:
             - |
               set -euo pipefail
+              # Keep OpenSSH StrictModes satisfied if another PVC consumer
+              # changes the shared Git directory permissions.
+              chmod 0755 /data/git
+              if [ -d /data/git/.ssh ]; then
+                chmod 0700 /data/git/.ssh
+              fi
+              if [ -f /data/git/.ssh/authorized_keys ]; then
+                chmod 0600 /data/git/.ssh/authorized_keys
+              fi
               export GITEA__security__SECRET_KEY="$(tr -d '\r\n' </vault/secrets/gitea-secret__SECRET_KEY)"
               export GITEA__security__INTERNAL_TOKEN="$(tr -d '\r\n' </vault/secrets/gitea-secret__INTERNAL_TOKEN)"
               export DB_PASS="$(tr -d '\r\n' </vault/secrets/gitea-db-secret__password)"