use sudo for deploy scripts instead of chown on repo

The deploy user runs scripts as root via passwordless sudo,
avoiding ownership conflicts with Docker-mounted volumes.

scripts/deploy-dispatch.sh

@@ -2,8 +2,8 @@
 set -euo pipefail
 
 case "$SSH_ORIGINAL_COMMAND" in
-    deploy-nginx)       /opt/hantim/scripts/deploy-nginx.sh ;;
-    deploy-timothykim)  /opt/hantim/scripts/deploy-timothykim.sh ;;
+    deploy-nginx)       sudo /opt/hantim/scripts/deploy-nginx.sh ;;
+    deploy-timothykim)  sudo /opt/hantim/scripts/deploy-timothykim.sh ;;
     *)
         echo "Unknown command: $SSH_ORIGINAL_COMMAND"
         echo "Available: deploy-nginx, deploy-timothykim"

scripts/new-app.sh

@@ -38,7 +38,7 @@ EOF
 chmod +x "$REPO_ROOT/scripts/deploy-$APP.sh"
 
 echo "Adding $APP to deploy-dispatch.sh..."
-sed -i "/^    \*)$/i\\    deploy-$APP) /opt/hantim/scripts/deploy-$APP.sh ;;" \
+sed -i "/^    \*)$/i\\    deploy-$APP) sudo /opt/hantim/scripts/deploy-$APP.sh ;;" \
     "$REPO_ROOT/scripts/deploy-dispatch.sh"
 
 echo "Creating .gitea/workflows/deploy-$APP.yml..."

setup.sh

@@ -86,7 +86,12 @@ if [ ! -f /home/deploy/.ssh/authorized_keys ]; then
     echo "  into /home/deploy/.ssh/authorized_keys"
 fi
 chown -R deploy:deploy /home/deploy/.ssh
-su -s /bin/bash deploy -c "git config --global --add safe.directory $REPO_DIR"
+
+echo "==> Configuring sudo for deploy user..."
+cat > /etc/sudoers.d/deploy <<SUDOERS
+deploy ALL=(root) NOPASSWD: /opt/hantim/scripts/deploy-*.sh
+SUDOERS
+chmod 440 /etc/sudoers.d/deploy
 
 # --- Start services ---