From 46a7cc23bdc352b2a52071b7d725880c0d0ec7ad Mon Sep 17 00:00:00 2001
From: maro <mail@mgoth.de>
Date: Fri, 18 Sep 2026 02:09:16 +0200
Subject: [PATCH] Fix media directory permissions during deploy

---
 deploy.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/deploy.sh b/deploy.sh
index bee13b5..f82c9ca 100755
--- a/deploy.sh
+++ b/deploy.sh
@@ -129,6 +129,14 @@ deploy_version() {
   registry_login
   log_info "Pulling ${ANOUMA_IMAGE} …"
   $COMPOSE pull app || return 1
+  # The media directory is a bind mount. Its host ownership can differ from
+  # the unprivileged `nextjs` user inside the image, which otherwise turns a
+  # valid image upload into Payload's generic FileUploadError. The deploy user
+  # already controls Docker, so use the image's root user only for this narrow
+  # ownership repair before starting the app.
+  log_info "Preparing media storage permissions …"
+  $COMPOSE run --rm --user root --entrypoint /bin/sh app -c \
+    'mkdir -p /app/media && chown -R 1001:1001 /app/media && chmod 775 /app/media' || return 1
   log_info "Running database migrations …"
   $COMPOSE run --rm app npm run migrate || return 1
   log_info "Starting containers …"