From 9fc08a31455a9593a2f1c8a0b8075364d3e61875 Mon Sep 17 00:00:00 2001 From: sascha Date: Thu, 13 Aug 2026 13:03:28 +0200 Subject: [PATCH 1/3] fix: install TTS bridge secrets with sudo --- app.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app.py b/app.py index 36afdb7..018a069 100644 --- a/app.py +++ b/app.py @@ -1912,7 +1912,7 @@ async def tts_bridge_deploy(req: TTSBridgeDeployRequest, _=Depends(_verify)): "pathlib.Path('/app-config/tts-bridge').mkdir(parents=True,exist_ok=True);" "[(pathlib.Path(p).write_text(v),os.chmod(p,0o600)) for p,v in files.items()]" ) - rc, _out, err = _ssh("sascha@10.5.85.5", f"python3 -c {__import__('shlex').quote(script)}", timeout=30) + rc, _out, err = _ssh("sascha@10.5.85.5", f"sudo python3 -c {__import__('shlex').quote(script)}", timeout=30) if rc != 0: _audit("/tts/bridge/deploy", "POST", 500, "secret installation failed") raise HTTPException(status_code=500, detail="Could not install bridge secrets") From 0e9a42bb4fbb77eba043e4e3c7eec202ec73501f Mon Sep 17 00:00:00 2001 From: sascha Date: Thu, 13 Aug 2026 13:04:49 +0200 Subject: [PATCH 2/3] fix: replace Docker-created secret directories --- app.py | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/app.py b/app.py index 018a069..6a36206 100644 --- a/app.py +++ b/app.py @@ -1905,14 +1905,20 @@ async def tts_bridge_deploy(req: TTSBridgeDeployRequest, _=Depends(_verify)): "/app-config/tts-bridge/butler-token": BUTLER_TOKEN, "/app-config/tts-bridge/client-token": client_token, } - encoded = base64.b64encode(json.dumps(files).encode()).decode() - script = ( - "import base64,json,os,pathlib;" - f"files=json.loads(base64.b64decode('{encoded}'));" - "pathlib.Path('/app-config/tts-bridge').mkdir(parents=True,exist_ok=True);" - "[(pathlib.Path(p).write_text(v),os.chmod(p,0o600)) for p,v in files.items()]" - ) - rc, _out, err = _ssh("sascha@10.5.85.5", f"sudo python3 -c {__import__('shlex').quote(script)}", timeout=30) + installer = """import json, os, pathlib +files = json.loads({files_json!r}) +base = pathlib.Path('/app-config/tts-bridge') +base.mkdir(parents=True, exist_ok=True) +for filename, value in files.items(): + path = pathlib.Path(filename) + if path.is_dir(): + path.rmdir() + path.write_text(value) + os.chmod(path, 0o600) +""".format(files_json=json.dumps(files)) + encoded = base64.b64encode(installer.encode()).decode() + command = f"sudo python3 -c {__import__('shlex').quote(f'import base64;exec(base64.b64decode({encoded!r}))')}" + rc, _out, err = _ssh("sascha@10.5.85.5", command, timeout=30) if rc != 0: _audit("/tts/bridge/deploy", "POST", 500, "secret installation failed") raise HTTPException(status_code=500, detail="Could not install bridge secrets") From cb54a7977a9fa52562bc9279539c34814b5e4e52 Mon Sep 17 00:00:00 2001 From: sascha Date: Thu, 13 Aug 2026 13:09:07 +0200 Subject: [PATCH 3/3] fix: make bridge secrets readable by service uid --- app.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app.py b/app.py index 6a36206..7aa0419 100644 --- a/app.py +++ b/app.py @@ -1914,7 +1914,8 @@ for filename, value in files.items(): if path.is_dir(): path.rmdir() path.write_text(value) - os.chmod(path, 0o600) + os.chown(path, 10001, 10001) + os.chmod(path, 0o400) """.format(files_json=json.dumps(files)) encoded = base64.b64encode(installer.encode()).decode() command = f"sudo python3 -c {__import__('shlex').quote(f'import base64;exec(base64.b64decode({encoded!r}))')}"