fix(deploy): конфиг в /opt/security-alert-center/config (sac:sac)

Убирает ошибку Permission denied при каталоге /etc root:root.

backend/README.md

@@ -11,7 +11,7 @@ FastAPI + PostgreSQL + Alembic.
 ```bash
 cd /opt/security-alert-center/backend
 python3.12 -m venv .venv && .venv/bin/pip install -r requirements.txt
-# /etc/security-alert-center/sac-api.env — см. deploy/env.native.example
+# /opt/security-alert-center/config/sac-api.env — см. deploy/env.native.example
 alembic upgrade head
 systemctl start sac-api
 ```

deploy/.env.example

@@ -1,5 +1,5 @@
 # Только для Docker Compose (см. docs/install-ubuntu-24.04-docker.md).
-# Production native: deploy/env.native.example → /etc/security-alert-center/sac-api.env
+# Production native: deploy/env.native.example → /opt/security-alert-center/config/sac-api.env
 
 # PostgreSQL
 POSTGRES_USER=sac

deploy/README.md

@@ -3,7 +3,7 @@
 ## Production (native) — основной путь
 
 1. [docs/install-ubuntu-24.04-native.md](../docs/install-ubuntu-24.04-native.md)
-2. `deploy/env.native.example` → `/etc/security-alert-center/sac-api.env`
+2. `deploy/env.native.example` → `/opt/security-alert-center/config/sac-api.env`
 3. `deploy/systemd/sac-api.service` → `/etc/systemd/system/`
 4. `deploy/nginx/sac.conf.example` → `/etc/nginx/sites-available/sac`
 

deploy/env.native.example

@@ -1,6 +1,6 @@
-# Native (systemd): скопировать в /etc/security-alert-center/sac-api.env
+# Native: /opt/security-alert-center/config/sac-api.env
-# sudo chown root:sac /etc/security-alert-center/sac-api.env
+# sudo chown sac:sac /opt/security-alert-center/config/sac-api.env
-# sudo chmod 640 /etc/security-alert-center/sac-api.env
+# sudo chmod 600 /opt/security-alert-center/config/sac-api.env
 
 DATABASE_URL=postgresql+psycopg2://sac:CHANGE_ME_POSTGRES_PASSWORD@127.0.0.1:5432/sac
 

deploy/systemd/sac-api.service

@@ -10,7 +10,7 @@ Type=simple
 User=sac
 Group=sac
 WorkingDirectory=/opt/security-alert-center/backend
-EnvironmentFile=/etc/security-alert-center/sac-api.env
+EnvironmentFile=/opt/security-alert-center/config/sac-api.env
 Environment=PYTHONPATH=/opt/security-alert-center/backend
 ExecStart=/opt/security-alert-center/backend/.venv/bin/uvicorn app.main:app --host 127.0.0.1 --port 8000
 Restart=on-failure

docs/deployment.md

@@ -14,7 +14,7 @@
 
 ```
 deploy/
-  env.native.example      → /etc/security-alert-center/sac-api.env
+  env.native.example      → /opt/security-alert-center/config/sac-api.env
   systemd/sac-api.service → /etc/systemd/system/
   nginx/sac.conf.example  → /etc/nginx/sites-available/sac
 ```
@@ -106,7 +106,7 @@ curl -sS https://sac.kalinamall.ru/health
 ```bash
 cd /opt/security-alert-center && sudo -u sac git pull
 sudo -u sac backend/.venv/bin/pip install -r backend/requirements.txt
-sudo -u sac bash -c 'set -a; source /etc/security-alert-center/sac-api.env; set +a; cd backend && .venv/bin/alembic upgrade head'
+sudo -u sac bash -c 'set -a; source /opt/security-alert-center/config/sac-api.env; set +a; cd backend && .venv/bin/alembic upgrade head'
 sudo systemctl restart sac-api
 ```
 

docs/install-ubuntu-24.04-native.md

@@ -118,17 +118,26 @@ sudo -u sac .venv/bin/pip install -r requirements.txt
 
 ---
 
-## 6. Конфигурация `/etc/security-alert-center`
+## 6. Конфигурация
+
+Файл лежит **в каталоге приложения** (владелец `sac`) — так проще, чем права на `/etc/...`.
 
 ```bash
-sudo mkdir -p /etc/security-alert-center
+sudo mkdir -p /opt/security-alert-center/config
-sudo cp /opt/security-alert-center/deploy/env.native.example /etc/security-alert-center/sac-api.env
+sudo cp /opt/security-alert-center/deploy/env.native.example \
-sudo nano /etc/security-alert-center/sac-api.env
+  /opt/security-alert-center/config/sac-api.env
-# Каталог и файл: группа sac должна иметь доступ (иначе Permission denied у пользователя sac)
+sudo nano /opt/security-alert-center/config/sac-api.env
-sudo chown root:sac /etc/security-alert-center
+sudo chown sac:sac /opt/security-alert-center/config/sac-api.env
-sudo chmod 750 /etc/security-alert-center
+sudo chmod 600 /opt/security-alert-center/config/sac-api.env
-sudo chown root:sac /etc/security-alert-center/sac-api.env
+```
-sudo chmod 640 /etc/security-alert-center/sac-api.env
+
+Если уже создавали `/etc/security-alert-center/sac-api.env` — перенесите:
+
+```bash
+sudo mkdir -p /opt/security-alert-center/config
+sudo cp /etc/security-alert-center/sac-api.env /opt/security-alert-center/config/sac-api.env
+sudo chown sac:sac /opt/security-alert-center/config/sac-api.env
+sudo chmod 600 /opt/security-alert-center/config/sac-api.env
 ```
 
 Обязательно задать:
@@ -146,29 +155,16 @@ sudo chmod 640 /etc/security-alert-center/sac-api.env
 Проверка, что `sac` читает конфиг (должно быть без `Permission denied`):
 
 ```bash
-sudo -u sac test -r /etc/security-alert-center/sac-api.env && echo OK
+ls -la /opt/security-alert-center/config/sac-api.env
+# должно быть: -rw------- sac sac
+sudo -u sac test -r /opt/security-alert-center/config/sac-api.env && echo OK
 ```
 
 Миграции:
 
 ```bash
 cd /opt/security-alert-center/backend
-sudo -u sac bash -c 'set -a; source /etc/security-alert-center/sac-api.env; set +a; .venv/bin/alembic upgrade head'
+sudo -u sac bash -c 'set -a; source /opt/security-alert-center/config/sac-api.env; set +a; .venv/bin/alembic upgrade head'
-```
-
-Если снова `Permission denied` — проверьте **каталог** (не только файл):
-
-```bash
-namei -l /etc/security-alert-center/sac-api.env
-# у каталога security-alert-center должны быть root:sac и drwxr-x---
-sudo chown root:sac /etc/security-alert-center
-sudo chmod 750 /etc/security-alert-center
-```
-
-Разовый обход для миграции (от root, если срочно):
-
-```bash
-sudo bash -c 'set -a; source /etc/security-alert-center/sac-api.env; set +a; cd /opt/security-alert-center/backend && .venv/bin/alembic upgrade head'
 ```
 
 ---
@@ -268,7 +264,7 @@ EOF
 cd /opt/security-alert-center
 sudo -u sac git pull
 sudo -u sac backend/.venv/bin/pip install -r backend/requirements.txt
-sudo -u sac bash -c 'set -a; source /etc/security-alert-center/sac-api.env; set +a; cd backend && .venv/bin/alembic upgrade head'
+sudo -u sac bash -c 'set -a; source /opt/security-alert-center/config/sac-api.env; set +a; cd backend && .venv/bin/alembic upgrade head'
 sudo systemctl restart sac-api
 ```
 
@@ -280,7 +276,7 @@ sudo systemctl restart sac-api
 - [ ] ufw: 22, 80, 443
 - [ ] PostgreSQL: БД `sac`, пользователь `sac`
 - [ ] venv, зависимости установлены
-- [ ] `/etc/security-alert-center/sac-api.env`, chmod 600
+- [ ] `/opt/security-alert-center/config/sac-api.env`, владелец `sac:sac`, chmod 600
 - [ ] `alembic upgrade head` без ошибок
 - [ ] `sac-api` active (systemd)
 - [ ] nginx + TLS
@@ -293,7 +289,7 @@ sudo systemctl restart sac-api
 
 | Симптом | Действие |
 |---------|----------|
-| `sac-api.env: Permission denied` | `chown root:sac` и `chmod 750` на **каталог** `/etc/security-alert-center`, `chmod 640` на файл |
+| `sac-api.env: Permission denied` | Конфиг в `/opt/security-alert-center/config/`, `chown sac:sac`, `chmod 600`. Не используйте `/etc/...` с каталогом `root:root` |
 | `password authentication failed for user sac` | Пароль в `DATABASE_URL` ≠ пароль в PostgreSQL; или `.env` не прочитан (тогда берётся дефолт `sac:sac`). Исправить пароль: `sudo -u postgres psql -c "ALTER USER sac PASSWORD '...';"` и обновить `DATABASE_URL` |
 | `database: error` / SQLAlchemy connect | `systemctl status postgresql`; проверить `DATABASE_URL` после успешного `source` |
 | 401 ingest | ключ в `Authorization: Bearer`; проверить `SAC_BOOTSTRAP_API_KEY` |

docs/install-ubuntu-24.04.md

@@ -15,7 +15,7 @@
 # см. полный чеклист в native-руководстве
 sudo apt update && sudo apt install -y git postgresql nginx python3.12 python3.12-venv
 sudo git clone https://git.kalinamall.ru/PapaTramp/security-alert-center.git /opt/security-alert-center
-# … PostgreSQL, venv, /etc/security-alert-center/sac-api.env, systemd, nginx
+# … PostgreSQL, venv, config/sac-api.env, systemd, nginx
 ```
 
 ## См. также