fix provisioning

internal/app/deploy_service.go

@@ -107,7 +107,7 @@ func (a *App) buildProjectBinary(p Project) error {
 		return err
 	}
 	binaryPath := filepath.Join(binDir, "app")
-	if err := runCmd("go", "-C", repoDir, "build", "-o", binaryPath, "."); err != nil {
+	if err := runGoBuildForUser(p.UnixUser, repoDir, binaryPath); err != nil {
 		return fmt.Errorf("build failed: %w", err)
 	}
 	if err := ensureOwnedByUnixUser(binaryPath, p.UnixUser, 0o755); err != nil {
@@ -156,3 +156,32 @@ func (a *App) repoURLForGitAuth(repoURL string) string {
 	u.User = url.UserPassword(a.cfg.ForgejoGitUsername, a.cfg.ForgejoToken)
 	return u.String()
 }
+
+func runGoBuildForUser(unixUser, repoDir, binaryPath string) error {
+	homeDir, err := homeForUnixUser(unixUser)
+	if err != nil {
+		return err
+	}
+	goPath := filepath.Join(homeDir, "go")
+	goModCache := filepath.Join(goPath, "pkg", "mod")
+	goCache := filepath.Join(homeDir, ".cache", "go-build")
+
+	for _, dir := range []string{goPath, goModCache, goCache} {
+		if err := os.MkdirAll(dir, 0o755); err != nil {
+			return err
+		}
+		if err := ensureOwnedByUnixUser(dir, unixUser, 0o755); err != nil {
+			return err
+		}
+	}
+
+	return runCmd(
+		"sudo", "-n", "-u", unixUser,
+		"env",
+		"HOME="+homeDir,
+		"GOPATH="+goPath,
+		"GOMODCACHE="+goModCache,
+		"GOCACHE="+goCache,
+		"go", "-C", repoDir, "build", "-o", binaryPath, ".",
+	)
+}