permissions are hard

internal/app/systemd_service.go

@@ -52,6 +52,15 @@ func (a *App) renderSystemdForProject(ctx context.Context, p Project) error {
 	if err := os.WriteFile(envPath, []byte(b.String()), 0o600); err != nil {
 		return err
 	}
+	if err := ensureOwnedByUnixUser(projectDir, p.UnixUser, 0o755); err != nil {
+		return err
+	}
+	if err := ensureOwnedByUnixUser(dataDir, p.UnixUser, 0o755); err != nil {
+		return err
+	}
+	if err := ensureOwnedByUnixUser(envPath, p.UnixUser, 0o600); err != nil {
+		return err
+	}
 
 	unit := fmt.Sprintf(`[Unit]
 Description=Project %s
@@ -81,6 +90,9 @@ WantedBy=default.target
 	if err := os.WriteFile(servicePath, []byte(unit), 0o644); err != nil {
 		return err
 	}
+	if err := ensureOwnedByUnixUser(servicePath, p.UnixUser, 0o644); err != nil {
+		return err
+	}
 	_ = runSystemctlUser(p.UnixUser, "daemon-reload")
 	_ = runSystemctlUser(p.UnixUser, "enable", "--now", p.ServiceName)
 	return nil
@@ -97,6 +109,25 @@ func homeForUnixUser(username string) (string, error) {
 	return u.HomeDir, nil
 }
 
+func ensureOwnedByUnixUser(path, username string, mode os.FileMode) error {
+	u, err := user.Lookup(username)
+	if err != nil {
+		return fmt.Errorf("lookup unix user %q failed: %w", username, err)
+	}
+	uid, err := strconv.Atoi(u.Uid)
+	if err != nil {
+		return fmt.Errorf("invalid uid for %q: %w", username, err)
+	}
+	gid, err := strconv.Atoi(u.Gid)
+	if err != nil {
+		return fmt.Errorf("invalid gid for %q: %w", username, err)
+	}
+	if err := os.Chown(path, uid, gid); err != nil {
+		return err
+	}
+	return os.Chmod(path, mode)
+}
+
 func userRuntimeEnv(username string) (string, string, error) {
 	u, err := user.Lookup(username)
 	if err != nil {