SocialSecretary — Filesystem Manifest

socialsecretary.pub, as of 2026-09-20

Every path on the server that belongs to SocialSecretary or to the project site, with who owns it, what mode it has, and — the column that explains the other two — what writes to it at runtime. zdat's paths are not here; they are zdat's manifest's.

The rule behind every row: a file is owned by whatever writes it, and by root if nothing does. Static files are root's because nothing running on the server should be able to change them. Everything under /opt/socialsecretary is secretary's because Secretary writes there, and the systemd unit (ProtectSystem=strict, ReadWritePaths=/opt/socialsecretary) makes the rest of the filesystem read-only to it regardless of ownership.

Modes: directories 755 unless noted; files 644 unless noted. The actor data directories carry the setgid bit (2775, shown by ls as drwxrwsr-x) from their creation in April; it is harmless — new files inherit the secretary group, which is the group that should own them — and is left as found.

The service — /opt/socialsecretary/

Owner secretary:secretary throughout.

Actor state — /opt/socialsecretary/actors/socialsecretary.pub/rob/

Owner secretary:secretary throughout. Created by Secretary on first run.

The service user's home — /opt/secretary/

The unit — /etc/systemd/system/

The project site — /opt/sites/socialsecretary.pub/public/

Owner root:root throughout. Read by Caddy (caddy user, via world-read). Nothing running writes here. All updates are by hand as root, or by the release procedure.

Caddy — /etc/caddy/

Verifying this manifest

All of the following, run together in one pass, is tools/audit-permissions.sh — it exits non-zero if anything below would have printed. The blocks here stay as a fallback for a box that doesn't have the script yet, and as the reference the script is checked against, not the other way around: if the two ever disagree, this table and these blocks are what's right, and the script gets fixed to match — see docs/LEDGER.md L-033 for why that order matters (the reverse, script-as-ground-truth, is how a real drift went unnoticed for months).

Run on the server. Anything printed is a deviation.

# Nothing under /opt/socialsecretary owned by anyone but secretary
sudo find /opt/socialsecretary ! -user secretary -o ! -group secretary

# The private key is 600 and nothing else under keys/ is more permissive than 644
sudo find /opt/socialsecretary/keys -type f ! -name private.pem ! -perm 644
sudo find /opt/socialsecretary/keys -name private.pem ! -perm 600

# No data file under the actor directory is executable
sudo find /opt/socialsecretary/actors -type f -perm /111

# log/ is narrower than the rest of actors/: 2750 not 2775, 640 not 664
# (log.mjs's own design; L-033 found a file that had drifted to 664)
sudo find /opt/socialsecretary/actors -type d -name log ! -perm 2750
sudo find /opt/socialsecretary/actors -path '*/log/*' -type f ! -perm 640

# Nothing under the site root owned by anyone but root, or writable by anyone but root
sudo find /opt/sites/socialsecretary.pub/public ! -user root -o ! -group root
sudo find /opt/sites/socialsecretary.pub/public -perm /022

# The unit and the Caddyfile are root's and not world-writable
ls -l /etc/systemd/system/socialsecretary.service /etc/caddy/Caddyfile

To restore the whole state in one pass, in the order it matters — the broad actors/ sweep first, then the log/ exception narrowed back down afterward, because a later find wins over an earlier one on the same files:

sudo chown -R secretary:secretary /opt/socialsecretary
sudo find /opt/socialsecretary -type d -exec chmod 755 {} \;
sudo find /opt/socialsecretary -type f -exec chmod 644 {} \;
sudo chmod 755 /opt/socialsecretary/tools/make-release.sh
sudo chmod 755 /opt/socialsecretary/tools/audit-permissions.sh
sudo chmod 600 /opt/socialsecretary/keys/socialsecretary.pub/rob/private.pem
sudo find /opt/socialsecretary/actors -type d -exec chmod 2775 {} \;
sudo find /opt/socialsecretary/actors -type f -exec chmod 664 {} \;
sudo find /opt/socialsecretary/actors -type d -name log -exec chmod 2750 {} \;
sudo find /opt/socialsecretary/actors -path '*/log/*' -type f -exec chmod 640 {} \;
sudo chown -R root:root /opt/sites/socialsecretary.pub/public
sudo find /opt/sites/socialsecretary.pub/public -type d -exec chmod 755 {} \;
sudo find /opt/sites/socialsecretary.pub/public -type f -exec chmod 644 {} \;

The second block is idempotent and safe to run at any time; it is what sudo chown -R in OPERATOR §2.1 is shorthand for. Before L-033, this block had the same drift its own actors/ sweep would have caused — resetting log/ to 2775/664 — since written before that exception existed; running it today does the same broad sweep, then correctly narrows log/ back down in the two lines added for it, rather than leaving log/ wherever the sweep left it.