fix(perms): stop clone_or_update_repo clobbering home dir with docker group

chgrp/chmod in clone_or_update_repo applied to parent_dir unconditionally,
so cloning into /home/adam/pseudohome ran chgrp -R docker /home/adam and
chmod -R g+w — nuking .ssh permissions (SSH then rejects 770 .ssh dir).

Add group param to clone_or_update_repo and clone_or_update_private_repo_with_key_check;
guard chgrp/chmod block behind `if group`. Callers pass group from constants:
- HWGA repos and docker-related personal repos: group=docker
- pseudohome and dracula: no group (user:user only)

Also tighten module_pseudohome to non-recursive chown on home dir and
re-enforce set_ssh_perms after clone. Restructure PERSONAL_GITHUB_REPOS
from Dict[str,str] to Dict[str,Dict] consistent with HWGA_REPOS.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01F2ixsEtGQH2uBTwv7iXhAv

Author: adamamyl

lib/constants.py

@@ -46,6 +46,7 @@
 HWGA_REPOS: Dict[str, Dict[str, Any]] = {
     "herewegoagain": {
         "user": "no2id-docker",
+        "group": "docker",
         "url": "git@github.com:no2id/herewegoagain.git",
         "dest": f"{ROOT_SRC_CHECKOUT}/herewegoagain",
         "installer": "install",
@@ -54,6 +55,7 @@
     },
     "fake-le": {
         "user": "adam",
+        "group": "docker",
         "url": "git@github.com:adamamyl/fake-le.git",
         "dest": f"{ROOT_SRC_CHECKOUT}/fake-le",
         "installer": "fake-le-for-no2id-docker-installer",
@@ -128,10 +130,19 @@
 
 # Personal GitHub Repos (public, cloned for the 'adam' user).
 # dest is resolved at runtime relative to the target user's home dir.
-PERSONAL_GITHUB_REPOS: Dict[str, str] = {
-    "traefik-proxy": "https://github.com/adamamyl/traefik-proxy.git",
-    "dracula": "https://github.com/adamamyl/dracula.git",
-    "docker-dns-reso": "https://github.com/adamamyl/docker-dns-reso.git",
+# group: set group ownership on the checkout; omit for user-only repos.
+PERSONAL_GITHUB_REPOS: Dict[str, Dict[str, str]] = {
+    "traefik-proxy": {
+        "url": "https://github.com/adamamyl/traefik-proxy.git",
+        "group": "docker",
+    },
+    "dracula": {
+        "url": "https://github.com/adamamyl/dracula.git",
+    },
+    "docker-dns-reso": {
+        "url": "https://github.com/adamamyl/docker-dns-reso.git",
+        "group": "docker",
+    },
 }
 
 # Firewall module:

lib/installer_utils/git_tools.py

@@ -7,12 +7,13 @@
 from .repo_utils import _display_key_and_url_for_repo
 import time # For retry sleep
 
-def clone_or_update_repo(exec_obj: Executor, 
-                         repo_url: str, 
-                         dest_dir: str, 
-                         ssh_key_path: Optional[str] = None, 
+def clone_or_update_repo(exec_obj: Executor,
+                         repo_url: str,
+                         dest_dir: str,
+                         ssh_key_path: Optional[str] = None,
                          extra_git_flags: Optional[str] = "",
-                         user: Optional[str] = None) -> None:
+                         user: Optional[str] = None,
+                         group: Optional[str] = None) -> None:
     """
     Clones or updates a Git repository, handling SSH deploy keys if specified.
     
@@ -34,10 +35,12 @@ def clone_or_update_repo(exec_obj: Executor,
     # 1. Ensure parent dir exists and has correct group/permissions
     exec_obj.run(f"mkdir -p {parent_dir}", force_sudo=True)
 
-    # Use 'docker' group and ensure recursive chmod
-    exec_obj.run(f"chgrp -R docker {parent_dir} || true", force_sudo=True)
-    exec_obj.run(f"chmod -R g+w {parent_dir}", force_sudo=True)
-    exec_obj.run(f"chmod -R -s {parent_dir} || true", force_sudo=True)
+    # Set group ownership and ensure group-writeable; only when a group is explicitly requested.
+    # Never apply to home directories — callers that need a specific group (e.g. docker) pass it.
+    if group:
+        exec_obj.run(f"chgrp -R {group} {parent_dir} || true", force_sudo=True)
+        exec_obj.run(f"chmod -R g+w {parent_dir}", force_sudo=True)
+        exec_obj.run(f"chmod -R -s {parent_dir} || true", force_sudo=True)
 
     # 2. Prepare environment prefix for SSH key usage
     env_prefix = "" 
@@ -86,13 +89,14 @@ def clone_or_update_repo(exec_obj: Executor,
         exec_obj.run(final_cmd, user=user)
         log.success(f"Repository cloned: {dest_dir}")
 
-def clone_or_update_private_repo_with_key_check(exec_obj: Executor, 
-                                               repo_url: str, 
-                                               dest_dir: str, 
-                                               ssh_key_path: str, 
+def clone_or_update_private_repo_with_key_check(exec_obj: Executor,
+                                               repo_url: str,
+                                               dest_dir: str,
+                                               ssh_key_path: str,
                                                repo_name: str,
                                                extra_git_flags: Optional[str] = "",
-                                               user: str = "root") -> None:
+                                               user: str = "root",
+                                               group: Optional[str] = None) -> None:
     """
     Attempts to clone a private repo. If it fails due to SSH permission,
     it prompts the user to add the deploy key and retries the clone once.
@@ -108,12 +112,13 @@ def clone_or_update_private_repo_with_key_check(exec_obj: Executor,
                 f"(Attempt {attempt + 1}/{MAX_CLONE_ATTEMPTS})..."
             )
             clone_or_update_repo(
-                exec_obj, 
-                repo_url, 
-                dest_dir, 
+                exec_obj,
+                repo_url,
+                dest_dir,
                 ssh_key_path=ssh_key_path,
                 extra_git_flags=extra_git_flags,
-                user=user
+                user=user,
+                group=group,
             )
             clone_succeeded = True
             break # Exit loop on success

lib/installer_utils/module_no2id.py

@@ -53,13 +53,14 @@ def setup_no2id(exec_obj: Executor) -> None:
         ssh_key_path = os.path.join(ssh_dir, repo_name)
 
         clone_or_update_private_repo_with_key_check(
-            exec_obj, 
-            repo_url, 
-            dest_dir, 
+            exec_obj,
+            repo_url,
+            dest_dir,
             ssh_key_path=ssh_key_path,
             repo_name=repo_name,
             extra_git_flags=extra_flags,
-            user=user # Execute as target user
+            user=user,
+            group=config.get('group'),
         )
 
         # --- NEW STEP: Configure local Git SSH key for subsequent pulls/fetches ---

lib/installer_utils/module_personal_repos.py

@@ -11,7 +11,9 @@
 
 
 def _setup_repo(exec_obj: Executor, key: str) -> None:
-    url = PERSONAL_GITHUB_REPOS[key]
+    config = PERSONAL_GITHUB_REPOS[key]
+    url = config["url"]
+    group = config.get("group")
     user_home = Path(f"~{PERSONAL_REPOS_USER}").expanduser()
     projects_dir = user_home / "projects"
     dest = str(projects_dir / key)
@@ -22,8 +24,10 @@ def _setup_repo(exec_obj: Executor, key: str) -> None:
     )
 
     log.info(f"Cloning/updating {key}...")
-    clone_or_update_repo(exec_obj, url, dest, user=PERSONAL_REPOS_USER)
+    clone_or_update_repo(exec_obj, url, dest, user=PERSONAL_REPOS_USER, group=group)
     exec_obj.run(f"chown -R {PERSONAL_REPOS_USER}:{PERSONAL_REPOS_USER} {dest}", force_sudo=True)
+    if group:
+        exec_obj.run(f"chgrp -R {group} {dest}", force_sudo=True)
     log.success(f"{key} ready at {dest}.")
 
 

lib/installer_utils/module_pseudohome.py

@@ -71,9 +71,11 @@ def setup_pseudohome(exec_obj: Executor) -> None:
         user=user,  # Execute as 'adam'
     )
 
-    # 6. Fix permissions
-    exec_obj.run(f"chown -R {user}:{user} {os.path.dirname(dest_dir)}", force_sudo=True)
+    # 6. Fix permissions: home dir ownership (non-recursive — must not clobber .ssh),
+    # then repo contents, then re-enforce .ssh in case anything above touched it.
+    exec_obj.run(f"chown {user}:{user} {os.path.dirname(dest_dir)}", force_sudo=True)
     set_homedir_perms_recursively(exec_obj, user, dest_dir)
+    set_ssh_perms(exec_obj, user, ssh_dir)
 
     # 7. Run installer script (as the user)
     installer_path = os.path.join(dest_dir, PSEUDOHOME_INSTALLER)