From 2f7d018c70d1e505219db3a6d95676c83b2b2bb9 Mon Sep 17 00:00:00 2001
From: Zaine Arch <zaineulabideen@outlook.com>
Date: Fri, 8 May 2026 23:57:56 +0100
Subject: [PATCH] password

---
 .gitea/workflows/build.yml |  1 +
 scripts/deploy-systemd.sh  | 24 ++++++++++++++++--------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 307ff0d..ab5c177 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -16,6 +16,7 @@ jobs:
     env:
       APP_HOME: /home/zaine/master-folder/projects/java_projects/org_backend
       SERVICE_NAME: org-backend.service
+      SUDO_PASSWORD: ${{ secrets.SUDO_PASSWORD }}
 
     steps:
       - uses: actions/checkout@v4
diff --git a/scripts/deploy-systemd.sh b/scripts/deploy-systemd.sh
index 497a964..44627ab 100755
--- a/scripts/deploy-systemd.sh
+++ b/scripts/deploy-systemd.sh
@@ -12,6 +12,14 @@ APP_JAR="${APP_TARGET_DIR}/org-backend.jar"
 SOURCE_SERVICE="${SOURCE_DIR}/misc/${SERVICE_NAME}"
 SYSTEMD_SERVICE="/etc/systemd/system/${SERVICE_NAME}"
 
+run_sudo() {
+  if [[ -n "${SUDO_PASSWORD:-}" ]]; then
+    printf '%s\n' "${SUDO_PASSWORD}" | sudo -S -p '' "$@"
+  else
+    sudo -n "$@"
+  fi
+}
+
 if [[ ! -f "${SOURCE_JAR}" ]]; then
   echo "Missing built jar: ${SOURCE_JAR}" >&2
   exit 1
@@ -31,24 +39,24 @@ else
   echo "Built jar is already in place at ${APP_JAR}"
 fi
 
-echo "Checking passwordless sudo access"
-sudo -n true
+echo "Checking sudo access"
+run_sudo true
 
 echo "Installing systemd unit to ${SYSTEMD_SERVICE}"
-sudo -n install -m 0644 "${SOURCE_SERVICE}" "${SYSTEMD_SERVICE}"
+run_sudo install -m 0644 "${SOURCE_SERVICE}" "${SYSTEMD_SERVICE}"
 
 echo "Reloading systemd"
-sudo -n systemctl daemon-reload
+run_sudo systemctl daemon-reload
 
 echo "Enabling ${SERVICE_NAME}"
-sudo -n systemctl enable "${SERVICE_NAME}"
+run_sudo systemctl enable "${SERVICE_NAME}"
 
 echo "Restarting ${SERVICE_NAME}"
-if ! timeout "${SYSTEMCTL_TIMEOUT}" sudo -n systemctl --no-ask-password restart "${SERVICE_NAME}"; then
+if ! timeout "${SYSTEMCTL_TIMEOUT}" bash -c "$(declare -f run_sudo); run_sudo systemctl --no-ask-password restart \"${SERVICE_NAME}\""; then
   echo "Restart did not finish within ${SYSTEMCTL_TIMEOUT}s" >&2
-  sudo -n systemctl --no-pager --full status "${SERVICE_NAME}" || true
+  run_sudo systemctl --no-pager --full status "${SERVICE_NAME}" || true
   exit 1
 fi
 
 echo "Service status"
-sudo -n systemctl --no-pager --full status "${SERVICE_NAME}"
+run_sudo systemctl --no-pager --full status "${SERVICE_NAME}"