fix: set group-writable permissions on shared storage during deploy

.deployer/inventory.yml

@@ -1,5 +1,6 @@
 servers:
-  - name: deployerphp
+  -
+    name: deployerphp
     host: 165.245.136.228
     port: 22
     username: root
@@ -8,7 +9,8 @@ servers:
     dropletId: 547535778
     instanceId: null
 sites:
-  - domain: deployerphp.com
+  -
+    domain: deployerphp.com
     server: deployerphp
     repo: 'git@github.com:loadinglucian/deployerphp.com.git'
     branch: main

.deployer/scripts/deploy.sh

@@ -18,6 +18,34 @@ set -euo pipefail
 #
 # You're automatically in the DEPLOYER_RELEASE_PATH directory at this point:
 
+#
+# Permissions helper
+# ----
+#
+# Code runs with PHP-FPM as `www-data` while deploy commands run as
+# `deployer`. In DeployerPHP setups, `www-data` is added to the
+# `deployer` group so both can write to shared runtime paths.
+#
+# This helper keeps shared writable trees consistent:
+# - Directories: `2775` (`rwxrwxr-x` + SGID bit)
+# - Files: `664` (`rw-rw-r--`)
+#
+# The leading `2` in `2775` enables SGID on directories, so newly created
+# files/directories inherit the parent directory group instead of the creator's
+# primary group.
+
+set_group_writable_tree() {
+	local path="$1"
+
+	if [[ ! -d "${path}" ]]; then
+		return
+	fi
+
+	# Keep shared writable trees group-writable and SGID so new entries inherit group.
+	find "${path}" -type d -exec chmod 2775 {} +
+	find "${path}" -type f -exec chmod 664 {} +
+}
+
 # ----
 # Framework Detection
 # ----
@@ -41,7 +69,10 @@ if [[ $framework == "laravel" ]]; then
 	echo "→ Ensuring shared storage directories..."
 	mkdir -p "${DEPLOYER_SHARED_PATH}/storage/"{app,framework,logs}
 	mkdir -p "${DEPLOYER_SHARED_PATH}/storage/framework/"{cache,sessions,views}
-	mkdir -p "${DEPLOYER_SHARED_PATH}/storage/framework/cache/docs-output/.locks"
+    mkdir -p "${DEPLOYER_SHARED_PATH}/storage/framework/cache/docs-output/.locks"
+
+	# Make shared storage writable for both deploy user and PHP-FPM group member:
+	set_group_writable_tree "${DEPLOYER_SHARED_PATH}/storage"
 
 	echo "→ Linking shared storage..."
 	rm -rf "${DEPLOYER_RELEASE_PATH}/storage"
@@ -51,6 +82,10 @@ if [[ $framework == "laravel" ]]; then
 	mkdir -p "${DEPLOYER_SHARED_PATH}/database"
 	touch "${DEPLOYER_SHARED_PATH}/database/database.sqlite"
 
+	# Keep sqlite path writable for both deploy user and PHP-FPM group member:
+	chmod 2775 "${DEPLOYER_SHARED_PATH}/database"
+	chmod 664 "${DEPLOYER_SHARED_PATH}/database/database.sqlite"
+
 	echo "→ Linking shared database.sqlite..."
 	ln -sf "${DEPLOYER_SHARED_PATH}/database/database.sqlite" "${DEPLOYER_RELEASE_PATH}/database/database.sqlite"
 fi
@@ -129,9 +164,12 @@ if [[ $framework == "laravel" ]]; then
 	echo "→ Optimizing..."
 	"${DEPLOYER_PHP}" artisan optimize:clear
 	"${DEPLOYER_PHP}" artisan optimize
+    "${DEPLOYER_PHP}" artisan docs:clear
+
+	# Artisan commands can create new cache/session/log paths. Re-apply permissions
+	# to keep shared storage writable for both deploy user and PHP-FPM group member:
+	set_group_writable_tree "${DEPLOYER_SHARED_PATH}/storage"
 
-	echo "→ Clearing docs output cache..."
-	"${DEPLOYER_PHP}" artisan docs:clear
 fi
 
 # Symfony (uncomment as needed)