From e68eaa7067a524fb959f13e786569ae683f6db3f Mon Sep 17 00:00:00 2001
From: MickLesk <47820557+MickLesk@users.noreply.github.com>
Date: Tue, 25 Aug 2026 16:02:48 +0200
Subject: [PATCH] gitea: fix ordering regression, chmod 750 before ln -s broke
 symlink creation

---
 install/gitea-install.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/install/gitea-install.sh b/install/gitea-install.sh
index f4c38d784..cabea2583 100644
--- a/install/gitea-install.sh
+++ b/install/gitea-install.sh
@@ -30,8 +30,12 @@ setup_deb_based() {
   chown -R gitea:gitea /var/lib/gitea/
   chmod -R 750 /var/lib/gitea/
   chown root:gitea /etc/gitea
-  chmod 750 /etc/gitea
+  chmod 770 /etc/gitea
   sudo -u gitea ln -s /var/lib/gitea/data/.ssh/ /etc/gitea/.ssh
+  # sshd's StrictModes rejects pubkey auth if authorized_keys or any parent dir up to
+  # $HOME is group-writable, so 770 can only be transient - tighten it once the gitea
+  # user no longer needs group-write to create the symlink above.
+  chmod 750 /etc/gitea
   msg_ok "Configured Gitea"
 
   msg_info "Creating Service"