lazysite

Site doctor

The install health and permissions checker, with safe automatic fixes.

Site doctor

lazysite-check verifies that a site's docroot is set up so the web-server CGI identity can read its configuration and write what it must write (cache, logs, locks, secrets), that secrets are hidden from other users, and that the manager is bootstrapped. Run it through the CLI or directly:

lazysite check --docroot /path/to/public_html
perl tools/lazysite-check.pl --docroot /path/to/public_html [--fix]

Options: --cgibin PATH (default <docroot>/../cgi-bin), --owner USER and --group GROUP (defaults derived from the docroot itself), --fix, --check-dav URL, --dependencies.

Evaluated as the CGI identity

Every effective-access check is computed by ownership-and-mode arithmetic for the CGI user, never by the process's own -r/-w/-x tests - run as root, those answer for root, which bypasses permissions and would silently pass files the CGI cannot actually use.

What it evaluates

  • ownership of the lazysite/ tree (no foreign-owned files)
  • the dirs the CGI must write: group-writable, setgid, correct group, traversable, including every level of the template compile cache
  • secrets: readable by the CGI yet closed to world access (including the session registry and revocation files); the user store must never be world-writable
  • lazysite.conf present and readable by the CGI; the cgi-bin scripts present and executable
  • manager bootstrap (group, user, password) and the manager layout present and usable by the CGI
  • content-history repo health: lazysite/auth excluded, repo internals usable by the CGI, shared-repository mode set
  • system pages (login, claim, 40x) resolving via the fallback chain, and OAuth/remote-discovery coherence of site_url
  • content provenance: which pages are pristine seeds, customised, or operator-authored (never touched by upgrades)

Two opt-in probes: --check-dav URL requests URL/dav/ unauthenticated and expects a 401 challenge (route wired) rather than a 404 (front-end does not forward /dav/); --dependencies reports the OS Perl packages lazysite needs, present versus missing, with the install line - no docroot required.

Report versus --fix

A plain run prints one OK / WARN / FAIL line per check with a remediation hint, and exits non-zero if anything FAILs. With --fix it applies the safe repairs - chmod always, chown only when run as root - then re-runs every check (repeating until stable), so the printed report reflects the post-fix state.

When to run it

Run the doctor after a hand-run or tarball install, after moving or restoring a site tree, or whenever the manager reports it cannot write something. Sites provisioned with the lazysite CLI are owned correctly by construction, so there the doctor is a diagnostic, and routine --fix runs are unnecessary.