From c2a1ab464b153390cfc4de516c61ce890be6379b Mon Sep 17 00:00:00 2001
From: Claudio <genitor06@gmail.com>
Date: Mon, 20 Apr 2026 17:11:39 +0200
Subject: [PATCH] Webhook service: allow writes to /etc/caddy

git pull inside the deploy needs to update .git/FETCH_HEAD, but
ProtectSystem=full makes /etc read-only. ReadWritePaths=/etc/caddy
opens just the repo directory.
---
 scripts/webhook/caddy-deploy-webhook.service | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/webhook/caddy-deploy-webhook.service b/scripts/webhook/caddy-deploy-webhook.service
index 1ec6131..97e8b80 100644
--- a/scripts/webhook/caddy-deploy-webhook.service
+++ b/scripts/webhook/caddy-deploy-webhook.service
@@ -9,6 +9,7 @@ Restart=on-failure
 RestartSec=2
 User=root
 ProtectSystem=full
+ReadWritePaths=/etc/caddy
 ProtectHome=true
 NoNewPrivileges=true
 PrivateTmp=true