fix(agent): unify agent and openresty runtime user as openflare

Introduce the shared openflare service account for the agent process and
OpenResty workers, normalize data_dir ownership on startup, and ensure
managed paths are chowned with 0755/0644 during sync and apply. Docker
entrypoint fixes volume ownership before dropping privileges; local systemd
install runs the service as openflare with CAP_NET_BIND_SERVICE.

cmd/agent/main.go

@@ -16,6 +16,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/httpclient"
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/logging"
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/nginx"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/runtimeuser"
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/state"
 	syncservice "github.com/Rain-kl/Wavelet/internal/apps/agent/sync"
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/updater"
@@ -33,6 +34,14 @@ func main() {
 		slog.Error("load agent config failed", "error", err)
 		os.Exit(1)
 	}
+	if err = runtimeuser.EnsureProcessUser(); err != nil {
+		slog.Error("ensure runtime user failed", "error", err)
+		os.Exit(1)
+	}
+	if err = runtimeuser.EnsurePathOwnership(cfg.DataDir, runtimeuser.DefaultDirPerm, runtimeuser.DefaultFilePerm); err != nil {
+		slog.Error("ensure data dir ownership failed", "error", err, "data_dir", cfg.DataDir)
+		os.Exit(1)
+	}
 	cfg.ExtVersion = nginx.DetectVersion(
 		context.Background(),
 		nginx.ExecutorOptions{

docker/Dockerfile.agent

@@ -25,16 +25,22 @@ RUN --mount=type=cache,target=/go/pkg/mod \
 
 FROM openresty/openresty:alpine
 
-RUN apk add --no-cache ca-certificates tzdata perl libmaxminddb \
+RUN apk add --no-cache ca-certificates tzdata perl libmaxminddb su-exec libcap \
     && ln -sf /usr/lib/libmaxminddb.so.0 /usr/lib/libmaxminddb.so \
     && opm get anjia0532/lua-resty-maxminddb \
-    && mkdir -p /etc/openflare /data
+    && addgroup -S openflare \
+    && adduser -S -G openflare -H -h /data -s /sbin/nologin openflare \
+    && mkdir -p /etc/openflare /data \
+    && chown -R openflare:openflare /etc/openflare /data \
+    && setcap 'cap_net_bind_service=+ep' /usr/local/openresty/nginx/sbin/nginx
 
 ENV OPENFLARE_OPENRESTY_PATH=openresty \
     OPENFLARE_DATA_DIR=/data
 
 COPY --from=builder /build/bin/openflare-agent /usr/local/bin/openflare-agent
+COPY docker/agent-entrypoint.sh /usr/local/bin/openflare-agent-entrypoint.sh
+RUN chmod +x /usr/local/bin/openflare-agent-entrypoint.sh
 
 EXPOSE 80 443 18081
-ENTRYPOINT ["/usr/local/bin/openflare-agent"]
-CMD ["-config", "/etc/openflare/agent.json"]
+ENTRYPOINT ["/usr/local/bin/openflare-agent-entrypoint.sh"]
+CMD ["-config", "/etc/openflare/agent.json"]

docker/agent-entrypoint.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+set -eu
+
+RUNTIME_USER="openflare"
+AGENT_BIN="/usr/local/bin/openflare-agent"
+OPENRESTY_BIN="/usr/local/openresty/nginx/sbin/nginx"
+
+fix_runtime_ownership() {
+  for target in /data /etc/openflare; do
+    if [ -d "$target" ]; then
+      chown -R "${RUNTIME_USER}:${RUNTIME_USER}" "$target" 2>/dev/null || true
+      chmod -R u+rwX,g+rX "$target" 2>/dev/null || true
+    fi
+  done
+}
+
+if [ "$(id -u)" -eq 0 ]; then
+  fix_runtime_ownership
+  exec su-exec "${RUNTIME_USER}" "${AGENT_BIN}" "$@"
+fi
+
+exec "${AGENT_BIN}" "$@"

docs/changelog/index.md

@@ -22,6 +22,8 @@ sidebar: false
 
 ### 修复
 
+- 修复 Agent 与 OpenResty worker 权限不一致导致 Pages/WAF 等静态资源 Permission denied：引入共享运行时用户 `openflare`（Agent 进程、OpenResty worker、文件属主统一）；Docker 入口脚本在启动前修正 volume 属主并降权；本地 systemd 服务以 `openflare` 运行并授予 `CAP_NET_BIND_SERVICE`；`data_dir` 与 `pages_dir` 等路径在同步/Apply 时统一 `chown` 与 `0755/0644` 规范化。
+
 - 修复 Pages 站点根路径 `/` 访问异常：OpenResty 渲染增加 `location = /` 精确匹配；未启用 SPA Fallback 时直接提供入口文件（`index` 指令在 `try_files ... =404` 场景下不生效）；启用 SPA Fallback 时避免 `try_files $uri $uri/ /index.html` 因 `$uri/` 命中站点根目录触发内部重定向循环而返回 500。
 
 - 修复代理路由详情认证配置 Tab：移除 PoW 配置（PoW 仅在 WAF 规则组中设置）；保留 Basic Auth 保存能力；移除页头重复的「保存当前分区」按钮。

internal/apps/agent/nginx/manager.go

@@ -25,6 +25,7 @@ import (
 	"github.com/Rain-kl/Wavelet/pkg/utils"
 
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/protocol"
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/runtimeuser"
 )
 
 // RuntimeConfigDirPlaceholder is substituted into generated configs at apply time.
@@ -187,6 +188,7 @@ const (
 )
 
 const safeDefaultFallbackMainConfig = `# This file is generated by OpenFlare safe default fallback.
+user ` + OpenFlareRuntimeUser + `;
 worker_processes auto;
 pid logs/nginx.pid;
 
@@ -278,64 +280,32 @@ func (m *Manager) writeTargetFiles(mainConfig string, routeConfig string, suppor
 	return m.ensureOpenRestyWorkerReadAccess()
 }
 
-// ensureOpenRestyWorkerReadAccess makes runtime config and Lua paths traversable by the
-// unprivileged OpenResty worker user (typically nobody). Volume mounts may create parent
-// directories as 0700 root-owned; MkdirAll does not fix existing modes.
+// ensureOpenRestyWorkerReadAccess assigns runtime ownership and normalized modes
+// on agent-managed paths so the agent and OpenResty workers share access.
 func (m *Manager) ensureOpenRestyWorkerReadAccess() error {
 	targets := []string{
 		m.RuntimeConfigDir,
 		m.LuaDir,
+		m.PagesDir,
 		filepath.Dir(m.MainConfigPath),
 		filepath.Dir(m.RouteConfigPath),
 	}
 	if m.AccessLogPath != "" {
 		targets = append(targets, filepath.Dir(m.AccessLogPath))
 	}
+	seen := make(map[string]struct{}, len(targets))
 	for _, target := range targets {
-		if err := ensureWorldTraversablePath(target); err != nil {
-			return err
-		}
-	}
-	if strings.TrimSpace(m.RuntimeConfigDir) == "" {
-		return nil
-	}
-	entries, err := os.ReadDir(m.RuntimeConfigDir)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return err
-	}
-	for _, entry := range entries {
-		if entry.IsDir() {
+		cleaned := filepath.Clean(strings.TrimSpace(target))
+		if cleaned == "" || cleaned == "." {
 			continue
 		}
-		path := filepath.Join(m.RuntimeConfigDir, entry.Name())
-		if chmodErr := os.Chmod(path, nginxConfigFilePerm); chmodErr != nil && !os.IsNotExist(chmodErr) {
-			return chmodErr
+		if _, ok := seen[cleaned]; ok {
+			continue
 		}
-	}
-	return nil
-}
-
-func ensureWorldTraversablePath(targetDir string) error {
-	const maxDepth = 12
-	current := filepath.Clean(strings.TrimSpace(targetDir))
-	if current == "" || current == "." {
-		return nil
-	}
-	for depth := 0; depth < maxDepth; depth++ {
-		if err := os.Chmod(current, nginxDirPerm); err != nil {
-			if os.IsNotExist(err) || os.IsPermission(err) {
-				break
-			}
-			return fmt.Errorf("chmod %s: %w", current, err)
+		seen[cleaned] = struct{}{}
+		if err := runtimeuser.EnsurePathOwnership(cleaned, nginxDirPerm, nginxConfigFilePerm); err != nil {
+			return err
 		}
-		parent := filepath.Dir(current)
-		if parent == current {
-			break
-		}
-		current = parent
 	}
 	return nil
 }

internal/apps/agent/nginx/manager_test.go

@@ -979,8 +979,8 @@ func TestEnsureWorldTraversableChainFixesRestrictedParentDirs(t *testing.T) {
 		t.Fatalf("WriteFile failed: %v", err)
 	}
 
-	if err := ensureWorldTraversablePath(runtimeDir); err != nil {
-		t.Fatalf("ensureWorldTraversablePath failed: %v", err)
+	if err := EnsureWorldTraversablePath(runtimeDir); err != nil {
+		t.Fatalf("EnsureWorldTraversablePath failed: %v", err)
 	}
 
 	info, err := os.Stat(filepath.Join(dataDir, "etc"))

internal/apps/agent/nginx/runtime_access.go

@@ -0,0 +1,31 @@
+package nginx
+
+import (
+	openrestyrender "github.com/Rain-kl/Wavelet/pkg/render/openresty"
+
+	"github.com/Rain-kl/Wavelet/internal/apps/agent/runtimeuser"
+)
+
+// OpenFlareRuntimeUser is the shared OS account for the agent process and
+// OpenResty worker processes.
+const OpenFlareRuntimeUser = openrestyrender.OpenFlareRuntimeUser
+
+// OpenRestyWorkerUser is an alias kept for internal call sites.
+const OpenRestyWorkerUser = OpenFlareRuntimeUser
+
+// EnsureWorldTraversablePath makes targetDir and its ancestors world-traversable.
+func EnsureWorldTraversablePath(targetDir string) error {
+	return runtimeuser.EnsurePathOwnership(targetDir, nginxDirPerm, nginxConfigFilePerm)
+}
+
+// EnsureWorkerReadableTree normalizes ownership and modes under root for the
+// shared runtime user.
+func EnsureWorkerReadableTree(rootDir string) error {
+	return runtimeuser.EnsurePathOwnership(rootDir, nginxDirPerm, nginxConfigFilePerm)
+}
+
+// EnsureWorkerReadAccess makes agent-managed runtime paths accessible to the
+// shared runtime user.
+func (m *Manager) EnsureWorkerReadAccess() error {
+	return m.ensureOpenRestyWorkerReadAccess()
+}

internal/apps/agent/nginx/runtime_access_test.go

@@ -0,0 +1,75 @@
+package nginx
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestEnsureWorkerReadableTreeFixesRestrictedPagesFiles(t *testing.T) {
+	tempDir := t.TempDir()
+	pagesDir := filepath.Join(tempDir, "data", "var", "lib", "openflare", "pages")
+	releaseDir := filepath.Join(pagesDir, "deployments", "1", "releases", "abc123")
+	if err := os.MkdirAll(releaseDir, 0o700); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	indexPath := filepath.Join(releaseDir, "index.html")
+	if err := os.WriteFile(indexPath, []byte("<html></html>"), 0o600); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+
+	if err := EnsureWorldTraversablePath(pagesDir); err != nil {
+		t.Fatalf("EnsureWorldTraversablePath failed: %v", err)
+	}
+	if err := EnsureWorkerReadableTree(pagesDir); err != nil {
+		t.Fatalf("EnsureWorkerReadableTree failed: %v", err)
+	}
+
+	info, err := os.Stat(indexPath)
+	if err != nil {
+		t.Fatalf("Stat failed: %v", err)
+	}
+	if info.Mode().Perm() != nginxConfigFilePerm {
+		t.Fatalf("expected index.html mode %o, got %o", nginxConfigFilePerm, info.Mode().Perm())
+	}
+	etcInfo, err := os.Stat(filepath.Join(tempDir, "data", "var"))
+	if err != nil {
+		t.Fatalf("Stat var failed: %v", err)
+	}
+	if etcInfo.Mode().Perm()&0o005 == 0 {
+		t.Fatalf("expected var directory to be world-traversable, got %o", etcInfo.Mode().Perm())
+	}
+}
+
+func TestManagerEnsureWorkerReadAccessIncludesPagesDir(t *testing.T) {
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "data")
+	pagesRoot := filepath.Join(dataDir, "var", "lib", "openflare", "pages")
+	releaseDir := filepath.Join(pagesRoot, "deployments", "1", "releases", "abc123")
+	if err := os.MkdirAll(releaseDir, 0o700); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(releaseDir, "index.html"), []byte("ok"), 0o600); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+
+	manager := &Manager{PagesDir: pagesRoot}
+	if err := manager.EnsureWorkerReadAccess(); err != nil {
+		t.Fatalf("EnsureWorkerReadAccess failed: %v", err)
+	}
+
+	info, err := os.Stat(filepath.Join(tempDir, "data"))
+	if err != nil {
+		t.Fatalf("Stat data failed: %v", err)
+	}
+	if info.Mode().Perm()&0o005 == 0 {
+		t.Fatalf("expected data directory to be world-traversable, got %o", info.Mode().Perm())
+	}
+	indexInfo, err := os.Stat(filepath.Join(releaseDir, "index.html"))
+	if err != nil {
+		t.Fatalf("Stat index failed: %v", err)
+	}
+	if indexInfo.Mode().Perm() != nginxConfigFilePerm {
+		t.Fatalf("expected index.html mode %o, got %o", nginxConfigFilePerm, indexInfo.Mode().Perm())
+	}
+}

internal/apps/agent/runtimeuser/runtimeuser.go

@@ -0,0 +1,111 @@
+// Package runtimeuser defines the shared OS account used by the agent process
+// and OpenResty worker processes so file ownership stays aligned.
+package runtimeuser
+
+import (
+	"errors"
+	"fmt"
+	"log/slog"
+	"os"
+	"os/user"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	openrestyrender "github.com/Rain-kl/Wavelet/pkg/render/openresty"
+)
+
+// Name is the dedicated service account shared by the agent and OpenResty workers.
+const Name = openrestyrender.OpenFlareRuntimeUser
+
+const (
+	// DefaultDirPerm is the normalized permission for runtime directories.
+	DefaultDirPerm = 0o755
+	// DefaultFilePerm is the normalized permission for runtime files.
+	DefaultFilePerm = 0o644
+)
+
+// Account holds the resolved UID/GID for Name on the current host.
+type Account struct {
+	Name string
+	UID  int
+	GID  int
+}
+
+// Lookup resolves the runtime account on the current host.
+func Lookup() (*Account, error) {
+	record, err := user.Lookup(Name)
+	if err != nil {
+		return nil, fmt.Errorf("lookup %s: %w", Name, err)
+	}
+	uid, err := strconv.Atoi(record.Uid)
+	if err != nil {
+		return nil, fmt.Errorf("parse uid for %s: %w", Name, err)
+	}
+	gid, err := strconv.Atoi(record.Gid)
+	if err != nil {
+		return nil, fmt.Errorf("parse gid for %s: %w", Name, err)
+	}
+	return &Account{Name: Name, UID: uid, GID: gid}, nil
+}
+
+// CurrentEUID returns the effective UID of the current process.
+func CurrentEUID() int {
+	return os.Geteuid()
+}
+
+// IsRuntimeUser reports whether the current process runs as Name.
+func IsRuntimeUser() bool {
+	account, err := Lookup()
+	if err != nil {
+		return false
+	}
+	return os.Geteuid() == account.UID
+}
+
+// EnsureProcessUser drops from root to Name when possible so the agent writes
+// files with the same ownership OpenResty workers read.
+func EnsureProcessUser() error {
+	account, err := Lookup()
+	if err != nil {
+		slog.Warn("runtime user unavailable, agent continues as current user", "user", Name, "euid", os.Geteuid(), "error", err)
+		return nil
+	}
+	if os.Geteuid() == account.UID {
+		slog.Info("agent running as runtime user", "user", Name, "uid", account.UID)
+		return nil
+	}
+	if os.Geteuid() != 0 {
+		slog.Warn("agent is not running as runtime user", "expected", Name, "euid", os.Geteuid())
+		return nil
+	}
+	if dropErr := dropTo(account); dropErr != nil {
+		return dropErr
+	}
+	slog.Info("agent dropped privileges to runtime user", "user", Name, "uid", account.UID)
+	return nil
+}
+
+// EnsurePathOwnership makes root and its ancestors traversable, assigns runtime
+// ownership when running as root, and normalizes directory/file modes.
+func EnsurePathOwnership(root string, dirPerm os.FileMode, filePerm os.FileMode) error {
+	root = filepath.Clean(strings.TrimSpace(root))
+	if root == "" || root == "." {
+		return nil
+	}
+	if err := ensureWorldTraversablePath(root); err != nil {
+		return err
+	}
+	if _, statErr := os.Stat(root); os.IsNotExist(statErr) {
+		return nil
+	}
+	account, lookupErr := Lookup()
+	if lookupErr != nil {
+		var unknown user.UnknownUserError
+		if errors.As(lookupErr, &unknown) {
+			return ensureModesOnly(root, dirPerm, filePerm)
+		}
+		return lookupErr
+	}
+	return applyOwnershipAndModes(root, account, dirPerm, filePerm)
+}

internal/apps/agent/runtimeuser/runtimeuser_test.go

@@ -0,0 +1,39 @@
+package runtimeuser
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestEnsurePathOwnershipNormalizesModes(t *testing.T) {
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "data")
+	releaseDir := filepath.Join(dataDir, "var", "lib", "openflare", "pages", "releases", "abc")
+	if err := os.MkdirAll(releaseDir, 0o700); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(releaseDir, "index.html"), []byte("ok"), 0o600); err != nil {
+		t.Fatalf("WriteFile failed: %v", err)
+	}
+
+	pagesRoot := filepath.Join(dataDir, "var", "lib", "openflare", "pages")
+	if err := EnsurePathOwnership(pagesRoot, 0o755, 0o644); err != nil {
+		t.Fatalf("EnsurePathOwnership failed: %v", err)
+	}
+
+	dataInfo, err := os.Stat(dataDir)
+	if err != nil {
+		t.Fatalf("Stat dataDir failed: %v", err)
+	}
+	if dataInfo.Mode().Perm()&0o005 == 0 {
+		t.Fatalf("expected dataDir to be world-traversable, got %o", dataInfo.Mode().Perm())
+	}
+	indexInfo, err := os.Stat(filepath.Join(releaseDir, "index.html"))
+	if err != nil {
+		t.Fatalf("Stat index failed: %v", err)
+	}
+	if indexInfo.Mode().Perm() != 0o644 {
+		t.Fatalf("expected mode 0644, got %o", indexInfo.Mode().Perm())
+	}
+}

internal/apps/agent/runtimeuser/runtimeuser_unix.go

@@ -0,0 +1,99 @@
+//go:build unix
+
+package runtimeuser
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+)
+
+func dropTo(account *Account) error {
+	if err := syscall.Setgid(account.GID); err != nil {
+		return fmt.Errorf("setgid %d: %w", account.GID, err)
+	}
+	if err := syscall.Setuid(account.UID); err != nil {
+		return fmt.Errorf("setuid %d: %w", account.UID, err)
+	}
+	return nil
+}
+
+func ensureWorldTraversablePath(targetDir string) error {
+	const maxDepth = 12
+	current := filepath.Clean(strings.TrimSpace(targetDir))
+	if current == "" || current == "." {
+		return nil
+	}
+	for depth := 0; depth < maxDepth; depth++ {
+		if err := os.Chmod(current, DefaultDirPerm); err != nil { //nolint:gosec // parent dirs must be traversable by the runtime user
+			if os.IsNotExist(err) || os.IsPermission(err) {
+				break
+			}
+			return fmt.Errorf("chmod %s: %w", current, err)
+		}
+		parent := filepath.Dir(current)
+		if parent == current {
+			break
+		}
+		current = parent
+	}
+	return nil
+}
+
+func applyOwnershipAndModes(root string, account *Account, dirPerm os.FileMode, filePerm os.FileMode) error {
+	return filepath.WalkDir(root, func(path string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return err
+		}
+		if os.Geteuid() == 0 {
+			if chownErr := os.Chown(path, account.UID, account.GID); chownErr != nil && !os.IsNotExist(chownErr) { //nolint:gosec // path is under managed root walk
+				return fmt.Errorf("chown %s: %w", path, chownErr)
+			}
+		}
+		if entry.IsDir() {
+			if chmodErr := os.Chmod(path, dirPerm); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk
+				return fmt.Errorf("chmod dir %s: %w", path, chmodErr)
+			}
+			return nil
+		}
+		if !info.Mode().IsRegular() {
+			return nil
+		}
+		mode := filePerm
+		if chmodErr := os.Chmod(path, mode); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk
+			return fmt.Errorf("chmod file %s: %w", path, chmodErr)
+		}
+		return nil
+	})
+}
+
+func ensureModesOnly(root string, dirPerm os.FileMode, filePerm os.FileMode) error {
+	return filepath.WalkDir(root, func(path string, entry os.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() {
+			if chmodErr := os.Chmod(path, dirPerm); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk
+				return fmt.Errorf("chmod dir %s: %w", path, chmodErr)
+			}
+			return nil
+		}
+		if !info.Mode().IsRegular() {
+			return nil
+		}
+		if chmodErr := os.Chmod(path, filePerm); chmodErr != nil && !os.IsNotExist(chmodErr) { //nolint:gosec // path is under managed root walk
+			return fmt.Errorf("chmod file %s: %w", path, chmodErr)
+		}
+		return nil
+	})
+}

internal/apps/agent/sync/pages.go

@@ -24,6 +24,7 @@ import (
 const (
 	pagesMaxExtractedFileBytes = 100 * 1024 * 1024
 	pagesDirPerm               = 0o755
+	pagesFilePerm              = 0o644
 	pagesManifestFilePerm      = 0o644
 )
 
@@ -137,6 +138,11 @@ func (s *Service) syncPagesDeployments(ctx context.Context, snapshot *state.Snap
 			return err
 		}
 	}
+	if s.nginxManager != nil {
+		if err := s.nginxManager.EnsureWorkerReadAccess(); err != nil {
+			return fmt.Errorf("ensure openresty worker read access: %w", err)
+		}
+	}
 	return nil
 }
 
@@ -333,7 +339,7 @@ func extractPagesFile(item *zip.File, targetPath string) error {
 		return err
 	}
 	defer func() { _ = source.Close() }()
-	target, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, item.FileInfo().Mode().Perm()) //nolint:gosec // targetPath is under managed PagesDir from validated zip entry
+	target, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, pagesFilePerm) //nolint:gosec // targetPath is under managed PagesDir from validated zip entry
 	if err != nil {
 		return err
 	}
@@ -416,10 +422,6 @@ func copyPagesDir(sourceDir string, targetDir string) error {
 		if entry.IsDir() {
 			return os.MkdirAll(targetPath, pagesDirPerm)
 		}
-		info, err := entry.Info()
-		if err != nil {
-			return err
-		}
 		input, err := os.Open(sourcePath) //nolint:gosec // sourcePath is under managed PagesDir walk root
 		if err != nil {
 			return err
@@ -428,7 +430,7 @@ func copyPagesDir(sourceDir string, targetDir string) error {
 		if err := os.MkdirAll(filepath.Dir(targetPath), pagesDirPerm); err != nil {
 			return err
 		}
-		output, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, info.Mode().Perm()) //nolint:gosec // targetPath is under managed PagesDir walk root
+		output, err := os.OpenFile(targetPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, pagesFilePerm) //nolint:gosec // targetPath is under managed PagesDir walk root
 		if err != nil {
 			return err
 		}

internal/apps/agent/sync/service.go

@@ -43,6 +43,7 @@ type NginxManager interface {
 	CurrentChecksum() (string, error)
 	WAFIPGroupChecksums() (map[string]string, error)
 	SyncWAFIPGroups(groups []protocol.WAFIPGroup) error
+	EnsureWorkerReadAccess() error
 }
 
 // Service orchestrates configuration synchronisation between the server and the local OpenResty instance.

internal/apps/agent/sync/service_test.go

@@ -141,6 +141,10 @@ func (m *fakeManager) SyncWAFIPGroups(groups []protocol.WAFIPGroup) error {
 	return nil
 }
 
+func (m *fakeManager) EnsureWorkerReadAccess() error {
+	return nil
+}
+
 func TestSyncOnceSuccess(t *testing.T) {
 	client := &fakeClient{
 		config: protocol.ActiveConfigResponse{
@@ -254,6 +258,54 @@ func TestSyncOnceDownloadsPagesDeploymentBeforeApply(t *testing.T) {
 	}
 }
 
+func TestSyncPagesDeploymentEnsuresWorkerReadAccess(t *testing.T) {
+	tempDir := t.TempDir()
+	dataDir := filepath.Join(tempDir, "data")
+	if err := os.MkdirAll(dataDir, 0o700); err != nil {
+		t.Fatalf("MkdirAll failed: %v", err)
+	}
+	pagesDir := filepath.Join(dataDir, "var", "lib", "openflare", "pages")
+
+	packageBytes := testPagesPackage(t, map[string]string{"index.html": "hello"})
+	checksum := testBytesChecksum(packageBytes)
+	config := protocol.ActiveConfigResponse{
+		Version:          "20260309-106",
+		Checksum:         "pages-config-checksum",
+		SourceConfigJSON: testPagesSourceConfigJSON(7, checksum),
+		CreatedAt:        time.Now().Format(time.RFC3339),
+	}
+	client := &fakeClient{
+		config:        config,
+		pagesPackages: map[uint][]byte{7: packageBytes},
+	}
+	stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
+	snapshot, _ := stateStore.Load()
+
+	runtimeManager := &nginx.Manager{PagesDir: pagesDir}
+	service := New(client, runtimeManager, stateStore)
+	service.SetPagesDir(pagesDir)
+
+	if err := service.syncPagesDeployments(context.Background(), snapshot, &config); err != nil {
+		t.Fatalf("syncPagesDeployments failed: %v", err)
+	}
+
+	dataInfo, err := os.Stat(dataDir)
+	if err != nil {
+		t.Fatalf("Stat dataDir failed: %v", err)
+	}
+	if dataInfo.Mode().Perm()&0o005 == 0 {
+		t.Fatalf("expected dataDir to be world-traversable, got %o", dataInfo.Mode().Perm())
+	}
+	indexPath := filepath.Join(pagesDir, "deployments", "7", "current", "index.html")
+	indexInfo, err := os.Stat(indexPath)
+	if err != nil {
+		t.Fatalf("expected Pages file to be extracted: %v", err)
+	}
+	if indexInfo.Mode().Perm() != 0o644 {
+		t.Fatalf("expected index.html mode 0644, got %o", indexInfo.Mode().Perm())
+	}
+}
+
 func TestSyncOnceExtractsPagesPackageWithZeroByteFiles(t *testing.T) {
 	packageBytes := testPagesPackage(t, map[string]string{
 		"index.html": "hello",

internal/model/openflare_option.go

@@ -106,6 +106,7 @@ var (
 )
 
 const defaultOpenRestyMainConfigTemplate = `# This file is generated by OpenFlare. Do not edit manually.
+user openflare;
 worker_processes {{OpenRestyWorkerProcesses}};
 worker_rlimit_nofile {{OpenRestyWorkerRlimitNofile}};
 pid logs/nginx.pid;

pkg/render/openresty/types.go

@@ -25,7 +25,15 @@ const (
 	anubisAPIPrefix       = "/.within.website/x/cmd/anubis/api/"
 )
 
+// OpenFlareRuntimeUser is the dedicated service account shared by the agent
+// process and OpenResty worker processes.
+const OpenFlareRuntimeUser = "openflare"
+
+// OpenRestyWorkerUser is kept as an alias for existing call sites.
+const OpenRestyWorkerUser = OpenFlareRuntimeUser
+
 const defaultMainConfigTemplate = `# This file is generated by OpenFlare. Do not edit manually.
+user ` + OpenFlareRuntimeUser + `;
 worker_processes {{OpenRestyWorkerProcesses}};
 worker_rlimit_nofile {{OpenRestyWorkerRlimitNofile}};
 pid logs/nginx.pid;

scripts/install-agent.sh

@@ -478,8 +478,21 @@ if [[ -d "$INSTALL_DIR" ]]; then
   rm -rf "$INSTALL_DIR"
 fi
 
+ensure_runtime_user() {
+  if [[ "$OS" != "linux" ]]; then
+    return
+  fi
+  if id openflare >/dev/null 2>&1; then
+    return
+  fi
+  if command -v useradd >/dev/null 2>&1; then
+    useradd --system --home-dir "${INSTALL_DIR}/data" --shell /usr/sbin/nologin openflare
+  fi
+}
+
 echo "Installing to ${INSTALL_DIR}..."
 mkdir -p "${INSTALL_DIR}/data"
+ensure_runtime_user
 
 mv -f "$TMP_BINARY" "${INSTALL_DIR}/openflare-agent"
 trap - EXIT
@@ -511,6 +524,10 @@ else
 CFGEOF
 fi
 
+if id openflare >/dev/null 2>&1; then
+  chown -R openflare:openflare "${INSTALL_DIR}"
+fi
+
 # Create systemd service
 if [[ "$CREATE_SERVICE" == "true" && "$OS" == "linux" && -d /etc/systemd/system && "$SYSTEMCTL_AVAILABLE" == "true" ]]; then
   echo "Creating systemd service..."
@@ -521,6 +538,11 @@ After=network.target
 
 [Service]
 Type=simple
+User=openflare
+Group=openflare
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
 ExecStart=${INSTALL_DIR}/openflare-agent -config ${CONFIG_FILE}
 WorkingDirectory=${INSTALL_DIR}
 Restart=always