feat: optionally set permissions and ownership for pulled files

Author: thannaske

README.md

@@ -4,7 +4,8 @@ Simple service that pulls files via http(s) in configurable intervals, stores th
 ## Features
 - **Easily Configurable** - Configure which files to pull in which interval and what to do with them in a single configuration file
 - **Sub-Minute Intervals** - Pull files as often (or as infrequent) as you need to
-- **Atomic Writes** - Files are downloaded into a temporary file, first, then atomically moved into place (`inotify`-compatible)
+- **Atomic Writes** - Files are downloaded into a temporary file first, then atomically moved into place (`inotify`-compatible)
+- **File Permissions** - Optionally set file mode, owner, and group — applied before the atomic rename, so watchers never see incorrect permissions
 - **Hooks** - Configure hooks to be executed after a pull was completed successfully or after it failed
 - **Extensible** - Easily develop own hooks by satisfying a simple Go interface with just one method
 
@@ -51,6 +52,10 @@ targets:
         username: username
         password: password
       follow_redirects: true # default: true
+    file: # optional
+      mode: "0644" # octal file mode
+      owner: www-data # user name or numeric UID
+      group: www-data # group name or numeric GID
     hooks: # optional
       - type: shell # `shell` or `move`
         command: echo "Downloaded successfully"
@@ -61,6 +66,20 @@ targets:
         destination: /opt/data/data.txt
 ```
 
+## File Permissions
+Each target can include an optional `file` block to set mode, owner, and group on the downloaded file. Permissions are applied to the temporary file **before** the atomic rename, so services watching the destination (e.g. via `inotify`) will never observe a file with incorrect permissions.
+
+All three fields are optional and can be used independently:
+
+```yaml
+file:
+  mode: "0755"  # octal string
+  owner: deploy # user name or numeric UID
+  group: staff  # group name or numeric GID
+```
+
+Setting `owner` or `group` typically requires running `http-pull` as root.
+
 ## Hooks
 
 **`shell`** — Executes a command via `/bin/sh -c` after the pull completes.

cmd/http-pull/main.go

@@ -15,10 +15,19 @@ import (
 	"http-pull/internal/runner"
 )
 
+// version is set at build time via ldflags.
+var version = "dev"
+
 func main() {
 	configPath := pflag.String("config", "/etc/http-pull/config.yaml", "path to configuration file")
+	showVersion := pflag.Bool("version", false, "print version and exit")
 	pflag.Parse()
 
+	if *showVersion {
+		fmt.Println("http-pull", version)
+		return
+	}
+
 	cfg, err := config.Load(*configPath)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "error loading config: %v\n", err)

internal/config/config.go

@@ -3,6 +3,7 @@ package config
 
 import (
 	"fmt"
+	"strconv"
 	"strings"
 	"time"
 
@@ -29,9 +30,17 @@ type TargetConfig struct {
 	Interval    time.Duration      `mapstructure:"interval"`
 	Destination string             `mapstructure:"destination"`
 	HTTPRequest *HTTPRequestConfig `mapstructure:"http_request"`
+	File        *FileConfig        `mapstructure:"file"`
 	Hooks       []HookConfig       `mapstructure:"hooks"`
 }
 
+// FileConfig holds optional file ownership and permission settings.
+type FileConfig struct {
+	Owner string `mapstructure:"owner"`
+	Group string `mapstructure:"group"`
+	Mode  string `mapstructure:"mode"`
+}
+
 // HTTPRequestConfig holds optional HTTP request settings.
 type HTTPRequestConfig struct {
 	Method          string     `mapstructure:"method"`
@@ -154,6 +163,12 @@ func validate(cfg *Config) error {
 			return fmt.Errorf("target %q: destination is required", t.Name)
 		}
 
+		if t.File != nil && t.File.Mode != "" {
+			if _, err := strconv.ParseUint(t.File.Mode, 8, 32); err != nil {
+				return fmt.Errorf("target %q: invalid file mode %q: must be an octal string (e.g. \"0644\")", t.Name, t.File.Mode)
+			}
+		}
+
 		for j, h := range t.Hooks {
 			if err := validateHook(t.Name, j, h); err != nil {
 				return err

internal/hook/move.go

@@ -69,5 +69,10 @@ func copyFile(src, dst string) error {
 		return err
 	}
 
-	return out.Close()
+	if err := out.Close(); err != nil {
+		return err
+	}
+
+	// Preserve file ownership across the copy.
+	return preserveOwnership(info, dst)
 }

internal/hook/ownership_other.go

@@ -0,0 +1,10 @@
+//go:build !unix
+
+package hook
+
+import "os"
+
+// preserveOwnership is a no-op on non-Unix platforms.
+func preserveOwnership(_ os.FileInfo, _ string) error {
+	return nil
+}

internal/hook/ownership_unix.go

@@ -0,0 +1,16 @@
+//go:build unix
+
+package hook
+
+import (
+	"os"
+	"syscall"
+)
+
+func preserveOwnership(info os.FileInfo, dst string) error {
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return nil
+	}
+	return os.Chown(dst, int(stat.Uid), int(stat.Gid))
+}

internal/puller/puller.go

@@ -8,7 +8,9 @@ import (
 	"log/slog"
 	"net/http"
 	"os"
+	"os/user"
 	"path/filepath"
+	"strconv"
 
 	"http-pull/internal/config"
 )
@@ -110,10 +112,83 @@ func (p *Puller) atomicWrite(r io.Reader) error {
 		return fmt.Errorf("closing temp file: %w", err)
 	}
 
+	if err := p.applyFilePermissions(tmpPath); err != nil {
+		os.Remove(tmpPath)
+		return fmt.Errorf("applying file permissions: %w", err)
+	}
+
 	if err := os.Rename(tmpPath, p.target.Destination); err != nil {
 		os.Remove(tmpPath)
 		return fmt.Errorf("renaming temp file: %w", err)
 	}
 
 	return nil
 }
+
+func (p *Puller) applyFilePermissions(path string) error {
+	fc := p.target.File
+	if fc == nil {
+		return nil
+	}
+
+	if fc.Mode != "" {
+		parsed, err := strconv.ParseUint(fc.Mode, 8, 32)
+		if err != nil {
+			return fmt.Errorf("parsing mode %q: %w", fc.Mode, err)
+		}
+		if err := os.Chmod(path, os.FileMode(parsed)); err != nil {
+			return fmt.Errorf("chmod: %w", err)
+		}
+		p.logger.Debug("applied file mode", "path", path, "mode", fc.Mode)
+	}
+
+	if fc.Owner != "" || fc.Group != "" {
+		uid := -1
+		gid := -1
+
+		if fc.Owner != "" {
+			id, err := resolveUID(fc.Owner)
+			if err != nil {
+				return fmt.Errorf("resolving owner %q: %w", fc.Owner, err)
+			}
+			uid = id
+		}
+
+		if fc.Group != "" {
+			id, err := resolveGID(fc.Group)
+			if err != nil {
+				return fmt.Errorf("resolving group %q: %w", fc.Group, err)
+			}
+			gid = id
+		}
+
+		if err := os.Chown(path, uid, gid); err != nil {
+			return fmt.Errorf("chown: %w", err)
+		}
+		p.logger.Debug("applied file ownership", "path", path, "uid", uid, "gid", gid)
+	}
+
+	return nil
+}
+
+func resolveUID(name string) (int, error) {
+	if id, err := strconv.Atoi(name); err == nil {
+		return id, nil
+	}
+	u, err := user.Lookup(name)
+	if err != nil {
+		return 0, err
+	}
+	return strconv.Atoi(u.Uid)
+}
+
+func resolveGID(name string) (int, error) {
+	if id, err := strconv.Atoi(name); err == nil {
+		return id, nil
+	}
+	g, err := user.LookupGroup(name)
+	if err != nil {
+		return 0, err
+	}
+	return strconv.Atoi(g.Gid)
+}