From 9c2f5848c2faea328c75c24d95c02302c9c8d18a Mon Sep 17 00:00:00 2001
From: Vadim Malanov <vadim.malanov@gmail.com>
Date: Sat, 11 Jul 2026 18:26:00 +0300
Subject: [PATCH] fix(deploy): pipeline scratch as named volumes to unblock
 redeploy

---
 docker-compose.server.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/docker-compose.server.yml b/docker-compose.server.yml
index 81a8df2..b6fb085 100644
--- a/docker-compose.server.yml
+++ b/docker-compose.server.yml
@@ -31,6 +31,15 @@ networks:
     external: true
     name: teamhub_net
 
+# Pipeline scratch (OCR work / input) as named volumes instead of the base
+# compose bind-mounts under app_root: the worker writes those files as root, so
+# the deployer's `rm -rf app_root` (run as qmsadmin) hit "Permission denied" and
+# failed every redeploy after a document was processed. Named volumes live
+# outside app_root and survive the clean-tree extract.
+volumes:
+  legacyhub_input:
+  legacyhub_work:
+
 services:
   postgres:
     networks: !override [legacyhub_db]
@@ -65,6 +74,10 @@ services:
       legacyhub_db: {}
       teamhub_net:
         aliases: [legacyhub-api]
+    volumes: !override
+      - legacyhub_input:/data/input
+      - legacyhub_work:/data/work
+      - hf_cache:/root/.cache/huggingface
     environment:
       AUTH_REQUIRE_IDENTITY: ${AUTH_REQUIRE_IDENTITY:-false}
     restart: always
@@ -73,4 +86,8 @@ services:
     networks: !override
       legacyhub_db: {}
       teamhub_net: {}
+    volumes: !override
+      - legacyhub_input:/data/input
+      - legacyhub_work:/data/work
+      - hf_cache:/root/.cache/huggingface
     restart: always