Upload start.sh with huggingface_hub

start.sh

@@ -1,8 +1,29 @@
-#!/bin/sh
-echo "Surgical Permission Fix starting..."
-# Fix permissions on the persistent volume
-chown -R 1000:1000 /data/.n8n
-chmod -R 700 /data/.n8n
-
-echo "Launching n8n..."
-exec n8n start
+#!/usr/bin/env bash
+# ==============================================================================
+# start.sh – Bootstrap script for n8n on Hugging Face Spaces
+#
+# Runs as root (PID 1 is tini), fixes the permission wall, then drops
+# privileges to uid 1000 before executing n8n.
+# ==============================================================================
+set -euo pipefail
+
+N8N_DATA="/data/.n8n"
+
+echo "▸ [start.sh] Ensuring data directory exists …"
+mkdir -p "${N8N_DATA}"
+
+# ---------- Fix the Permission Wall -------------------------------------------
+# HF mounts /data owned by a different uid. n8n refuses to start if config
+# files are readable by group/other (requires 0600 / 0700).
+echo "▸ [start.sh] Fixing ownership → 1000:1000 …"
+chown -R 1000:1000 /data
+
+echo "▸ [start.sh] Fixing permissions → dirs 0700, files 0600 …"
+find "${N8N_DATA}" -type d -exec chmod 0700 {} +
+find "${N8N_DATA}" -type f -exec chmod 0600 {} +
+
+# ---------- Drop Privileges & Launch ------------------------------------------
+echo "▸ [start.sh] Dropping to user 1000, starting n8n on port ${N8N_PORT:-7860} …"
+
+# su-exec replaces the current process (no intermediate shell)
+exec su-exec 1000:1000 n8n start