The problem

You copied a small shop app to the server and its cron job fails with ./deploy.sh: Permission denied. The app, running as the user www-data, cannot write its log either. The database password sits in a file that every user on the server can read. You are logged in as root, in /srv/shop.

deploy.sh and config/db.env are both -rw-r--r--, owned by alice:alice. releases/ and releases/v1/ are drwx------ and releases/v1/app.js is -rw-------, all owned by alice:alice. logs/app.log is -rw-r--r--, owned by root:root.

The group deploy exists and alice is in it. The user www-data has a login group with the same name. Each rep starts from these files.