diff --git a/README.md b/README.md index 97fc8ca9115597a4ab6740ce004a27985d6e1e6f..94bb54f55d89e18e047ca35c7a794e47338bbdb8 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,7 @@ Deploy code! ## users -The deployment runs as the user `deployer`, which has access to e.g. gitlab. +The deployment runs as `root`, which has access to e.g. gitlab. The formula is organized in projects. ```yaml @@ -13,7 +13,7 @@ deploy: project_name: {} ``` -For each project an additional user with the name `project_name` gets created, which is a member of the group `deployer`. +For each project an additional user with the name `project_name` gets created. This user should be used to run daemons. ## states @@ -147,7 +147,7 @@ The environment creation runs in the context of the project user. #### `deploy.projects.[...].user_groups` Each project receives a user that should be used to run the project (if it is runnable somehow...). -By default this user is member of the groups: `deployer`, `[project_name]` and `virtualenv`. +By default this user is member of the groups: `[project_name]` and `virtualenv`. With `user_groups` you can define additional groups the user should belojng to. This is especially interesting for access to cert data. If your run user needs to read a cert, you might add him into the corresponding group. diff --git a/deploy/django.sls b/deploy/django.sls index 9c6e92628721299578c4aac08e8fa5f43798b46d..1a8716c16782fd86d8a7282b6b02c16edc69f547 100644 --- a/deploy/django.sls +++ b/deploy/django.sls @@ -3,20 +3,16 @@ deploy_static_directory: file.directory: - name: {{ deploy.config.static_directory }} - - user: deployer + - user: root - group: www-data - - mode: 2770 - - require: - - user: deployer + - mode: 2775 deploy_sqlite_directory: file.directory: - name: {{ deploy.config.sqlite_directory }} - - user: deployer - - group: deployer - - mode: 2770 - - require: - - user: deployer + - user: root + - group: root + - mode: 2775 {% for project_name, project_config in deploy.projects.items() if project_config.get('django', False) %} {% set dj_config = project_config.django %} @@ -28,7 +24,7 @@ deploy_django_{{ project_name }}_settings: - source: salt://deploy/tpl/django_settings.py - template: jinja - mode: 640 - - user: deployer + - user: root - group: {{ project_name }} - context: {{ dj_config|json }} @@ -44,7 +40,7 @@ deploy_django_{{ project_name }}_migrate: - runas: {{ project_name }} - require: - file: deploy_django_{{ project_name }}_settings - - require_in: + - require: - cmd: fix_sqlite3_permissions {% endif %} diff --git a/deploy/gitlab.sls b/deploy/gitlab.sls index 47a52f9feddf9ae98833c6a6c7bcf8d3f481c1df..877a3e535ab1d245e1e66f3a5454851e23c86b6a 100644 --- a/deploy/gitlab.sls +++ b/deploy/gitlab.sls @@ -12,13 +12,9 @@ deploy_packages: deploy_target_directory_exists: file.directory: - name: {{ deploy.config.deploy_directory }} - - user: deployer - - group: deployer - - mode: 0770 - - require: - - user: deployer - - group: deployer - + - user: root + - group: root + - mode: 0755 {% for project_name, project_config in deploy.projects.items() if project_config.get('gitlab', False) %} {% set repo_config = project_config.gitlab %} @@ -27,7 +23,7 @@ deploy_{{ project_name }}_clone_git: git.latest: - name: {{ repo_config.url }} - rev: {{ repo_config.rev }} - - user: deployer + - user: root - force_fetch: true - force_reset: true # ignore local repos changed! - target: {{ project_config.path }} @@ -37,7 +33,7 @@ deploy_{{ project_name }}_clone_git: deploy_{{ project_name }}_clone_directory_permissions: file.directory: - name: {{ project_config.path }} - - user: deployer + - user: root - group: {{ project_name }} {% if repo_config.get('keep_chmod_from_repo', False) %} {% else %} @@ -50,7 +46,6 @@ deploy_{{ project_name }}_clone_directory_permissions: - mode - require: - git: deploy_{{ project_name }}_clone_git - - sls: deploy.user {% if repo_config.get('after_clone_command', False) %} deploy_{{ project_name }}_run_after_clone_command: diff --git a/deploy/user.sls b/deploy/user.sls index 90f123eb2139aa60ad292d8714eb8daeb7b30095..70d3880a38451114a083e4c1a316e36955d1c6be 100644 --- a/deploy/user.sls +++ b/deploy/user.sls @@ -1,43 +1,37 @@ {% from "deploy/map.jinja" import deploy with context %} deployer: - group.present: - - system: True - user.present: - - groups: - - deployer + user.absent: [] + group.absent: [] + -/home/deployer/.ssh/known_hosts: +/root/.ssh/known_hosts: file.managed: - source: salt://deploy/tpl/ssh/known_hosts - - user: deployer - - group: deployer + - user: root + - group: root - makedirs: True - - require: - - user: deployer -/home/deployer/.ssh/config: +/root/.ssh/config: file.managed: - source: salt://deploy/tpl/ssh/config - - user: deployer - - group: deployer + - user: root + - group: root - makedirs: True - - require: - - user: deployer deploy_key: file.managed: - - name: /home/deployer/.ssh/deploy_key + - name: /root/.ssh/deploy_key - contents_pillar: deploy:config:key - mode: 600 - - user: deployer - - group: deployer + - user: root + - group: root - makedirs: True {% for project_name, project_config in deploy.projects.items() %} {% set config_user_groups = project_config.get('user_groups', []) %} -{% set default_user_groups = [project_name, 'deployer'] %} +{% set default_user_groups = [project_name] %} {% set user_groups = config_user_groups + default_user_groups %} {{ project_name }}: diff --git a/deploy/venv.sls b/deploy/venv.sls index fa8bbb1acfab2ca027e4b0d9eb0c5acd369c5e19..caa2f39c72da81e2aa722f147e7dc1c8eadabaa8 100644 --- a/deploy/venv.sls +++ b/deploy/venv.sls @@ -20,11 +20,10 @@ deploy_provision_virtualenv_group_with_members: deploy_venv_directory: file.directory: - name: {{ deploy.config.venv_directory }} - - user: deployer + - user: root - group: virtualenv - mode: 2770 - require: - - user: deployer - group: virtualenv {% for project_name, project_config in deploy.projects.items() if project_config.get('venv', False) %} @@ -34,7 +33,7 @@ create_{{ project_name }}_venv: cmd.run: - name: python3 -m venv {{ venv_config.path }} - onlyif: test ! -e {{ venv_config.path }} - - runas: deployer + - runas: root - require: - file: deploy_venv_directory - pkg: deploy_venv_pkgs @@ -42,7 +41,7 @@ create_{{ project_name }}_venv: upgrade_pip_in_{{ project_name }}_venv: cmd.run: - name: {{ venv_config.path }}/bin/pip install --upgrade pip - - runas: deployer + - runas: root - env: LANG: en_US.UTF-8 LC_CTYPE: en_US.UTF-8 @@ -55,7 +54,7 @@ upgrade_pip_in_{{ project_name }}_venv: install_requirements_in_{{ project_name }}_venv: cmd.run: - name: {{ venv_config.path }}/bin/pip install --upgrade -r {{ venv_config.requirements }} - - runas: deployer + - runas: root - env: LANG: en_US.UTF-8 LC_CTYPE: en_US.UTF-8