appbox-cookbook
appbox-cookbook copied to clipboard
Merge deploy user to apps
Currently the user for deployment is deploy, while for running application is apps. This devision may cause permission problems, such as the one described in issue #5. The user deploy only works on deployment of webapps, so I think they can be merged to one account apps.
Anything stopping this from getting merged?
The code in this PR gives the apps user full sudoer access with no password. I think from a "secure by default" point of view this shouldn't be merged since a minor RCE bug in a web app can trivially be escalated to full root access.
Instead of running rake tasks as the deploy user, why not use sudo to impersonate the apps user? sudo -u apps RAILS_ENV=production bin/rake my:task
Agree with @arrtchiu on this.