appbox-cookbook
appbox-cookbook copied to clipboard
Merge deploy user to apps
Currently the user for deployment is deploy
, while for running application is apps
. This devision may cause permission problems, such as the one described in issue #5. The user deploy
only works on deployment of webapps, so I think they can be merged to one account apps
.
Anything stopping this from getting merged?
The code in this PR gives the apps
user full sudoer access with no password. I think from a "secure by default" point of view this shouldn't be merged since a minor RCE bug in a web app can trivially be escalated to full root access.
Instead of running rake tasks as the deploy
user, why not use sudo to impersonate the apps
user? sudo -u apps RAILS_ENV=production bin/rake my:task
Agree with @arrtchiu on this.