How do I allow my teammate to deploy?

[alexanderkahn]

Hi,

I'm working on a Rails project that I deploy using the basic
remote_cache strategy. I push to a bare git repo in my home folder on
the server, and then `cap deploy` checks out the latest code from the
repo, links it, and restarts Passenger.

This works well, but I have a new requirement: I want my designer to
be able to deploy changes. How do folks set this up? My designer has
ssh access to the server. Do I need to move the git repo out of my
home folder to somewhere we both have write access to? Or can I simply
give him write access to the git repo? But then he would need to
change his deploy.rb in order to have Capistrano log in to the server
as his user. And then would the checkout have the right ownership/
permissions?

Or do we need to set up a special user on the server for Capistrano
deployments? Then put the git repo in that user's home, and have the
application run as that user?

I'm sure this is a fairly common scenario. I'm just looking for how
people approach this.

Thanks for any advice,
Alex

[Lee Hambley]

Alex,

Hosting the repository in your home directory is not bad for a single guy, but in order to collaberate, you need to move it to somewhere shared, as you mentioned - or, run a git server (starting to get complicated) and deal with permissions. For the small, small cost involved - I would take a repository somewhere like Github and collaberate there.

This solves all your problems about sharing code; (and I throughoughtly recommend not getting involved in hosting your own multi user repository, if you're not a competant sysadmin, it can get ugly real quickly)

With regard to the "deploy" user, I would take the approach of using groups, and user rights - add yourself, and the designer to a deployment group, and then chgrp the deploy directories to the group, and set "G+rwx". Then members of the `deploy` group should be able to write there properly.

The alternative is a dedicated deploy user, but I don't like that idea so much.

-- Lee Hambley

Twitter: @leehambley | @capistranorb

[alexanderkahn]

Hi Lee,

Thank you for the thorough response. I think we will upgrade to paid
GitHub accounts and host our project there.

I have one question about the deployment group you suggest creating.
On my server, on which directories/files should I be setting the group
ownership? Will this group not just be overwritten the next time the
code is checked out from GitHub? I'm a little hazy on how this setting
would persist across deploys. Maybe you can fill me in.

Thanks again,
Alex

[Lee Hambley]

You should chown the /u/apps/ to owned by the deployment group, and ensure that the files are written with group permissions, this means setting your deploy group member's umask to the correct setting for your operating system.

[Richie Vos]

On Nov 30, 8:25 am, Lee Hambley <lee.hamb...@gmail.com> wrote:
> Alex,
>
> Hosting the repository in your home directory is not bad for a single guy,
> but in order to collaberate, you need to move it to somewhere shared, as you
> mentioned - or, run a git server (starting to get complicated) and deal with
> permissions. For the small, small cost involved - I would take a repository
> somewhere like Github and collaberate there.
>
> This solves all your problems about sharing code; (and I throughoughtly
> recommend not getting involved in hosting your own multi user repository, if
> you're not a competant sysadmin, it can get ugly real quickly)

I agree with Lee on the easiest solution being the github route. If
you're willing to do a couple hours of work though (depending on your
expertise), you can probably get your own multi-user repo setup with
gitosis. I started using it on one of my own personal sites (I'm too
cheap to pay for a paid github plan), and felt it was actually
straightforward as far as config management things can go. You setup a
couple users, install a thing or 2, and have a pretty easily
configurable, secure, multi-user (with groups) git repository setup on
your host.

http://scie.nti.st/2007/11/14/hosting-git-repositories-the-easy-and-secure-way

[Lee Hambley]

Alex, Ritchie is right - it really isn't so difficult as I made out, but its not something I would advise someone to do; configuring a server if you do it wrong can lead to you getting hacked, and I don't need that on my conscience :) either way works though.