Question

I’m trying to setup Capistrano to do our deployments, but I now stumbled upon what seems to be a common assumption of capistrano users: that the user you SSH to the remote host will have permission to write to the directory of deployment.

Here, administrators are common users with a single distinction: they can sudo. At first, I thought that would be enough, since there are some configurations related to sudo, but it seems that’s not the case after all.

Is there a way around this? Creating a user shared by everyone doing deployment is not an acceptable solution.

Edit: to make it clear, no deploy action should happen without calling sudo — that’s the gateway point that checks whether the user is allowed to deploy or not, and it should be a mandatory checkpoint.

The presently accepted answer does not fit that criteria. It goes around sudo by granting extra permissions to the user. I’m accepting it anyway because I’ve come to the conclusion that Capistrano is fundamentally broken in this regard.

Answer 1

I assume you are deploying to a Linux distro. The easiest way to resolve your issue is to create a group, say, deployers, and add each user who should have the permissions to deploy to that group. Once the group is created and the users are in the group, change the ownership and permissions on the deployment path.

Depending on the distro, the syntax will vary slightly. Here it is for ubuntu/debian:

Create the group:

$ sudo groupadd deployers

Add users to group:

$ sudo usermod -a -G deployers daniel

The last argument there is the username.

Next, update the ownership of the deployment path:

$ sudo chown -R root:deployers /deploy/to/path/

The syntax for is :. Here I am assuming that the user that currently owns the path is root. Update to which ever user should own the directory.

Finally, change the permissions on the deployment path:

$ sudo chmod -R 0766 /deploy/to/path/

That will allow users in the deployers group to read and write all files and directories beneath /deploy/to/path