What is the expected use case with sudo?

[JustinHardage]

I just picked up safe-depoy-to, but it - as with many other gems - runs into problems with use of sudo through cap. What's the expected way to deal with this?

My current solution is to add the commands to passwordless sudo in /etc/sudoers, but I'm basically just running the deploy over and over again and adding each command as it fails. Which is obviously no easier than just creating the directories myself. I'm also not super comfy with the security of passwordless sudo in general.

Can someone provide a better workflow for using capistrano-safe-deploy-to or capistrano sudo use in general?

[bruno-]

Hi, unfortunately I don't have a clear answer for you.

You've probably stumbled on "official" capistrano docs - authorization section where they are not really clear about this too.
I read it as "you should probably give your deploy user passwordless sudo, but it's dangerous and maybe you shouldn't".

I have let go of this and just give my deploy user passwordless sudo and I move on to other things. Than again, I don't have super important apps out there.

As for the better workflow, I've never pursued this path but I'd imagine it might be something like this:

• use a dedicated provisioning tool for
  • provisioning and server configuration
  • *all* application configuration
• use capistrano for deployments exclusively

From what I see it's the "application configuration" that is in the grey zone.
Things like: configuring a web server for the specific app, creating an application user and a database, creating app directories etc.

Capistrano would be used for just a couple tasks like: git pulling new app updates, migrations, asset compilation and reseting a server.

Like I said, this is just theoretical talking from my side, never tried this.
Sorry for not being more helpful here. Let me know if you have any feedback on this!

[JustinHardage]

No worries! I did read those docs, but I appreciate you linking them because of your brilliant paraphrase. :-)

I do pretty lightweight projects, which is why I'd like to avoid a separate provisioning tool. I'm going to just do NOPASSWD:ALL until I learn enough about Capistrano to do a setup task with an interactive sudo password prompt. Ideally, you'd input your sudo password during setup and those tasks would set the correct permissions for deploy to run without sudo.

Thanks for your input; it definitely helps to hear that other people are glossing over it in the same way. I'm still open to any further suggestions, though.