capistrano-ext-superusers 0.2.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e126ff631b7eabbf7b7c701110997f97914bb617
-  data.tar.gz: 5be909d886dbe9264909788ff944b67d2560910d
+  metadata.gz: e1cab0c735883f7f277943a7f27a37e5ce8b955a
+  data.tar.gz: 0cd390a64b985483982053edc02517828cc191e8
 SHA512:
-  metadata.gz: 2a3eb655d5529855625c50a4858afc630a291a2f9abb20116cc7a08848612953dcf93cf9c7f597d83be17be0286852f68b02aba7ec9270953b3cc2fe5f02c64f
-  data.tar.gz: 4a1a09c77998d56e9c5599df607f1d9997341f3eb77e75b5cc4b2c575c8d86a0349c175e311b09625e58a9f1bce84ff06be456753eccb8aaeea133a54b6eb614
+  metadata.gz: 9693dccf32d7e9a8caf7945a1b5822d5c369660a3e5629cb4b6a058801dbe2249f7e369539dfe103e990a3d0c13513e1ac56d668c3169bb8da705d65165a0c3e
+  data.tar.gz: 5fefdee5527f610b9ce75d5661644038dea0f7a01d35fa8ce11c6ca99976f9bfec7ac85f7f053875bc3463566ee4fcfa2c6192d5e51a9d83f385a8112c22152d

data/README.md

@@ -0,0 +1,59 @@
+Capistrano::Ext::Superusers
+==
+
+A simple rubygem to help run commands and environments as a named user to a common deploy user
+
+Rationale
+--
+
+Its pretty common to want to have named access to a server but to be able to automate running and connecting as a shared/common user. And to not over engineer groups and ACLs
+
+Config
+--
+
+```ruby
+set :owner, 'common_user'             # Defaults to 'nobody'
+set :user_sudo, '/path/to/script'     # Defaults to "sudo -u #{owner} -i"
+set :ssh_forward, '/path/to/script'   # Defaults to "setfacl -m #{owner}:rx $(dirname $SSH_AUTH_SOCK) && setfacl -m #{owner}:rwx $SSH_AUTH_SOCK")"
+```
+
+I don't get it....
+--
+
+Consider the simple bundler sort of task as per:
+
+```ruby
+namespace :deploy do
+  task :bundle do
+    run "cd #{current_path} && bundle install --deployment --binstubs --without test cucumber development ruby-debug"
+  end
+end
+```
+
+We could prepend the sudo command (as above) and do:
+
+```ruby
+run "sudo -u nobody -i cd #{current_path} && bundle install --deployment --binstubs --without test cucumber development ruby-debug"
+```
+
+But this will change the dir as 'nobody' then drop back to the deploy user. We could then do, instead;
+
+```ruby
+run "sudo -u nobody -i bash -c 'cd #{current_path} && bundle install --deployment --binstubs --without test cucumber development ruby-debug'"
+```
+
+Or; more betterly:
+
+```ruby
+run "sudo -u nobody -i  #{default_shell} -c 'cd #{current_path} && bundle install --deployment --binstubs --without test cucumber development ruby-debug'"
+```
+
+Which has already lost DRY points.
+
+But what, then, if the Gemfile has gems pointing to git repos we need a key for? We would then need to do two things; add `$SSH_AUTH_SOCK` to env_keep in our sudoers file and then give the `:owner` access to this to. We could extend further without this gem and chain out a massive:
+
+```ruby
+run "#{update_perms_on_key} && sudo -u nobody -i  #{default_shell} -c 'cd #{current_path} && bundle install --deployment --binstubs --without test cucumber development ruby-debug'"
+```
+
+And, because every new session creates another of these and Capistrano is a tad wasteful we'd end up needing to do this for every `run`.

data/capistrano-ext-superusers.gemspec

@@ -0,0 +1,23 @@
+$:.push File.expand_path("../lib", __FILE__)
+
+Gem::Specification.new do |spec|
+  spec.name = 'capistrano-ext-superusers'
+  spec.version = '0.3.1'
+  spec.platform = Gem::Platform::RUBY
+  spec.authors = ['Funding Circle Engineering']
+  spec.email = ['engineering+capistrano-ext-superusers@fundingcircle.com']
+  spec.summary = 'Run Capistrano commands as a superuser'
+  spec.description = 'Capistrano extension to run commands as an unprivileged user in a sensible manner'
+  spec.homepage = 'https://github.com/FundingCircle/capistrano-ext-superusers'
+  spec.license = 'BSD-3-Clause'
+
+  spec.files = `git ls-files -z -- ./* ':(exclude)spec/*'`.split("\x0")
+
+  spec.add_dependency 'capistrano', '>=2.11.0'
+  spec.add_dependency 'capistrano-ext'
+
+  spec.add_development_dependency 'rspec'
+  spec.add_development_dependency 'capistrano-spec'
+
+  spec.require_path = 'lib'
+end

data/lib/capistrano/ext/superusers.rb

@@ -0,0 +1,14 @@
+require 'capistrano'
+Capistrano::Configuration.class_eval do
+  def superuser cmd, options={}
+    owner       = fetch(:owner,       'nobody')
+
+    user_sudo   = fetch(:user_sudo,   "sudo -u #{owner} -i")
+    ssh_forward = fetch(:ssh_forward, "setfacl -m #{owner}:rwx $(dirname $SSH_AUTH_SOCK) && setfacl -m #{owner}:rwx $SSH_AUTH_SOCK")
+    shell       = fetch(:user_shell,  :default_shell)
+    
+    cmd.gsub! "\n", ""
+
+    run "#{ssh_forward} && #{user_sudo} #{shell} -c '#{cmd}'", options
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: capistrano-ext-superusers
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.1
 platform: ruby
 authors:
-- Funding Circle
+- Funding Circle Engineering
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-06-13 00:00:00.000000000 Z
+date: 2017-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: capistrano
@@ -66,16 +66,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: Capistrano extension to run sensible userage
+description: Capistrano extension to run commands as an unprivileged user in a sensible
+  manner
 email:
-- james.condron@fundingcircle.co.uk
+- engineering+capistrano-ext-superusers@fundingcircle.com
 executables: []
 extensions: []
 extra_rdoc_files: []
-files: []
-homepage: 
+files:
+- README.md
+- capistrano-ext-superusers.gemspec
+- lib/capistrano/ext/superusers.rb
+homepage: https://github.com/FundingCircle/capistrano-ext-superusers
 licenses:
-- Simplified BSD
+- BSD-3-Clause
 metadata: {}
 post_install_message: 
 rdoc_options: []
@@ -93,8 +97,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.12
+rubygems_version: 2.6.14
 signing_key: 
 specification_version: 4
-summary: Extend out from capistrano deploy user stuff and bits
+summary: Run Capistrano commands as a superuser
 test_files: []