capistrano-fiftyfive 0.12.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: fdbde2f4fccd4d71cee322fa44e5b0efc0b8e7f8
-  data.tar.gz: c1f3b4f97aaa954f5f12ffdb3dc0b15cf001effa
+  metadata.gz: 29e3fd7ad4df880bfb2665250d10881d574d9345
+  data.tar.gz: 248cb2746bed751d9347586fbb0f96ace8c5c6f5
 SHA512:
-  metadata.gz: 344a1b1348883651726eb448779a35db61697d0925c856f178d5370ff8894c65b30ab28c1a3249a76f3c6eb84e751575e91b62bb6a557c95c6b92e8ebfe939d3
-  data.tar.gz: 6fbc01f6072e72f639542c294d9e613446de66118840992bee2b6d56bcc0ce4156c088ef344b21017f2a1c4d6847fcfd3ed93a282ba1189a8b8ac4113d39fd89
+  metadata.gz: 33c8160aed2ddc2dfc8f43758e567dc705b5f4e3a16341cfa525af3757c5964100829766b7e30a361f55082f956b7628aa48134f2008883c7612be1157718b65
+  data.tar.gz: 5aa307f5bc6704fc13db501adeb4567e58fe3ec811e4254c1fdc3f789aba4932691e295f8f377ba2f26febeb9d7da6f03618fd7d9567af4aa063645f6dc60854

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # capistrano-fiftyfive Changelog
 
+## `0.13.0`
+
+The provisioning tasks now work for a non-root user that has password-less sudo privileges. Assuming a user named `matt` that can sudo without being prompted for a password ([instructions here](http://askubuntu.com/questions/192050/how-to-run-sudo-command-with-no-password)), simply modify `deploy.rb` with:
+
+```ruby
+set :fiftyfive_privileged_user, "matt"
+```
+
+Now all provisioning tasks that would normally run as root will instead run as `matt` using `sudo`.
+
 ## `0.12.0`
 
 * capistrano-fiftyfive's abbreviated format now honors the new `SSHKIT_COLOR` environment variable. Set `SSHKIT_COLOR=1` to force ANSI color even on non-ttys (e.g. Jenkins).

data/lib/capistrano/fiftyfive/dsl.rb

@@ -84,6 +84,13 @@ module Capistrano
       # remote file.
       #
       def put(string_or_io, remote_path, opts={})
+        sudo_exec = ->(*cmd) {
+          cmd = [:sudo] + cmd if opts[:sudo]
+          execute *cmd
+        }
+
+        tmp_path = "/tmp/#{SecureRandom.uuid}"
+
         owner = opts[:owner]
         mode = opts[:mode]
 
@@ -93,12 +100,13 @@ module Capistrano
           StringIO.new(string_or_io.to_s)
         end
 
-        execute :mkdir, "-p", File.dirname(remote_path)
+        sudo_exec.call :mkdir, "-p", File.dirname(remote_path)
 
-        upload!(source, remote_path)
+        upload!(source, tmp_path)
 
-        execute(:chown, owner, remote_path) if owner
-        execute(:chmod, mode, remote_path) if mode
+        sudo_exec.call(:mv, "-f", tmp_path, remote_path)
+        sudo_exec.call(:chown, owner, remote_path) if owner
+        sudo_exec.call(:chmod, mode, remote_path) if mode
       end
 
 

data/lib/capistrano/fiftyfive/version.rb

@@ -1,5 +1,5 @@
 module Capistrano
   module Fiftyfive
-    VERSION = "0.12.0"
+    VERSION = "0.13.0"
   end
 end

data/lib/capistrano/tasks/aptitude.rake

@@ -55,14 +55,14 @@ namespace :fiftyfive do
     end
 
     def _already_installed?(pkg)
-      test(:dpkg, "-s", pkg, "2>/dev/null", "|", :grep, "-q 'ok installed'")
+      test(:sudo, "dpkg", "-s", pkg, "2>/dev/null", "|", :grep, "-q 'ok installed'")
     end
 
     def _add_repository(repo, options={})
       unless _already_installed?("python-software-properties")
         _install("python-software-properties")
       end
-      execute :"apt-add-repository", "-y '#{repo}'"
+      execute :sudo, "apt-add-repository", "-y '#{repo}'"
 
       if (key = options.fetch(:key, nil))
         execute "wget --quiet -O - #{key} | sudo apt-key add -"
@@ -71,19 +71,19 @@ namespace :fiftyfive do
 
     def _install(pkg)
       with :debian_frontend => "noninteractive" do
-        execute :aptitude, "-y -q install", pkg
+        execute :sudo, "aptitude", "-y -q install", pkg
       end
     end
 
     def _update
       with :debian_frontend => "noninteractive" do
-        execute :aptitude, "-q -q -y update"
+        execute :sudo, "aptitude", "-q -q -y update"
       end
     end
 
     def _safe_upgrade
       with :debian_frontend => "noninteractive" do
-        execute :aptitude, "-q -q -y safe-upgrade"
+        execute :sudo, "aptitude", "-q -q -y safe-upgrade"
       end
     end
 

data/lib/capistrano/tasks/delayed_job.rake

@@ -14,9 +14,10 @@ namespace :fiftyfive do
         template "delayed_job_init.erb",
                  "/etc/init.d/delayed_job_#{application_basename}",
                  :mode => "a+rx",
-                 :binding => binding
+                 :binding => binding,
+                 :sudo => true
 
-        execute "update-rc.d -f delayed_job_#{application_basename} defaults"
+        execute "sudo update-rc.d -f delayed_job_#{application_basename} defaults"
       end
     end
 

data/lib/capistrano/tasks/logrotate.rake

@@ -9,7 +9,8 @@ namespace :fiftyfive do
       template "logrotate.erb",
                "/etc/logrotate.d/#{application_basename}-logs",
                :mode => 644,
-               :owner => "root:root"
+               :owner => "root:root",
+               :sudo => true
     end
   end
 end

data/lib/capistrano/tasks/nginx.rake

@@ -7,14 +7,15 @@ namespace :fiftyfive do
     desc "Install nginx.conf files and restart nginx"
     task :configure do
       privileged_on roles(:web) do
-        template("nginx.erb", "/etc/nginx/nginx.conf")
+        template("nginx.erb", "/etc/nginx/nginx.conf", :sudo => true)
 
         template "nginx_unicorn.erb",
-                 "/etc/nginx/sites-enabled/#{application_basename}"
+                 "/etc/nginx/sites-enabled/#{application_basename}",
+                 :sudo => true
 
-        execute "rm -f /etc/nginx/sites-enabled/default"
-        execute "mkdir -p /etc/nginx/#{application_basename}-locations"
-        execute "service nginx restart"
+        execute "sudo rm -f /etc/nginx/sites-enabled/default"
+        execute "sudo mkdir -p /etc/nginx/#{application_basename}-locations"
+        execute "sudo service nginx restart"
       end
     end
 
@@ -22,7 +23,7 @@ namespace :fiftyfive do
       desc "#{command} nginx"
       task command.intern do
         privileged_on roles(:web) do
-          execute "service nginx #{command}"
+          execute "sudo service nginx #{command}"
         end
       end
     end

data/lib/capistrano/tasks/postgresql.rake

@@ -17,24 +17,24 @@ namespace :fiftyfive do
         pgtune_output = "/tmp/postgresql.conf.pgtune"
         pg_conf = "/etc/postgresql/9.1/main/postgresql.conf"
 
-        execute :rm, "-rf", pgtune_dir
-        execute :git,
+        execute :sudo, "rm", "-rf", pgtune_dir
+        execute :sudo, "git",
                 "clone",
                 "-q",
                 "https://github.com/gregs1104/pgtune.git",
                 pgtune_dir
 
-        execute "#{pgtune_dir}/pgtune",
+        execute "sudo #{pgtune_dir}/pgtune",
                 "--input-config", pg_conf,
                 "--output-config", pgtune_output,
                 "--type", "Web",
                 "--connections", fetch(:fiftyfive_postgresql_max_connections)
 
         # Log diff for informational purposes
-        execute :diff, pg_conf, pgtune_output, "|| true"
+        execute :sudo, "diff", pg_conf, pgtune_output, "|| true"
 
-        execute :cp, pgtune_output, pg_conf
-        execute :service, "postgresql", "restart"
+        execute :sudo, "cp", pgtune_output, pg_conf
+        execute :sudo, "service", "postgresql", "restart"
       end
     end
 
@@ -109,7 +109,8 @@ namespace :fiftyfive do
           "/etc/logrotate.d/postgresql-backup-#{application_basename}",
           :owner => "root:root",
           :mode => "644",
-          :binding => binding
+          :binding => binding,
+          :sudo => true
       end
     end
 

data/lib/capistrano/tasks/rbenv.rake

@@ -62,7 +62,7 @@ namespace :fiftyfive do
     task :bootstrap_ubuntu_for_ruby_compile do
       privileged_on release_roles(:all) do |host, user|
         with :debian_frontend => "noninteractive" do
-          execute "~#{user}/.rbenv/plugins/rbenv-bootstrap/bin/rbenv-bootstrap-ubuntu-12-04"
+          execute "sudo ~#{user}/.rbenv/plugins/rbenv-bootstrap/bin/rbenv-bootstrap-ubuntu-12-04"
         end
       end
     end

data/lib/capistrano/tasks/sidekiq.rake

@@ -14,9 +14,10 @@ namespace :fiftyfive do
         template "sidekiq_init.erb",
                  "/etc/init.d/sidekiq_#{application_basename}",
                  :mode => "a+rx",
-                 :binding => binding
+                 :binding => binding,
+                 :sudo => true
 
-        execute "update-rc.d -f sidekiq_#{application_basename} defaults"
+        execute "sudo update-rc.d -f sidekiq_#{application_basename} defaults"
       end
     end
 

data/lib/capistrano/tasks/ssl.rake

@@ -19,7 +19,7 @@ namespace :fiftyfive do
     def _run_ssl_script(opt="")
       privileged_on primary(:web) do
         files_exist = %w(.key .csr .crt).any? do |ext|
-          test("[ -f /etc/ssl/#{application_basename}#{ext} ]")
+          test("sudo [ -f /etc/ssl/#{application_basename}#{ext} ]")
         end
 
         if files_exist
@@ -34,12 +34,12 @@ namespace :fiftyfive do
           config = "/tmp/csr_config"
           ssl_script = "/tmp/ssl_script"
 
-          template("csr_config.erb", config)
-          template("ssl_setup", ssl_script, :mode => "+x")
+          template("csr_config.erb", config, :sudo => true)
+          template("ssl_setup", ssl_script, :mode => "+x", :sudo => true)
 
           within "/etc/ssl" do
-            execute ssl_script, opt, application_basename, config
-            execute :rm, ssl_script, config
+            execute :sudo, ssl_script, opt, application_basename, config
+            execute :sudo, "rm", ssl_script, config
           end
         end
       end

data/lib/capistrano/tasks/ufw.rake

@@ -11,21 +11,21 @@ namespace :fiftyfive do
 
       # First reset the firewall on all affected servers
       privileged_on roles(*distinct_roles) do
-        execute "ufw --force reset"
-        execute "ufw default deny incoming"
-        execute "ufw default allow outgoing"
+        execute "sudo ufw --force reset"
+        execute "sudo ufw default deny incoming"
+        execute "sudo ufw default allow outgoing"
       end
 
       # Then set up all ufw rules according to the fiftyfive_ufw_rules hash
       rules.each do |command, *role_names|
         privileged_on roles(*role_names.flatten) do
-          execute "ufw #{command}"
+          execute "sudo ufw #{command}"
         end
       end
 
       # Finally, enable the firewall on all affected servers
       privileged_on roles(*distinct_roles) do
-        execute "ufw --force enable"
+        execute "sudo ufw --force enable"
       end
     end
   end

data/lib/capistrano/tasks/unicorn.rake

@@ -16,9 +16,10 @@ namespace :fiftyfive do
         template "unicorn_init.erb",
                  "/etc/init.d/unicorn_#{application_basename}",
                  :mode => "a+rx",
-                 :binding => binding
+                 :binding => binding,
+                 :sudo => true
 
-        execute "update-rc.d -f unicorn_#{application_basename} defaults"
+        execute "sudo update-rc.d -f unicorn_#{application_basename} defaults"
       end
     end
 

data/lib/capistrano/tasks/user.rake

@@ -7,8 +7,8 @@ namespace :fiftyfive do
     desc "Create the UNIX user if it doesn't already exist"
     task :add do
       privileged_on roles(:all) do |host, user|
-        unless test("grep -q #{user}: /etc/passwd")
-          execute :adduser, "--disabled-password", user, "</dev/null"
+        unless test("sudo grep -q #{user}: /etc/passwd")
+          execute :sudo, "adduser", "--disabled-password", user, "</dev/null"
         end
       end
     end
@@ -16,12 +16,15 @@ namespace :fiftyfive do
     desc "Copy root's authorized_keys to the user account if it doesn't "\
          "already have its own keys"
     task :install_public_key do
+      root = fetch(:fiftyfive_privileged_user)
+
       privileged_on roles(:all) do |host, user|
-        unless test("[ -f /home/#{user}/.ssh/authorized_keys ]")
-          execute :mkdir, "-p", "/home/#{user}/.ssh"
-          execute :cp, "~/.ssh/authorized_keys", "/home/#{user}/.ssh"
-          execute :chown, "-R", "#{user}:#{user}", "/home/#{user}/.ssh"
-          execute :chmod, "600", "/home/#{user}/.ssh/authorized_keys"
+        unless test("sudo [ -f /home/#{user}/.ssh/authorized_keys ]")
+          execute :sudo, "mkdir", "-p", "/home/#{user}/.ssh"
+          execute :sudo, "cp", "~#{root}/.ssh/authorized_keys",
+                               "/home/#{user}/.ssh"
+          execute :sudo, "chown", "-R", "#{user}:#{user}", "/home/#{user}/.ssh"
+          execute :sudo, "chmod", "600", "/home/#{user}/.ssh/authorized_keys"
         end
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: capistrano-fiftyfive
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.13.0
 platform: ruby
 authors:
 - Matt Brictson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-09-12 00:00:00.000000000 Z
+date: 2014-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: capistrano