Skip to content

Commit

Permalink
Use owner with template, rather than become with an unprivileged user
Browse files Browse the repository at this point in the history
When connecting to a host as an unprivileged user, using "become"
to become *another* unprivileged user can be problematic. Since
we were using the unprivileged taiga_user in two instances only
so we could drop a file as that user, become root instead and let
it drop the file as owned by taiga_user instead.

Reference:
https://docs.ansible.com/ansible/latest/user_guide/become.html#becoming-an-unprivileged-user
  • Loading branch information
fghaas committed Jan 3, 2021
1 parent bdafc28 commit 6b42dac
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 2 deletions.
3 changes: 2 additions & 1 deletion roles/taiga-back/tasks/systemd.yml
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
- name: add taiga to systemd
become: true
become_user: "{{ taiga_user }}"
become_user: root
template:
mode: "0644"
owner: "{{ taiga_user }}"
src: "{{ item }}.service.j2"
dest: "/etc/systemd/system/{{ item }}.service"
with_items:
Expand Down
3 changes: 2 additions & 1 deletion roles/taiga-webserver/tasks/nginx.yml
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,10 @@

- name: add taiga to nginx
become: true
become_user: "{{ taiga_user }}"
become_user: root
template:
mode: '0644'
owner: "{{ taiga_user }}"
src: taiga.conf.j2
dest: "/etc/nginx/conf.d/taiga.conf"
notify:
Expand Down

0 comments on commit 6b42dac

Please sign in to comment.