deploy_user

Synopsis

  • Provisions a dedicated system user for automated deployments, ensures matching UID/GID for cross-node consistency, generates and installs SSH keys, hardens sshd_config to allow only the deploy user, and drops a .profile that activates the app’s Python virtualenv on interactive login.

  • The role depends on the build_dependencies role (see meta/main.yml). Setup tasks are tagged setup,never and are skipped unless the playbook is invoked with --tags=all,setup.

Parameters

Parameter

Comments

app_name

string

Application identifier used as a comment in the generated .profile header. Purely cosmetic; safe to omit.

current_deploy

string

Path to the currently-active deploy directory. Referenced by the activate alias in the deploy user’s .profile. Set by the deploy role.

deploy_env_vars

dictionary

Optional mapping of extra environment variables to export from the deploy user’s .profile. Each key becomes an export line.

deploy_user

string

Name of the deployment user and its primary group.

Default: "conan"

deploy_user_shell

string

Login shell for the deployment user.

Default: "/bin/bash"

deploy_user_uid

integer / required

Numeric UID for the deployment user; also used as the GID for the matching primary group so file ownership is consistent across nodes (important for rsync between application and Solr servers). Must be set per host; no default is provided.

install_root

string

Filesystem root under which the app is installed. When defined, the generated activate alias uses it to locate the current deploy. Normally set by the deploy / configure roles.

python_venv_path_prefix

string

Optional path fragment prepended to env/bin/activate when building shell aliases. Use when the virtualenv is not a direct sibling of the current deploy directory.

Default: ""

runtime_env

string

Deployment environment name (e.g. staging, production). Exported as DJANGO_ENV in the deploy user’s .profile for django-split-settings-based apps. Typically set via -e runtime_env=<env> on the playbook command line; see README.md for defaults per environment.

webapp_group

string

Existing webserver group on the target system. The deployment user is added as a supplementary member so it can write to shared web-server-owned files (logs, media, etc.).

Default: "www-data"

Authors

  • Center for Digital Humanities @ Princeton