Proper permission setting on the server

[hktang]

I'm struggling to figure out how to properly set up permissions.

In the deploy.php, I use a non-root user to deploy the application.

host("mystaging.dev")
    ->set("remote_user", "newuser")
    ->set("deploy_path", "/home/newuser/html/mystaging.dev/");

The deployment works but I have to manually set the ownership of the deploy_path to www-data:www-data. However, this prevents running future dep deploy commands, as the user doesn't have enough permission.

/.dep/deploy.lock: Permission denied

I am sure there's a way to automate this, and I am not following best practices. I have looked through the docs but could not find any good resources. Any help is much appreciated!

[antonmedv]

Make sure your deploy user in under www-data group. Or use deployer's provision recipe: https://deployer.org/docs/7.x/getting-started#provision

[rabol]

the only problem with this is that it requires an old version of Ubuntu

[antonmedv]

It's important to follow best practices when it comes to setting up permissions for your deployments. Here are a few suggestions to help automate this process:

1. Use a deployment user group
   You can create a group for your deployment user and www-data user, and then set the deploy_path directory to be owned by that group. This will allow both users to access the directory and perform operations on it.

To do this, you can use the following command:

sudo chown -R newuser:deploy /home/newuser/html/mystaging.dev/

Note: Replace 'deploy' with the actual group name you want to use for your deployment user group.

2. Use setfacl to grant permission to the user
   Another option is to use setfacl to grant permission to the deployment user. This allows you to set more fine-grained permissions for the user on the deploy_path directory.

sudo setfacl -R -m u:newuser:rwx /home/newuser/html/mystaging.dev/

This will grant read, write and execute permissions to the user 'newuser' on the 'mystaging.dev' directory.

[hktang]

Thank you so much!

"Use a deployment user group" works like a charm.

[rabol]

Hmm.. I must have missed something

on a brand new server:

create a new group:

sudo addgroup deployment

Create a new user

add the user to sudo

sudo usermod -a -G sudo deployer

make the www-data user part of the deployment group:

sudo usermod -a -G deployment www-data

created the the deployment path:

sudo mkdir /var/www/<dir_name>

as above

sudo chown -R deployer:deployment /var/www/<dir_name>

as above

sudo setfacl -R -m u:deployer:rwx /var/www/<dir_name>/

and my deploy.php looks like this:

<?php

declare(strict_types=1);

namespace Deployer;

require 'recipe/laravel.php';
require 'contrib/php-fpm.php';
require 'contrib/npm.php';

set('user', 'deployer');
set('group', 'deployment');

set('http_user', 'www-data');
set('http_group', 'www-data');
set('writable_mode', 'chgrp');
set('writable_use_sudo', true);
set('writable_recursive', true);
set('writable_chmod_mode', '0775');

set('application', <application_name>);
set('repository', <name_of_repo>);
set('php_fpm_version', '8.3');

$writable = get('writable_dirs');
$writable[] = <dirname>
$writable[] = <dirname>
$writable[] = <dirname>
$writable[] = <dirname>

set('writable_dirs', $writable);

host('prod')
    ->set('remote_user', 'deployer')
    ->set('hostname', <host_name>)
    ->set('deploy_path', '/var/www/{{application}}');

// supervisor
desc('Restart supervisord restart');
task('supervisor:restart', function (): void {
    run('sudo service supervisord restart');
});

desc('Remove nodes_modules');
task('npm:cleanup', function (): void {
    run('rm -rf /var/www/<application_dir>/current/node_modules');
});

task('npm:run:prod', function (): void {
    cd('{{release_or_current_path}}');
    run('npm run prod');
});

task('npm:run:build', function (): void {
    cd('{{release_or_current_path}}');
    run('npm run build');
});
desc('Change Project Ownership');
task('change:ownership', function (): void {
    run('cd {{release_path}} && chown -Rf {{user}}:{{group}} .');
});

desc('Make deploy path');
task('make:deploypath', function (): void {
    run('mkdir -p {{deploy_path}}');
});

desc('Become root');
task('become:root', function (): void {
    run('sudo su -');
});

desc('link phpmyadmin');
task('link:phpmyadmin', function (): void {
    run('sudo ln -s /var/www/phpmyadmin/ /var/www/<application_dir>/current/public/phpmyadmin');
});

desc('restart supervisord');
task('restart:supervisord', function (): void {
    run('sudo supervisorctl restart all ');
});

desc('my info');
task('my:info', function (): void {
    writeln('-----');
    $writable = get('writable_dirs');
    foreach ($writable as $w) {
        writeln($w);
    }
    writeln('-----');
});

desc('Create sitemap');
task('artisan:make-sitemap', artisan('sitemap:generate'));

task('deploy', [
    'deploy:prepare',
    'deploy:vendors',
    'artisan:storage:link',
    'artisan:view:clear',
    'artisan:view:cache',
    'artisan:config:clear',
    'artisan:config:cache',
    'artisan:migrate',
    'my:info',
    'npm:install',
    'npm:run:build',
    'deploy:publish',
    'change:ownership',
    'npm:cleanup',
    'link:phpmyadmin',
    'restart:supervisord',
    'artisan:optimize:clear',
    'deploy:publish',
    'artisan:make-sitemap',
]);

after('deploy:failed', 'deploy:unlock');

but it fails :(

./vendor/bin/dep deploy
task deploy:info
[prod] info deploying HEAD
task deploy:setup
task deploy:lock
task deploy:release
task deploy:update_code
task deploy:shared
task deploy:writable
task deploy:vendors
task artisan:storage:link
task artisan:view:clear
task artisan:view:cache
task artisan:config:clear
task artisan:config:cache
task artisan:migrate
task my:info
[prod] -----
<some info>
[prod] -----
task npm:install
task npm:run:build
task deploy:symlink
task deploy:unlock
task deploy:cleanup
task deploy:success
[prod] info successfully deployed!
task change:ownership
task npm:cleanup
task link:phpmyadmin
task restart:supervisord
task artisan:optimize:clear
task deploy:symlink
[prod]  error  in symlink.php on line 12:
[prod] run mv -T /var/www/<application_dir>/release /var/www/<application_dir>/current
[prod] err mv: cannot stat '/var/www/<application_dir>/release': No such file or directory
[prod] exit code 1 (General error)
ERROR: Task deploy:symlink failed!
task deploy:failed
task deploy:unlock