Yeah, makes sense, both in explanation and in execution. I'm just surprised
because when I asked about this last week, I was told this wasn't possible
in 1.3. I'm happy to find out about this, thanks.


On Wed, Oct 30, 2013 at 3:13 PM, John Jarvis <notifications@github.com>wrote:

> In playbooks/roles/certs/tasks/main.yml:
>
> > +    owner="{{ certs_user }}" group="{{ certs_user }}"
> > +    mode=0700
> > +
> > +- name: certs | copy the private gpg signing key
> > +  copy: >
> > +    src={{ CERTS_LOCAL_PRIVATE_KEY }}
> > +    dest={{ certs_app_dir }}/{{ CERTS_LOCAL_PRIVATE_KEY|basename }}
> > +    owner={{ certs_user }} mode=0600
> > +  register: certs_gpg_key
> > +  tags: deploy
> > +
> > +
> > +- name: certs | load the gpg key
> > +  shell: >
> > +    /usr/bin/gpg --homedir {{ certs_gpg_dir }} --import {{ certs_app_dir }}/{{ CERTS_LOCAL_PRIVATE_KEY|basename }}
> > +  sudo_user: "{{ certs_user }}"
>
> If you set "sudo_user" it will run the command as sudo -u certs ... which
> is what I want to do here.
> It assumes that whoever is running the play has permission to do that,
> make sense?
> At the toplevel play we have "sudo: True" though the end goal will be to
> run the tasks tagged "deploy" without full sudo, eventually.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/edx/configuration/pull/375/files#r7328069>
> .
>