deploy: Use synnefo user/group snf-common creates

Synnefo conf files are shipped as root:www-data for security issues.
The point is that they cannot be modified by anyone other than root
while being readable only by www-data group. There is a known bug in
gunicorn that does not set supplementary groups when changing uid
[1]. Therefore gunicorn should run with group www-data.

Currently Archipelago can run as non root (archipelago:archipelago
by default). In order Pithos and Cyclades to be able to work with
Archipelago, gunicorn must run as the same user. Let this user be
synnefo, the one that snf-common adds upon installation.

In short make Archipelago run as synnefo:synnefo, gunicorn
as synnefo:www-data, and snf-dispatcher as www-data:www-data

Since we are using NFS we create synnefo group with common
gid across all nodes. The Archipelago dir to be exported
will be owned by root:synnefo and have group write permissions.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=762448

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
deploy: A workaround for archipelago bug

Due to a bug in archipelago [2] we chown /dev/shm/posixfd after
archipelago restart.

This should be reverted after this PR is merged and a
new archipelago version is released.

[2] https://github.com/grnet/archipelago/pull/44

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Mention the synnefo group in upgrade notes

Synnefo will run as synnefo:www-data while archipelago as
synnefo:synnefo. Mention the changes that should be
made after package installation wrt mods and permissions.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>