Anahkiasen/rocketeer — pull request #85 by cviebrock (2014-01-07 19:56:24+00:00)
Title: [Feature] Use ACL instead of chmod/chown to alter permissions

This is an alternative solution to the permissions issues reported previously (#84, #83, #18, #14, maybe others).

### Issue:

If you have a dedicated deployment user (e.g. "deploy"), then each release is chowned by that user. That's fine, except that that user usually doesn't have permission to change the folders that need to be writable (e.g. "app/storage") so that they are owned by the web server. This _can_ be solved with sudo, but then you run into permission issues when it comes to symlinking ... which means granting more sudo access, including `rm -rf` access. Not good.

### Solution:

Many (most?) OSs support file access control lists, giving finer grained control of file and directory permissions. The application files can still be owned by the "deploy" user, but the web server user can be given "rwx" access as well using command line tools ... and without requiring sudo.

### How?

There are lots of tutorials online for turning on ACLs, depending on your server. In my case, I'm deploying to an Ubuntu server, so the basic steps were:

1. Install the required command line tools:
```
apt-get install acl
```

2. edit `/etc/fstab` to make sure my partitions are using ACLs:
```
/dev/xvda / ext3 noatime,errors=remount-ro,acl 0 1
^^^^
```

3. remount:
```
sudo mount -o remount /
```

4. make your deploy user part of the web-data group (to handle deletion of files created by the application, e.g. uploads, logs, cache, etc.):
```
sudo usermod -G www-data deploy
```

That's basically it. Then, in Rocketeer's `config/remote.php` file, use an appropriate ACL string, such as:

```
'setfacl' => 'u:www-data:rwx'
```

This gives the "www-data" user "rwx" permissions to the selected files. The only sudo access my deploy user needs is the ability to restart PHP-FPM (since the combination of NGINX and PHP-FPM doesn't immediately pick up on the symlink changes used when pointing to a new release):

```
deploy ALL=(ALL) NOPASSWD: /usr/sbin/service php5-fpm restart
```

Obviously, this PR requires some better documentation. If you like it, I'll write you up a wiki page with basically the same information as above, to help people use Rocketeer safely! ;)