1

What's a good way to use git for deployment and now have to "chown -R" the whole app directory to the www user every time I deploy?

Basically I want to deploy using a post receive hook. Currently I have a post-receive hook that looks something like this:

#!/bin/sh
git --work-tree=/home/www/my-web-app --git-dir=/home/john/repo/my-web-app.git checkout -f
sudo chown -R www:www /home/www/my-web-app
sudo /home/john/scripts/reload-my-web-app.sh

It works, but the problem is that the chown step is slow, because there are millions of files in the my-web-app folder.

I thought I'd get around the problem using git as user www, so that the checked out files already have the correct owner. So I changed the so that the git line in the post-receive hook to:

sudo -u www git --work-tree=/home/www/my-web-app --git-dir=/home/john/repo/my-web-app.git checkout -f

But this doesn't work because I get a permission error about not being able to write the index.lock file in the git repo. Obviously user www doesn't have permission to write in the git repo, and I don't want to give www that permission because it seems like it would be unfavorable for the server security.

So, what's an elegant solution in this situation? Would you checkout to a temp directory, and then rsync from the temp directory to the /home/www/my-web-app directory so that you copy the files and change the owner at the same time? I feel like there must be some simple solution that I'm missing.

toby-one
  • 191
  • 2
  • 11

1 Answers1

0

Considering Git is not a deployment tool, your rsync might be a better solution.

But check if setting the group is enough in your case, with a setgid on your my-web-app folder, as explained here. That might avoid the need to chown the files.

VonC
  • 1,262,500
  • 529
  • 4,410
  • 5,250
  • Thank you - setgid looks like a good option. My plan is now to `chmod g+s+w /home/www/my-web-app` That way the files that git checks out will belong to group www (thanks to g+s), and when the web app is running as user www data it will be able to write/delete files in the my-web-app directory (thanks to g+w). And I can get rid of the chown line in the post-receive hook. – toby-one Mar 08 '19 at 16:00