3 ms·
If you're always using `become_user: root` in your playbooks, maybe think about writing them differently! I have experience with Tower, and have never configur
by chucky_z 9y ago
If you're always using `become_user: root` in your playbooks, maybe think about writing them differently! I have experience with Tower, and have never configured users to have any level of access beyond very, very basic SSH access.
- Spivak 9y agoSure, but from an ops perspective you won't really be able to do much sysadmining without root privileges.
- emmelaich 9y agoMy method is to have a "app superuser"; a user which is a group admin* for every group that I run apps as. It can then do everything required with a few exceptions. The exceptions are creating init/systemd files (associated startup/shutdown) and creating the necessary top-level directories for new apps. Those can be allowed with a few careful sudo rules. It can be a little convoluted but much more secure. * "gpasswd -A <user>,,, <group>" Note: to be a group admin doesn't necessarily mean you're in that group; it means that you can put yourself in and out of that group as required.