Best practices for users when deploying Shopware 6

[docmedicus-support]

Hi,

we are currently trying to implement a workflow for deploying our Shopware 6 instance to a Ubuntu server from a Gitlab repo using Deployer.

The deployment seems to work fine, problems still arise with the users that we are using:

The deployment is done via a user "deployer" that can login via SSH key and is able to sudo. The nginx webserver uses "www-data" for the vhost. Adter deployment all files belong to "deployer", which is a problem, since Shopware needs to write files etc. during operation. Assuming the directory "current" needs to belong to "www-data", we saw that Deployer is already able to chmod the files to the local user after deployment. This would need an elevation of rights though, which in turn would need a password (instead of the SSH key) and couldn't be done automatically.

What would be the best practice approach here? Running nginx with a different user? Adjusting any group memberships/rights/etc.?

[antonmedv]

What about using groups? Make sure deployer is in www-data group and file/dir have www-data group and write permission for a group.

[docmedicus-support]

Hi @antonmedv

I can add deployer to the www-data group, but how do I then deploy resulting in the correct users and permissions applied (since the directories are created by deployer)?

I am trying to follow https://deployer.org/docs/7.x/recipe/shopware but am not sure about

• http_user ( I guess www-data then?)
• http_group (same?)
• writable_mode
• writable_recursive
• become (only possible when using password?)

Sorry if this is trivial but I would really like to do it "correctly". If I add deployer to the www-data group, what other steps/settings are needed?

[antonmedv]

Yep, set http_user and http_group to www-data. Add deployer to the www-data group. Then make sure deployed files are group-owned by www-data and writable by the group.

Use this in your Deployer config:

set('http_user', 'www-data');
set('http_group', 'www-data');
set('writable_mode', 'chmod');
set('writable_use_sudo', false);
set('writable_chmod_mode', 'g+w');
set('writable_recursive', true);

Also, set the setgid bit on your target dirs (chmod g+s) so new stuff inherits the group.

No need for sudo if permissions are right.