60 lines
1.5 KiB
Markdown
60 lines
1.5 KiB
Markdown
|
---
|
||
|
|
tags:
|
||
|
|
- servers
|
||
|
|
---
|
||
|
|
|
||
|
|
# Create a deploy user
|
||
|
|
|
||
|
|
When I want to run deploy operations on my server from a client that is not me
|
||
|
|
(e.g. Forgejo) it is best to create a user for this purpose that has limited
|
||
|
|
conditions - more restricted than my `/home` user.
|
||
|
|
|
||
|
|
Create user on server:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
sudo useradd -m -s /bin/bash deploy
|
||
|
|
```
|
||
|
|
|
||
|
|
> `-m` gives him a home directory which is necessary for him to have an `.ssh/`
|
||
|
|
> directory. `/bin/bash` gives him the ability to run shell commands.
|
||
|
|
|
||
|
|
Give permissions:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
sudo chown -R deploy:www-data /var/www
|
||
|
|
sudo chmod -R 755 /var/www/
|
||
|
|
```
|
||
|
|
|
||
|
|
This:
|
||
|
|
|
||
|
|
- Adds the user ("deploy") to the group of the default web server user
|
||
|
|
(`www-data`)
|
||
|
|
- Gives deploy user full read/write/execute
|
||
|
|
|
||
|
|
Then create an SSH key-pair for the deploy user following the steps at
|
||
|
|
[Generating an SSH key for server access](./Generating_SSH_key_for_server_access.md)
|
||
|
|
and add his public key to the `authorized_keys` file on the server.
|
||
|
|
|
||
|
|
He'll first need his own `.ssh` directory however:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
sudo mkdir -p /home/deploy/.ssh
|
||
|
|
sudo touch /home/deploy/.ssh/authorized_keys
|
||
|
|
sudo chmod 700 /home/deploy/.ssh
|
||
|
|
sudo chmod 600 /home/deploy/.ssh/authorized_keys
|
||
|
|
sudo chown -R deploy:deploy /home/deploy/.ssh
|
||
|
|
```
|
||
|
|
|
||
|
|
Then attempt to connect to ensure SSH access is working:
|
||
|
|
|
||
|
|
```sh
|
||
|
|
ssh -i .ssh/deploy_self_host_server deploy@server_ip
|
||
|
|
|
||
|
|
```
|
||
|
|
|
||
|
|
Now the SSH key associated with the deploy user can be used to remotely execute
|
||
|
|
deployment functions on the server from any client.
|
||
|
|
|
||
|
|
Next need to add deploy user's key to Forgejo eolas-api repo and test the action
|
||
|
|
again
|