Managing nginx configurations

Question

My goal is to be able to update my server configurations (eg, nginx) quickly and easily using version control (eg, git). One requirement I had in mind was to have the configurations stored inside the code repository so when a developer clones the repo they get the required files with it.

I came up with a few creative solutions, but they both feel like they shouldn't be done.

Idea 1

Have a repository on the server named nginx-config which holds submodules for each websites vhost config. The layout would look like this:

nginx-config
|- nginx.conf
|
|- sites-available
|    - domain.com (submodule)
|        - website.conf
|
|    - domain.com (submodule)
|        - website.conf

I can then have the vhost submodule in my code repository. However, this method isn't automated as I need to login to the server to update the nginx config directory. Automating it would require a post-commit hook and root permissions for the deployer.

Idea 2

Have the nginx config for the code stored directly inside the repository and on push, symlink the config file to where nginx is looking. This requires a post-commit hook on the server and would require the user to be given sudo ability to symlink the file.

---

Although both solutions could work, they both feel wrong, ie: brittle and not automated.

I heard people talking about using puppet for this, but I couldn't find a decent guide / tutorial for what I wanted to do; I also fear it's a bit much for a simple setup.

If someone can point me in the right direction that'd be great.

Answer 1

Do you have any sort of central git repo that is considered the "master"? This would make things significantly easier, as then you can use something like Gitolite to set up access control to it. Once you have a separate repo setup, you can use a post-recieve hook to update the configs after code is pushed to it. The advantage here is that the repo can have it's own (non-public) ssh key, so you don't actually need to give root access to anyone.

Answer 2

A git push can be made interactive with the remote. Use this to prompt to sudo and prompt for the root password to reload nginx.

Additionally, you can add a user with an entry in the sudoers file that allows it elevated privileges only when reloading nginx.