At my company, we currently have one main project which is a big monolithic Rails app. Deployment is easy, we have a couple of frontend servers (setup with Puppet) which Capistrano deploys into
/var/www/<hostname>/current. It then restarts Unicorn (zero downtime deploys!) and everyone is happy.
Unfortunately there is a problem. The monolithic nature of the app is starting to bite us. It now takes over 30 minutes to run all the tests, and it is slowing us down. We are looking to split it into smaller chunks and adopt a more μService architecture. However this has made me think about our deployment strategy. As it stands:
- the Rails application and Nginx run as the
- Any users who have access to the box can deploy (in Capistrano we
chownstuff to the app user during deployment)
The security of this is rather low (everything running as the same user, everyone able to access everything). It also reminds me of how we did things at a previous company - it was a nightmare as all the apps were stuck on Ruby 1.6 as they shared the same version.
I'm thinking we can make this better by installing
rbenv to allow each app to run it's own version of Ruby, and having users per app to increase security. But I haven't really seen any examples of this in practise. For example 37signals run all apps as the same user - I'm concerned that there is a good reason why the apps shouldn't be run as different users.
- What is the best way to deploy multiple Rails apps to a server in a μService style architecture?
- What is the best way to isolate each of the apps (in terms of Ruby versions and user security)?
Thanks in advance!