How can I have Supervisor running my programs as another user?

Question

I'm having a lot of trouble making supervisor running my commands with expanded environment variables.

My supervisor conf.

; supervisor config file

[unix_http_server]
file=/var/run//supervisor.sock   ; (the path to the socket file)
chmod=0700                       ; sockef file mode (default 0700)

[supervisord]
logfile=/var/log/supervisor/supervisord.log ; (main log file;default $CWD/supervisord.log)
pidfile=/var/run/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
childlogdir=/var/log/supervisor            ; ('AUTO' child log dir, default $TEMP)
user = a-user-name
environment = HOME='/home/a-user-name',APP='staging.example.com',SYMFONY_ENVIRONMENT='staging'

; the below section must remain in the config file for RPC
; (supervisorctl/web interface) to work, additional interfaces may be
; added by defining them in separate rpcinterface: sections
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

[supervisorctl]
serverurl=unix:///var/run//supervisor.sock ; use a unix:// URL  for a unix socket

; The [include] section can just contain the "files" setting.  This
; setting can list multiple files (separated by whitespace or
; newlines).  It can also contain wildcards.  The filenames are
; interpreted as relative to this file.  Included files *cannot*
; include files themselves.

[include]
files = /etc/supervisor/conf.d/*.conf
files = /home/a-user-name/apps/staging.example.com/current/app/Resources/config/supervisor/*.conf

And under-version-control.conf in ~/apps/staging.example.com/current/app/Resources/config/supervisor

[program:hank-message-forwarder]
stdout_logfile = /var/log/pink-tie/%(program_name)s-out.log
stderr_logfile = /var/log/pink-tie/%(program_name)s-err.log
logfile_maxbytes = 50MB
logfile_backups = 10
identifier = hank-message-forwarder
command = %(ENV_HOME)s/apps/%(ENV_APP)s/current/bin/hank forward-messages tcp://*:5500 tcp://*:5600

What am I doing wrong here? The error I'm getting is not helpful at all. It's complaining about the fact that it can't connect to the unix server but once I remove the files, user and environment directive (all that I've changed basically) all goes back to normal.

Answer 1

but once I remove the files, user and environment directive (all that I've changed basically) all goes back to normal.

Sounds like you have a syntax problem. After referencing the online documentation... The user entry looks good. user = a-user-name But the environment looks odd to me. Try changing your single-quotes to double-quotes.

Change it from this;

environment = HOME='/home/a-user-name',APP='staging.example.com',SYMFONY_ENVIRONMENT='staging'

To this;

environment = HOME="/home/a-user-name",APP="staging.example.com",SYMFONY_ENVIRONMENT="staging"

EDIT:

I just noticed you have an asteriks in one of your "files=" lines. This I haven't seen before in practice (I've only specified complete filenames). But the online documentation does show wildcards ("*" and "?").

However, the Online documentation mentions the following (emphasis added);

If the configuration file contains an [include] section, it must contain a single key named “files”. The values in this key specify other configuration files to be included within the configuration.

Answer 2

Without actually looking in detail. One thought came to mind. You can't run a process as another user unless that user has sufficient privileges to do so.

So the question is to you, is supervisord running as root or as a lower privilege user?