0

We have task like:

- template: 
    src=templates/nginx/default 
    dest=/etc/nginx/sites-available/default 
    owner=root 
    group=root

When I run it like:

ansible-playbook -i inventory/amazon site.yml -u ubuntu --become --limit=web

it works. But become makes user act as root, and if nginx update is only part of deployment process - become flag is dangerous.

If we remove it - ansible gives error like:

TASK [nginx : template] ********************************************************
fatal: [*****.eu-west-1.compute.amazonaws.com]: FAILED! => {"changed": true, "failed": true, "gid": 1000, "group": "ubuntu", "mode": "0777", "msg": "chown failed", "owner": "ubuntu", "path": "/etc/nginx/sites-available/default", "size": 275, "state": "file", "uid": 1000} 

So.. What is correct way to update nginx config, using ansible? Can it be done without --become?

  • 3
    become is not dangerous. 0777 is dangerous! – Michael Hampton Mar 28 '16 at 17:21
  • @MichaelHampton, ok, removed this part :) – Nikolay Fominyh Mar 28 '16 at 17:38
  • @MichaelHampton, problem is that become will make everything in playbook under root. It's dangerous. – Nikolay Fominyh Mar 28 '16 at 17:40
  • Why is that dangerous? Most everything you would run needs to be root. – Michael Hampton Mar 28 '16 at 17:40
  • @MichaelHampton, I don't want to run my applications under root. Really. It sounds weird? Running them under simple user is fine. – Nikolay Fominyh Mar 28 '16 at 17:42
3

Use become: yes on the task that needs root. See http://docs.ansible.com/ansible/become.html for the official reference.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.