production-v2.cfg

# New style of deployments:
# - increased security through support for multiple users
# - deployments are now located at /apps/0x-plone-y
# - the groups "deploy" and "zope" make sure every user has the right access
#   to the files
# - files are owned by the deploying user and the service user (zope) does not
#   have write access to the source code and other files
# - files which are written by the service user (zope), such as the database,
#   are owned by the zope group.
#
# Usage:
# This config file must be extended after extending the production.cfg.
# It is not a replacement for the production.cfg but an extension.

[buildout]
early-parts += fix-solr-permissions
parts += setpermissions

[deployment]
etc-directory = /apps/etc

[fix-solr-permissions]
recipe = plone.recipe.command
command =
    sudo -u ${buildout:os-user} chmod -R --silent g+w ${buildout:directory}/parts/solr-instance/solr-webapp/webapp
update-command = ${:command}

[setpermissions]
# Make sure that the var directory is owned by the "zope" group in order to
# let the service user "zope" have write access.
recipe = plone.recipe.command
command =
    chgrp --silent -R ${buildout:os-user} ${buildout:directory}/var
    find ${buildout:directory}/var -maxdepth 1 -type d -exec chmod --silent 2770 {} \;
    # Make sure supervisord is always started as "zope" user using sudo.
    chmod --silent u-x,g-x ${buildout:directory}/bin/supervisord
    # Make sure that other users can access the egg infos later.
    chmod -R --silent g+rw,o+r /apps/eggs/*
    # Make sure that other users can access the extends-cache later.
    chmod -R --silent g+rw,o+r /apps/extends-cache/*
    # Make sure that other users can access the downloads later.
    chmod -R --silent g+rw,o+r /apps/downloads/*
    chgrp -R --silent deploy /apps/downloads/*
    # Make sure other deployers can change bin scripts.
    chmod --silent g+rw ${buildout:directory}/bin/*
    # Make sure other deployers can change parts.
    chmod -R --silent g+rw ${buildout:directory}/parts/*
    chgrp -R --silent deploy ${buildout:directory}/parts/*
    # Make sure that "zope" have write access to solr-specific folders.
    chgrp --silent -R ${buildout:os-user} ${buildout:directory}/parts/solr-instance/logs
    chgrp --silent -R ${buildout:os-user} ${buildout:directory}/parts/solr-instance/solr-webapp
    # Make sure that /apps/etc/**/* is group writeable.
    chmod -R --silent g+rw,o+r /apps/etc/*
update-command = ${:command}