{"action":"opened","issue":{"url":"https://api.github.com/repos/rehabstudio/oneill-server/issues/1","labels_url":"https://api.github.com/repos/rehabstudio/oneill-server/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/rehabstudio/oneill-server/issues/1/comments","events_url":"https://api.github.com/repos/rehabstudio/oneill-server/issues/1/events","html_url":"https://github.com/rehabstudio/oneill-server/issues/1","id":55829359,"number":1,"title":"oneill shouldn't run as root","user":{"login":"paddycarey","id":164309,"avatar_url":"https://avatars.githubusercontent.com/u/164309?v=3","gravatar_id":"","url":"https://api.github.com/users/paddycarey","html_url":"https://github.com/paddycarey","followers_url":"https://api.github.com/users/paddycarey/followers","following_url":"https://api.github.com/users/paddycarey/following{/other_user}","gists_url":"https://api.github.com/users/paddycarey/gists{/gist_id}","starred_url":"https://api.github.com/users/paddycarey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/paddycarey/subscriptions","organizations_url":"https://api.github.com/users/paddycarey/orgs","repos_url":"https://api.github.com/users/paddycarey/repos","events_url":"https://api.github.com/users/paddycarey/events{/privacy}","received_events_url":"https://api.github.com/users/paddycarey/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rehabstudio/oneill-server/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/rehabstudio/oneill-server/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-01-28T23:01:41Z","updated_at":"2015-01-28T23:01:41Z","closed_at":null,"body":"The newest versions of oneill call `sudo -n service nginx reload` instead of `service nginx reload`, so it's possible to configure sudoers to let the user running the oneill process reload nginx without entering a password. This allows oneill to run as a non-root user (mostly)\r\n\r\nA few things are required for this issue to be resolved:\r\n\r\n- Ansible should create a user called oneill and ensure that it:\r\n    - is in the `docker` group (so it can use docker)\r\n    - has `r/w` permissions for `/etc/nginx/sites-enabled` and `/etc/nginx/htpasswd`\r\n    - has `r` permissions for everything in `/etc/oneill`\r\n- Ansible should add an entry to `/etc/sudoers.d` to allow `oneill` to run `service nginx reload` without a password.\r\n    - e.g. `oneill   ALL=(ALL) NOPASSWD: /usr/sbin/service nginx reload`"}}