[tor-bugs] #29663 [Internal Services/Services Admin Team]: Deploy /etc/puppet as a role account

[Tor Bug Tracker & Wiki]

#29663: Deploy /etc/puppet as a role account
-------------------------------------------------+-------------------------
 Reporter:  ln5                                  |          Owner:  anarcat
     Type:  enhancement                          |         Status:
                                                 |  assigned
 Priority:  Medium                               |      Milestone:
Component:  Internal Services/Services Admin     |        Version:
  Team                                           |
 Severity:  Normal                               |     Resolution:
 Keywords:                                       |  Actual Points:
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------
Changes (by anarcat):

 * owner:  (none) => anarcat
 * status:  new => assigned


Comment:

 just had this problem:

 {{{
 anarcat at pauli:/etc/puppet/modules/ipsec/misc$ git pull
 Mise à jour a4dea802..d9e168b5
 error: unable to unlink old 'modules/ipsec/misc/config.yaml': Permission
 non accordée
 anarcat at pauli:/etc/puppet/modules/ipsec/misc$ ls -al
 total 12
 drwxrwxr-x 2 weasel weasel 4096 mai  3  2018 .
 drwxr-xr-x 5 weasel weasel 4096 jui 27  2017 ..
 -rw-rw-r-- 1 weasel weasel 1076 mai  3  2018 config.yaml
 }}}

 I am not sure that we need a role to fix this problem. Git should be able
 to set the proper permissions everywhere with the `sharedMode` variable,
 so I did the following:

 {{{
 sudo chown -R root:adm /etc/puppet
 sudo chown :puppet /etc/puppet/secret
 sudo chmod -R g+w /etc/puppet
 sudo chmod g-w /etc/puppet/secret
 git -C /etc/puppet config core.sharedRepository group
 git -C /srv/puppet.torproject.org/git/tor-puppet.git/ config
 core.sharedRepository group
 }}}

 Hopefully this will fix the problem indefinitely.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/29663#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online