set-capistrano-permissions

#!/usr/bin/env ruby
require File.expand_path(File.dirname(__FILE__) + '/shared')
require 'optparse'

def parse_options
	options = {}
	parser = OptionParser.new do |opts|
		nl = "\n" + ' ' * 37
		opts.banner = "Usage: set-capistrano-permissions [options]"
		opts.separator ""
		
		opts.separator "Options:"
		opts.on("--for-app-dir DIR",
		        "Set only permissions for the given app#{nl}" +
		        "directory") do |value|
			options[:for_app_dir] = value
		end
	end
	begin
		parser.parse!
	rescue OptionParser::ParseError => e
		puts e
		puts
		puts "Please see '--help' for valid options."
		exit 1
	end

	if options[:help]
		puts parser
		exit
	else
		return options
	end
end

# Set the permissions on a /u/apps/.../releases/... directory.
def set_permissions_on_release_dir(dir)
	# Deny web server access to everything except for a few things.
	sh "deny #{WWW_USER} #{dir}"
	
	# Executable access to the directory itself
	# so that the web server can access subdirectories.
	sh "setfacl -m user:#{WWW_USER}:--x #{dir}"
	
	# Read-only access to the 'public' directory so that
	# the web server can serve static assets.
	if File.directory?("#{dir}/public")
		sh "permit #{WWW_USER} #{dir}/public"
	end
	
	# Executable access to the 'config' directory so that
	# Phusion Passenger's app autodetection works.
	if File.directory?("#{dir}/config")
		sh "setfacl -m user:#{WWW_USER}:--x #{dir}/config"
	end
end

# Set the permissions on a /u/apps/... directory.
def set_permissions_on_app_dir(dir)
	# Give the web server read-only access to everything.
	# We tighten up permissions in later commands.
	sh "permit #{WWW_USER} #{dir}"
	
	# Make the application directory itself executable-only
	# by the web server.
	if File.directory?("#{dir}/releases") || File.directory?("#{dir}/shared")
		sh "setfacl -m user:#{WWW_USER}:--x #{dir}"
		sh "setfacl -d -m user:#{WWW_USER}:--x #{dir}"
	end
	
	# Make the 'releases' directory executable-only by the web server
	# and set correct permissions on each release subdirectory.
	if File.directory?("#{dir}/releases")
		sh "setfacl -m user:#{WWW_USER}:--x #{dir}/releases"
		Dir["#{dir}/releases/*"].each do |release_subdir|
			set_permissions_on_release_dir(release_subdir)
		end
	end
	
	# Deny web server access to everything in the 'shared'
	# directory, with some exceptions.
	if File.directory?("#{dir}/shared")
		sh "deny #{WWW_USER} #{dir}/shared"
		
		# If there's a Capistrano repository cache, then give
		# it the same permissions as a release directory because
		# Capistrano actually makes a release directory but copying
		# cached-copy with 'cp -dpR', thereby copying all ACLs too.
		if File.directory?("#{dir}/shared/cached-copy")
			set_permissions_on_release_dir("#{dir}/shared/cached-copy")
		end
		
		# If you store attachment files in the 'shared'
		# directory then you can allow read-only access to that:
		# sh "setfacl -m user:#{WWW_USER}:--x #{dir}/shared"
		# sh "permit #{dir}/shared/attachments"
	end
end

def start
	options = parse_options
	if options[:for_app_dir]
		sh "setfacl -m user:#{WWW_USER}:--x #{CAPISTRANO_DIR}"
		sh "setfacl -d -m user:#{WWW_USER}:r-x #{CAPISTRANO_DIR}"
		set_permissions_on_app_dir(options[:for_app_dir])
	else
		sh "chmod -R g+w,o-rwx #{CAPISTRANO_DIR}"
		sh "setfacl -m user:#{WWW_USER}:--x #{CAPISTRANO_DIR}"
		sh "setfacl -d -m user:#{WWW_USER}:r-x #{CAPISTRANO_DIR}"
		
		Dir["#{CAPISTRANO_DIR}/*"].each do |dir|
			set_permissions_on_app_dir(dir)
		end
	end
end

CAPISTRANO_DIR = config(:capistrano_dir)
WWW_USER = config(:www_user)

start