# looking for best practice for alternate user git clone of a private repo

**URL:** <https://forum.ansible.com/t/looking-for-best-practice-for-alternate-user-git-clone-of-a-private-repo/13494>\
**Category:** Ansible Project\
**Created:** [September 17, 2013, 11:47am UTC](https://forum.ansible.com/t/looking-for-best-practice-for-alternate-user-git-clone-of-a-private-repo/13494 "2013-09-17T11:47:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jerome\_Wagner](https://avatars.discourse-cdn.com/v4/letter/j/76d3ee/32.png) [@Jerome\_Wagner](https://forum.ansible.com/u/Jerome_Wagner)\
**Post date:** [September 17, 2013, 11:47am UTC](https://forum.ansible.com/t/looking-for-best-practice-for-alternate-user-git-clone-of-a-private-repo/13494/1 "2013-09-17T11:47:26Z")

</div>

Hello,

my question is half-ansible, half-sysop so I hope it is ok on the list.

my ‘ansibler’ user needs to git clone a repo on behalf of user ‘app’.  
‘ansibler’ is the only user having ssh access to the machine.  
the git repo is a protected repo only available via ssh keys.

important: I want the cloned repo to have the same ownership / permissions that it would have had if the ‘app’ user executed the git clone.

up until now, my plan was to execute the ansible task with a sudo\_user=app. I managed to have the forwarding agent forward the keys up to the ‘app’ user and added the host to the known\_hosts of user ‘app’.  
It works but its a bit of a hack to have ansible forward the keys. cf ticket [https://github.com/ansible/ansible/pull/4100](https://github.com/ansible/ansible/pull/4100)

So I am looking for best practices that people are using to solve this.

I understand that if ‘ansibler’ has acls/permissions to write in ‘app’ home, ‘ansibler’ could git clone directly inside ‘app’ home, but how to you handle the ownership/permission aspect of things so that you end up with a app:app ownership and the correct permissions ? permissions could be handled via acl defaults when acl are available but for the ownership, do you chown recursively ?

can you share a pointer to a playbook demonstrating this ?

I read here and there on the ML that it is best to prepare packages on the control machine and then install those packages on the remotes after a copy is done. Is that the best practive / preferred way to deploy an application ? can you share a playbook on this approach (creating a package on the control machine, packaging an app out of a git repo)

Thank you !

---

<div class="post-metadata">

**Author:** ![Victor\_Castell](https://avatars.discourse-cdn.com/v4/letter/v/df705f/32.png) [@Victor\_Castell](https://forum.ansible.com/u/Victor_Castell)\
**Post date:** [September 17, 2013, 7:26pm UTC](https://forum.ansible.com/t/looking-for-best-practice-for-alternate-user-git-clone-of-a-private-repo/13494/2 "2013-09-17T19:26:52Z")

</div>

The method I use is to generate a keypair for the app user and store it. Use ansible to copy the keys to their corresponding path (/home/app/.ssh)

Then use app's pub key to setup a "deploy key" in your private repo hosting (usually a kind of read only key)