Running Ansible playbooks as www-data

Archives Ansible Developer
1

Greetings,

I’m writing some web based system management utilities. Having the application fire ansible playbooks seems perfect and a natural direction to go. PHP-Ansible (https://github.com/maschmann/php-ansible) works really well provided I set things up so that my www-data user (the nginx owner) is set up with a valid shell and can run the playbooks.

Yes, I am very aware that allowing a shell on the www-data user is a very bad practice.

What are some alternatives to the “let the web server user run playbooks” aproach? I’ve got to be missing something fundamental here.

Many thanks for any thoughts anyone might have.

-goat

2

userv. http://www.gnu.org/software/userv/

Have a different user that runs ansible, and get www-data to speak to
that user via userv.

We make extensive use of this pattern to enable our django app (a
control panel) to control VMs and the like with ansible.

Regards,

Matthew

3

Brilliant! This is exactly what I’ve been looking for! Thank you very much for your response!

-goat