Merge lp:~wesmason/charms/trusty/conn-check/trunk-fix-perms into lp:~ubuntuone-hackers/charms/trusty/conn-check/trunk

[Wes Mason]

Ensure config file, if written by charm, is set to the right user/group

Ensure we set the correct user/group on the config file if the charm writes it (rather than being set by config_path).

[Michael Nelson (michael.nelson)]

20:48 < noodles> wes: I still don't understand why you don't just do nagios:nagios for those perms?
20:49 < noodles> Why do the "run check" and "run nagios checks" tasks need a separate user?
20:50 < wes> noodles: I don't think they do, although I am uneasy about creating/updating the user in the conn-check charm which may be created/updated differently in the nrpe charm
20:51 -!- noise [<email address hidden>] has quit [Ping timeout: 121 seconds]
20:52 < noodles> wes: why would you create/update the user?
20:52 < noodles> Don't those tasks specifically run after the nagios user will already be created?
20:53 < wes> noodles: nope, as it's not guaranteed you're using nagios with the charm
20:54 < noodles> OK, makes sense.

review: Approve

=== modified file 'playbook.yaml'
--- playbook.yaml	2015-05-12 09:08:14 +0000
+++ playbook.yaml	2015-05-14 11:01:21 +0000
@@ -11,6 +11,8 @@
     wheels_url: http://bazaar.launchpad.net/~ubuntuone-hackers/conn-check/wheels
     current_dir: "{{ env_dir }}/{{ revision }}"
     bin_path: "{{ current_dir }}/bin/conn-check"
+    user: conn-check
+    group: nagios
 
   tasks:
 
@@ -65,6 +67,8 @@
       copy:
         content: "{{ relations['conn-check'][0]['config'] }}"
         dest: "{{ config_path }}"
+        owner: "{{ user }}"
+        group: "{{ group }}"
         mode: 0600
       when: not (path_provided | bool) and (config_provided | bool)
 
@@ -99,18 +103,18 @@
       tags:
         - install
         - upgrade-charm
-      group: name=conn-check system=yes
+      group: "name={{ group }} system=yes"
 
     - name: create user
       tags:
         - install
         - upgrade-charm
-      user: name=conn-check group=conn-check createhome=no system=yes
+      user: "name={{ user }} group={{ group }} createhome=no system=yes"
 
     - name: run check
       tags: run-check
-      shell: "sudo -u conn-check {{ bin_path }} {{ args }} {{ config_path }}"
+      shell: "sudo -u {{ user }} {{ bin_path }} {{ args }} {{ config_path }}"
 
     - name: run nagios checks
       tags: run-nagios-check
-      shell: "sudo -u conn-check {{ bin_path }} --exclude-tags=no-nagios {{ args }} {{ config_path }}"
+      shell: "sudo -u {{ user }} {{ bin_path }} --exclude-tags=no-nagios {{ args }} {{ config_path }}"