I have created a webhook on github that calls my webserver for updating files in the web root. I have secured the sending part by using a token on github so only requests from github can execute the script. My question is since the script will run as the webserver(www-data) what is the best way to give it write permissions to the webroot. Is giving the webserver user write permissions on the webroot a good idea? What are the alternatives?
First write a script that performs the exact deployment steps needed. Then give
www-data the rights to run that specific script via sudo. For example, using the following sudoers rule:
www-data ALL=(someuser) /path/to/deploy.sh
(Replace "someuser" with the account which actually owns the webapp's files.)
The webhook handler would then execute:
sudo -u someuser /path/to/deploy.sh
This way, your webserver can perform updates exactly as scripted but still doesn't have unnecessary access to delete files or install malware to the site.