From 2b1911f17b0ed5ee5ad2384e176b84b84243802f Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 3 Sep 2015 23:24:43 -0700
Subject: make couchdb.admin.yml only readable by root, make non-admin cron run
 as webapp user.

---
 puppet/modules/site_webapp/manifests/cron.pp | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'puppet/modules/site_webapp/manifests/cron.pp')

diff --git a/puppet/modules/site_webapp/manifests/cron.pp b/puppet/modules/site_webapp/manifests/cron.pp
index d26ee312..7147a0d2 100644
--- a/puppet/modules/site_webapp/manifests/cron.pp
+++ b/puppet/modules/site_webapp/manifests/cron.pp
@@ -5,12 +5,14 @@ class site_webapp::cron {
     'rotate_databases':
       command     => 'cd /srv/leap/webapp && bundle exec rake db:rotate',
       environment => 'RAILS_ENV=production',
+      user        => 'root',
       hour        => [0,6,12,18],
       minute      => 0;
 
     'delete_tmp_databases':
       command     => 'cd /srv/leap/webapp && bundle exec rake db:deletetmp',
       environment => 'RAILS_ENV=production',
+      user        => 'root',
       hour        => 1,
       minute      => 1;
 
@@ -19,6 +21,7 @@ class site_webapp::cron {
     'remove_expired_sessions':
       command     => 'cd /srv/leap/webapp && bundle exec rake cleanup:sessions',
       environment => 'RAILS_ENV=production',
+      user        => 'leap-webapp',
       hour        => 2,
       minute      => 30,
       ensure      => absent;
@@ -26,6 +29,7 @@ class site_webapp::cron {
     'remove_expired_tokens':
       command     => 'cd /srv/leap/webapp && bundle exec rake cleanup:tokens',
       environment => 'RAILS_ENV=production',
+      user        => 'leap-webapp',
       hour        => 3,
       minute      => 0;
   }
-- 
cgit v1.2.3