Allow to run services with custom user

[scollazo]

In some envs, archivematica needs to run with an user different than
"archivematica"

This pr adds two configuration default to allow so:

• archivematica_src_am_system_user
• archivematica_src_am_system_group
• archivematica_src_ss_system_user
• archivematica_src_ss_system_group

Connects to #307

[mamedin]

Hi @scollazo , thanks for the PR :)

I have some questions/requests:

1) Do we need to create the users and groups here?:

https://github.com/artefactual-labs/ansible-archivematica-src/blob/qa/1.x/tasks/common.yml#L7-L17

2) Does it make sense to create new variables for home directories, gids and uids? Probably the home directories could be something like:

"/var/lib/{{ archivematica_src_am_system_user }}"
"/var/lib/{{ archivematica_src_ss_system_user }}"

In this case, the am directory should be created here:

https://github.com/artefactual-labs/ansible-archivematica-src/blob/qa/1.x/tasks/pipeline-osconf.yml#L16

And the SS home directory needs to be created in a separate task.

3) The AtoM user tasks in the am-configure section needs a review:

https://github.com/artefactual-labs/ansible-archivematica-src/blob/qa/1.x/tasks/configure.yml#L171-L226

4) After the qa/1.x rebase, these lines needs a change:

tasks/pipeline-environment.yml:    owner: "archivematica"
tasks/configure.yml:    owner: "archivematica"

tasks/pipeline-environment.yml:    group: "archivematica"
tasks/configure.yml:    group: "archivematica"

tasks/configure-gpg.yml:      become_user: "archivematica"
tasks/configure-gpg.yml:      become_user: "archivematica"

[scollazo]

Hi @scollazo , thanks for the PR :)

I have some questions/requests:

1) Do we need to create the users and groups here?:

https://github.com/artefactual-labs/ansible-archivematica-src/blob/qa/1.x/tasks/common.yml#L7-L17

I avoided creating them on purpose, as they might be already created using active directory or other means.

2) Does it make sense to create new variables for home directories, gids and uids? Probably the home directories could be something like:

"/var/lib/{{ archivematica_src_am_system_user }}"
"/var/lib/{{ archivematica_src_ss_system_user }}"

In this case, the am directory should be created here:

https://github.com/artefactual-labs/ansible-archivematica-src/blob/qa/1.x/tasks/pipeline-osconf.yml#L16

And the SS home directory needs to be created in a separate task.

Besides changing the effective UID/GID for the Archivematica processess, I didn't want to mess too much with the current setttings. In my current use case, the user was created with /var/lib/archivematica as home directory, so there wasn't a need to do this. Do you think it would help in other cases?

3) The AtoM user tasks in the am-configure section needs a review:

https://github.com/artefactual-labs/ansible-archivematica-src/blob/qa/1.x/tasks/configure.yml#L171-L226

Could you be more specific?

4) After the qa/1.x rebase, these lines needs a change:

tasks/pipeline-environment.yml:    owner: "archivematica"
tasks/configure.yml:    owner: "archivematica"

tasks/pipeline-environment.yml:    group: "archivematica"
tasks/configure.yml:    group: "archivematica"

tasks/configure-gpg.yml:      become_user: "archivematica"
tasks/configure-gpg.yml:      become_user: "archivematica"

I'll fix those conflicts

/santi

[scollazo]

@mamedin ping