title: nginx: run bash script on POST as specific user
body: <p>I have a nginx and git servers on one CentOS host, my git repo on bitbucket. What I wanna do is to execute a bash script, when specific POST request is received from Bitbucket.</p>
  
  <p>What I have:</p>
  
  <p><strong>1)</strong> dedicated user <code>nginx-script-runner</code>.</p>
  
  <p><strong>2)</strong> nginx config:</p>
  
  <pre><code>location / {
      rewrite ^(.*)$ /main.php?$1;
  }
  </code></pre>
  
  <p><strong>3)</strong> main.php:</p>
  
  <pre><code>exec('/bin/bash /script.sh')
  </code></pre>
  
  <p><strong>4)</strong> /script.sh:</p>
  
  <pre><code>sudo -u nginx-script-runner /bin/bash /pull.sh
  </code></pre>
  
  <p><strong>5)</strong> sudoers:</p>
  
  <pre><code>nginx-script-runner ALL=NOPASSWD: /pull.sh
  </code></pre>
  
  <p><code>pull.sh</code> automatically pulls from the remote origin and runs the 'build' procedure. Build procedure depends on <code>npm</code>, <code>bower</code>, <code>composer</code>, <code>grunt</code> etc (I also use <code>nvm</code> for the node version management). Those tools are meant to be run when there's real user logged in. The thing is — I login to CentOS via PKA only, no passwords, so my <code>pull.sh</code> falls under requirement to be able to run it as multiple users (me and <code>nginx-script-user</code>). And since it's a git repo, it has <code>node_modules</code>, <code>bower_components</code>, composer's <code>vendor</code> folder I should somehow manage privileges.</p>
  
  <p><strong>1st problem</strong>: I cannot really run <code>pull.sh</code> with different users. Even when I have:</p>
  
  <pre><code>DIR='/repo.git'
  #chgrp -R tactic "$DIR"
  #chmod -R g+w "$DIR"
  #find "$DIR" -type d -exec chmod g+s {} \;
  setfacl -R -m g:common-group:rwX "$DIR"
  find "$DIR" -type d | xargs setfacl -R -m d:g:common-group:rwX
  </code></pre>
  
  <p>I still end up having loads of "chgrp/chown permission denied" error.</p>
  
  <p><strong>2nd problem</strong>: I cannot really execute <code>pull.sh</code> with either of users from <code>main.php</code>.</p>
  
  <p>Any help would be much appreciated.</p>
  
  <p><strong>P.S.</strong></p>
  
  <ul>
  <li>Both my personal user (with PKA) and <code>nginx-script-runner</code> (password auth only, no external SSH access) belong to common group <code>common-group</code>.</li>
  <li>After the git repo was cloned, I've configure it with <code>git config core.sharedRepository true</code>  and ran the privileges fix.</li>
  </ul>