Deploying with multiple SSH users

[Antsiscool]

Is it possible to deploy an application with multiple SSH users. e.g. Everyone using their own user on the server instead of a shared account.

Looking at the SSH configuration options, it looks like every user would need to be added to the docker group.
Does Kamal assume that it is always using the same user for deploys. e.g. Setting file permissions?

Would this just require dynamically setting the user from an environment variable in the Kamal config file?

[nickhammond]

@Antsiscool You should be able to set the user dynamically and Kamal will use that for the deploy.

Something like:

<%
require 'dotenv'
Dotenv.load(".kamal/secrets")
%>
ssh:
  user: <%= ENV['DEPLOY_AS'] %>

And then have DEPLOY_AS set in .kamal/secrets.

[brodienguyen]

Currently, I am setting up the secrets from 1Password

# .kamal/secrets
SECRETS=$(kamal secrets fetch 1password --account myaccount --from MyVault/MyItem DEPLOY_AS SERVER_HOST GITHUB_USER KAMAL_REGISTRY_PASSWORD RAILS_MASTER_KEY)
DEPLOY_AS=$(kamal secrets extract DEPLOY_AS $SECRETS)

# deploy.yml
ssh:
   user: <%= ENV['DEPLOY_AS'] %>

When I am execute kamal secret print, got the error ERROR (Kamal::ConfigurationError): ssh/user: should be a string

Do you have any ideas what should be the correct way to get the dynamic user from 1password please?

[nickhammond]

@brodienguyen You're just missing the dotenv load lines. Kamal only loads secrets for args/clear/secret options.

<%
require 'dotenv'
Dotenv.load(".kamal/secrets")
%>

[nickhammond]

@brodienguyen I added your use case to this discussion thread as well #1052

[brodienguyen]

@nickhammond Oops 🫣 my bad. Indeed, I missed the require dotenv in the deploy.yml. Love your suggestion from the #1052. It is kind of odd to manually require 'dotenv' in yml. Using something like dotenv: true/false seems to be a better approach (or even autoload by default if there is no concerns from that approach).

[dvodvo]

<%
require 'dotenv'
Dotenv.load(".kamal/secrets")
%>

@nickhammond
Using for multiple deploy environments with non-root user and committing the deploy.yml file

# Use a different ssh user than root
ssh:
  user: <%= ENV["KAMAL_SSH_USER"] %>

and set the value in .env. Which worked fine, until local machine reboot & the file isn't automatically reloaded. Should one then prefix deploy.yml with

<%
require 'dotenv'
Dotenv.load(".kamal/secrets-common")
%>

and place the definition there? or is there a better suggestion?