Run sails.js with least privileges in Production

Question

I'm using Sails.js 0.10.5 on Node 0.10.33 on Ubuntu Trusty. I'd like to execute the node process as a non-root user with the least possible privileges in the production environment. I'm comfortable with the various options for binding to ports below 1024 but I'm more concerned with directory permissions.

Ideally, I'd prefer the node process only have write access to its log files and nothing else. It should only have read access to the directory containing app.js and below.

At the moment I have needed to grant write access to the ./.tmp directory and also to the ./views directory due to the grunt tasks that run at startup. I'd rather perform the grunt tasks at deploy time as a different user instead of at run-time. The sails www command appeared promising but I couldn't get the desired outcome.

Can someone please point me in the right direction for running Sails.js with zero write access to its assets, views, etc?

Answer 1

Use sails www to build static assets

chmod -R 440 all files and directories, so that your user and the webserver (group) can access the files.

Use nginx/apache to host a webserver on port 80/443 and proxy requests to sails (running on its own port or over a unix socket).

Run sails using PM2 to keep it running and have it manage/collect logs.

Sails will lift, but will be unable to write its .tmp directory, which shouldn't even be necessary since all your static files will be routed to the www directory through nginx/apache.

Answer 2

The simplest solution to me seems to be to separate the grunt tasks that need the elevated privileges out into a separate file that you can call with a different user on deploy. Then sails won't need to run anything and can be read only.