The developer/deployer/admin permission table, and why shared/.env is locked tighter than the rest of the app tree.
argus-tty has three account tiers; bosun enforces which of its own subcommands each one can run (require_role() in deployment/lib/common, checked against the caller's active session groups):
| Command | developer | deployer | admin |
|---|---|---|---|
add (provision an app) |
— | — | root only |
bootstrap (RVM, one time) |
— | — | root only |
install / setup |
✓ | — | ✓ |
run (console/rake) / logs |
✓ | — | ✓ |
deploy / cleanup |
— | ✓ | ✓ |
systemctl start/stop/restart (via sudo) |
✓ | ✓ | ✓ |
version (bosun/RVM/app version info) |
✓ | ✓ | ✓ |
mode (view) |
✓ | ✓ | ✓ |
mode <name> (set) |
— | — | root only |
A plain developer can't deploy; a plain deployer can't open a console, run rake, install deps, or tail logs. version and mode (viewing it) are the two exceptions with no require_role() gate at all — neither exposes anything sensitive (bosun's own version, RVM's version, an app's deploy.conf ruby/gemset; the configured/effective mode), so every tier can run them freely. Setting a mode (sudo bosun mode <name>) writes to /etc/bosun.conf, so that part is root-only regardless of tier. This whole table only applies when argus-tty is actually installed — in standalone mode require_role() always passes, since there's only one account to enforce tiers against in the first place. Sudoers only covers the root-requiring parts (systemctl, apt-get, docker) — the actual file access (clone/bundle install/symlink/console) is plain Unix permissions under the webapps group, which is why bosun's own require_role() check exists: without it, anyone in webapps could run any subcommand regardless of their argus-tty tier.
shared/.env (app secrets) is a stricter boundary still: it's readable by root and, via a single named-user ACL grant, the webapp-svc service account only — not the webapps group, so developer and deployer accounts can't read or edit it directly even though they're both webapps members. Admin edits it with sudo vi shared/.env (full sudo already covers this, no extra grant needed). A developer still gets a working bosun run console myapp with real secrets loaded: run elevates to webapp-svc via a narrowly-scoped sudoers grant (sudo -u webapp-svc, exact path only) instead of reading the file as themselves.