I want to maintain my debian servers by pushing etc into gitolite.
The problem is that gitolite shouldn't be run as root and neither as a user that can get shell access into the system from the outside. However I need gitolite to interact with etckeeper in hooks and triggers (eg. make sure all pending changes to the working tree are committed and pushed into the bare gitolite repo before any git operations from an outside user take place) for which root access is required.
I'm wondering what would be a safe, simple and elegant way to solve this problem.
Obviously many solutions are possible, but i'm not that adept at linux sys administration, so I seek some inspiration. Possible solutions I have thought about:
have two different users and some messaging system (producer/consumer or a deamon) with gitolite leaving a task to be executed by the root user. (seems very complicated compared to the luxury of a git hook which is a shell script that can execute any commands, especially since I will need to wait for the exit code)
use setuid? Seems made for the task, but reading up on it, it seems dangerous and not very supported for shell scripts...
Can someone point me in the right direction?
Update: I ended up finding some answers to this question myself, so posted an answer below. Any other solutions/considerations more than welcome...