I am using the Consul Template project, which is a process that is responsible for rendering multiple template files into various locations on disk. This poses a challenge of how best to manage the permissions and ownership of the destination files without running the Consul template process as root.
For example, consul-template needs to render the contents of a template string and write it to locations such as /etc/default/. It does have the option of executing a command after rendering a template, so I can write to /tmp and then execute a sudo mv, but what would be a sane setting in the sudoers file to allow that?
I am building the servers with configuration management and know all of the destination files at build time, so I can change ownership of the destinations at that point, but the process also creates temporary files during rendering that are located in the destination directories which complicates things a bit.
If anyone has dealt with a similar situation of needing to grant broad write permissions to a non-root process and has a solution that they're happy with I'd appreciate some feedback. Thank you in advance for the help.
