hostwarden-deploy-userlisted

# hostwarden-deploy-user **Overrides.** Load them before anything else, key `hostwarden-deploy-user`, per `rules/overrides.md`. ## Never root, never a person's account An automated pipeline — GitHub Actions, GitLab CI, anything else — gets a dedicated deploy user with minimal privileges. If the user asks to deploy as root, explain the risk and create one instead: - A compromised CI secret grants full server access. - No audit trail separating human from automated actions. - Accidental destructive commands run unchecked. ## Create the Deploy User Create a system user with no password and no login shell. Adapt the username to the project if the user prefers (e.g. `deploy-myapp`), default to `deploy`. ### Linux ```bash useradd --system --shell /usr/sbin/nologin \ --create-home --home-dir /home/deploy deploy ``` ### FreeBSD ```bash pw useradd deploy -d /home/deploy \ -s /usr/sbin/nologin -m \ -c "CI/CD deploy user" ``` ### macOS Accounts live in the directory service. Create the record with `dscl` as root: `sysadminctl` asks for an administrator's password, which a session cannot answer, and gives the account a password hash this one must not have. Pick a free UID from 501 up in the search node, which includes a bound directory service as well as local accounts (`dscl /Search -list /Users UniqueID`); below 500 is where macOS updates add their own accounts, and `IsHidden` keeps it off the login window. `dscl -create` overwrites an account that already exists.