We have a development model where every developer is responsible for deploying the program he/she is responsible for.
What we want to achieve is the following:
- for all developers to be able to deploy their applications to our production environment.
- have a good level of security
- have accountability on who did what.
- keep track of which application use what resources.
Currently we have written all our deployment scripts in fabric.
We have setup one account for each application. SSH-keys for that account are handed out to the developers responsible for deploying that application. This account is also used for running the application.
This achieves point 1, 4 and somewhat 2, but not 3. It also has the disadvantage that the server environment must be prepared since we don't want to provide root access to the application accounts (dependencies be installed by someone who is root, directories created).
How should we set up our deployment strategy in order to solve the above points, and have we missed some important goal for the strategy?