How to run as sudo without being prompted for sudo pass?

[devjk1]

I have some working code that I need to run as sudo, but would like to skip the password prompt that comes with running these tasks. How can I skip the password prompt?

task('cms:supervisor:horizon:config', function () {
    cd('{{release_or_current_path}}');
    if (test('[ -e horizon.conf ] && [ ! -e /etc/supervisor/conf.d/horizon.conf ]')) {
        run('sudo cp horizon.conf /etc/supervisor/conf.d/horizon.conf');
    }
});
task('cms:supervisor:horizon:start', function () {
    cd('{{release_or_current_path}}');
    if (test('[ -e /etc/supervisor/conf.d/horizon.conf ]')) {
        run('sudo supervisorctl reread');
        run('sudo supervisorctl update');
        run('sudo supervisorctl start horizon');
    }
});

Even though the command runs most of the time, sometimes if I wait too long I get this error.

run cd ~/deployer/releases/1 && ( SUDO_ASKPASS=~/deployer/.dep/sudo_pass PASSWORD=%sudo_pass% sudo -A cp horizon.conf /etc/supervisor/conf.d/horizon.conf)
Sorry, try again.
Sorry, try again.
sudo: 3 incorrect password attempts

If I add set('remote_user', get('provision_user')); to the tasks, I get this error.

err bash: line 1: cd: /root/deployer/current: No such file or directory

Any help is appreciated and thank you for your time.

[ideacatlab]

The prompt you're hitting is real sudo, not Deployer — you can see it in the output, Deployer is already going through sudo -A with an askpass helper, and the "3 incorrect password attempts" is that helper handing over an empty or stale password.

For unattended deploys the usual answer is to stop sending a password at all and give the deploy user a narrow NOPASSWD rule instead. On the server:

# /etc/sudoers.d/deployer   (edit with: visudo -f /etc/sudoers.d/deployer)
deployer ALL=(root) NOPASSWD: /usr/bin/supervisorctl, /bin/cp

chmod 0440 /etc/sudoers.d/deployer
visudo -c          # check you haven't locked yourself out before logging off

Keep the command list explicit rather than NOPASSWD: ALL — these two are all your tasks need, and it means a compromised deploy key can't become root.

Two things that will bite you afterwards:

• Paths must match what actually runs. which supervisorctl and which cp on that box; on Debian/Ubuntu cp is usually /bin/cp, on RHEL-family it's often /usr/bin/cp. A mismatch silently falls through to the password prompt again.
• sudo cp horizon.conf ... with a relative path depends on the cd() having taken effect. It's worth making it absolute so the rule and the command can't drift apart:

run('sudo cp {{release_or_current_path}}/horizon.conf /etc/supervisor/conf.d/horizon.conf');

Once the sudoers rule is in, you can drop set('remote_user', get('provision_user')) again and deploy as the normal user.