How to ensure TeamCity deployment through Web Deploy?

Question

My team uses TeamCity for continuous integration. He will create, test, and deploy web applications through Web Deploy for dev and qa web servers. The tricky part is deployed on the production web server - our policy dictates that developers cannot deploy to production, only a system administrator can.

Our current approach is for TeamCity to create a web deployment package that the administrator can download and install on the production web server. However, we would like to allow them to simply click Run in the build configuration, but we are not sure how to protect this button.

We could create a TeamCity project that only administrators have access to, but we must also access Web Deploy security. The web deployment service must be authenticated using the local administrator account on the production server. We do not want developers to have access to the username / password in the assembly script, and we do not want each assembly agent to work as this account, since developers could create an assembly that uses it for deployment to production.

I was not lucky to find resources in TeamCity’s best practices for security / deployment, but I can’t imagine that we are the only company in this situation. How do others manage deployment deployment security?

Answer 1

First of all, automatic deployment to a real server is not a good idea. Deployments must be automated prior to the stage. If you still want to do this, ez, a short and safe way is to use an Ant script. Write a short script to use SSH or sftp, and the deployment is complete. You can create two profiles for your project and add an additional step to the "Build Steps" for the deployment of Pro by the administrator.