Choose a deployment layout

Separate the person who deploys from the process that runs the application. The deploy account can install releases through sudo. A dedicated notes-app account runs the service without an interactive login.

Create the service account and directories:

sudo adduser --system --group --home /var/lib/notes-app notes-app
sudo install -d -m 755 -o deploy -g notes-app /srv/notes-app
sudo install -d -m 755 -o deploy -g notes-app /srv/notes-app/releases
sudo install -d -m 750 -o notes-app -g notes-app /var/lib/notes-app

Use these responsibilities:

/srv/notes-app/releases/   versioned application code
/srv/notes-app/current     symlink to the active release
/var/lib/notes-app/        persistent application data
/etc/notes-app.env         production configuration and secrets

The service needs read and execute access to the active release. It needs write access only to explicit state directories such as /var/lib/notes-app. It should not own Nginx configuration, systemd units, or unrelated system files.

Check the boundary:

id notes-app
namei -l /srv/notes-app/releases
sudo -u notes-app test -w /etc && echo unexpected
sudo -u notes-app test -w /var/lib/notes-app && echo writable

The first write test should print nothing. The second should print writable.

A release directory makes rollback predictable. Deploy code to a new path such as /srv/notes-app/releases/4f92c1a, test it, then point current at it:

sudo -u deploy ln -sfn /srv/notes-app/releases/4f92c1a /srv/notes-app/current
readlink -f /srv/notes-app/current

If a release fails, point the symlink back to the previous directory and restart the service. This rolls back code. It does not undo a database migration, uploaded file change, or secret rotation, which need their own recovery plans.

A common mistake is letting the service write inside its release directory. That mixes disposable code with persistent state and makes rollback unreliable.

Your action is to create the account and directories, run both permission tests, and explain which paths belong in backups.