Ruby-on-rails – Setting the Ruby on Rails application environment using Capistrano on Phusion Passenger

Here's my deploy.rb, which hasn't really been updated in a long time. I run two sed commands to set the environment inside my :after_update_code task. I'm certain there's an easier way to do it, but this is my current method.

require 'erb'

before "deploy:setup", :db
after "deploy:update_code", "db:symlink" 
after "deploy", "deploy:cleanup"

def prompt_with_default(var, default)
  set(var) do
    Capistrano::CLI.ui.ask "Enter #{var} [#{default}] : "
  end

  set var, default if eval("#{var.to_s}.empty?")
end

default_run_options[:pty] = true 

set :rake, "/usr/local/bin/rake"

set :user, "your username"
set :application, "application name"
set :repository,  "svn repository path"
set :host, "domain name"
set :db_host, "DB host name"
set :db_user, "DB user name"
set :db_prefix, "any DB name prefix your host might require"
set :rails_env, "production"

set :deploy_to, "/home/username/rails/#{host}" # your deployment directory

role :app, host
role :web, host
role :db,  host, :primary => true

set :use_sudo, false
set :checkout, "export"

#
# TASKS
#
desc "Tasks to execute after code update"
task :after_update_code, :roles => [:app, :db, :web] do
  # Make sure we're running in production
  run "sed -i -e '/ENV.*RAILS_ENV/s/# //' #{release_path}/config/environment.rb"
  run "sed -i -e '/ENV.*RAILS_ENV/s/production/#{rails_env}/' #{release_path}/config/environment.rb"

  # Add banned IPs
  deny_lines = []
  File.readlines("#{release_path}/config/banned_ips").each {|ip|
    deny_lines << "deny from #{ip}"
  }

  ip_ban_block = <<EOBAN
# Bannination
order allow,deny
#{deny_lines.join}
allow from all
EOBAN

  run "sed -i -e 's/# BANNED IPS/#{ip_ban_block}/' #{release_path}/public/.htaccess"

  run "chmod +x #{release_path}/script/runner" 
  run "chmod +x #{release_path}/script/process/reaper" 
  run "chmod +x #{release_path}/script/process/spawner" 
  run "chmod 755 #{release_path}/public/dispatch.*" 
end

desc "Restarting after deployment"
task :after_deploy, :roles => [:app, :db, :web] do
  run "cd #{current_path} && rake RAILS_ENV=production db:sessions:clear tmp:clear"
  # fix permissions
  run "dos2unix #{release_path}/public/dispatch.*"
  run "dos2unix #{release_path}/public/.htaccess"
  run "chmod -R 755 #{release_path}"
  run "chmod -R 775 #{release_path}/log #{release_path}/tmp #{release_path}/script"
  run "find #{release_path}/ | xargs touch"
  run "touch #{deploy_to}/current/public/dispatch.fcgi"
end

desc "Restarting after rollback"
task :after_rollback, :roles => [:app, :db, :web] do
  run "touch #{deploy_to}/current/public/dispatch.fcgi"
end

namespace :db do
  desc "Create database yaml in shared path" 
  task :default do
  prompt_with_default(:db_password, "")
  db_config = ERB.new <<-EOF
base: &base
  adapter: mysql
  port: 3306
  host: #{db_host}
  username: #{db_user}
  password: #{db_password}

development:
  database: #{db_prefix}#{application}development
  <<: *base

test:
  database: #{db_prefix}#{application}test
  <<: *base

production:
  database: #{db_prefix}#{application}production
  <<: *base
EOF

    run "mkdir -p #{shared_path}/config" 
    put db_config.result, "#{shared_path}/config/database.yml" 
  end

  desc "Make symlink for database yaml" 
  task :symlink do
    run "ln -nfs #{shared_path}/config/database.yml #{release_path}/config/database.yml" 
  end
end

Once I set up my variables, I have a bash script that runs:

svn export $svn_path . --force
cap deploy

That'll ask me for my password twice. Once for exporting from SVN, and once as a prompt to automatically generate my database.yml in the shared path.

Question has been inactive for quite a while with no responses.

Quoting Jscotts' comment from above as the answer since he did not respond to do so:

Your standard clone should only contain the OS and apps common for all machines (MS Office, Java, Flash, etc.) department specific apps can be deployed via Group Policy, scripting or the like. "Cleaning" workstations can be a losing battle.

Attempting to post-clean users' PC is nigh on impossible at worst, and at best a never ending headache. Replacing the entire OS and going with proper installed applications and user security is the best course of action.