I couldn't really summarize what @faidon and @ori said (about /var/lib vs /home), so would be great if either of them could comment.

I personally do not care as long as it's consistent between prod and beta (beta uses a shared /home, which doesn't actually cause any issues here in practice except being eugh)

In the coming world of systemd, it seems to be an implicit assumption for security that homedirs are for human users only, which could include cron/daemon -like things of today which become systemd units tomorrow. cf. http://0pointer.de/public/systemd-man/systemd.exec.html#ProtectHome= . The idea behind that is that most systemd units can have ProtectHome=full and not leak random human users' data if they're compromised (assuming other sufficient privdrop).

My comment was/is that I have a slight preference against non-human users having a home directory under /home. I called those "system" users and mwdeploy does have system => true (and I think rightfully), but @ori mentioned briefly that he doesn't consider mwdeploy a system user (correct me if I'm wrong). I'd prefer e.g. /var/lib/mwdeploy for this.

This has nothing to do with beta or Labs or NFS/LDAP in my mind; just a good practice.

Note that the reason mwdeploy switched to /home/mwdeploy was for provisioning an SSH key for keyholder, i.e. for creating ~/.ssh/authorized_keys. First of all, there's nothing stopping us from using /var/lib/mwdeploy/.ssh (SSH's config is %h/.ssh, not /home/%u/.ssh). Second, topic:ssh-userkey (still unmerged) ditches ~/.ssh entirely for authorized_keys, as these shouldn't be under user-control directories in our setup.

In T86971#981861, @faidon wrote:

slight preference against non-human users having a home directory under /home.>
I'd prefer e.g. /var/lib/mwdeploy for this.

^ this. +1

looping in Scap since it also belongs there

I see zero reason we can't move the homedir to /var/lib.

Change 323867 had a related patch set uploaded (by Chad):
Move mwdeploy home to /var/lib where it belongs, it's a system user

https://gerrit.wikimedia.org/r/323867

Change 323867 merged by Filippo Giunchedi:
[operations/puppet@production] Move mwdeploy home to /var/lib where it belongs, it's a system user

https://gerrit.wikimedia.org/r/323867