This will get you up and running but just be aware that some of the items may not be the "correct way" of doing it.
I don't think so. Removing the templates directory gives you an exception. Maybe you are using another loader?
>>Also running nearly everything as root.
Right, this was meant for starters so I didn't want to complicate things. But I just added some options so now Upstart will run GUnicorn under other user.
As for SSL certs, don't you store those on the load balancer? If you are running a single box and it goes down, pointing the LB at a new backend box is a lot easier than copying certs around.
As for SSH keys, I'm not quite sure what damage could be done there. The only thing on there is public keys, right?
As I said below, this is a big reason why I believe in PaaS if your application can deal with it (and most can). Sysadmin has become so commoditized that there is no point in wasting your own time/money dealing with this stuff.
Not really. It seems everything runs from a virtual environment under the Ubuntu user which is not root btw.