Allow deployer to exec supervisorctl only
deployer
deployer ALL=(ALL) !ALL deployer ALL=NOPASSWD: /usr/bin/supervisorctl