4 ms·

I don't like the advice he gives on just denying access to .git. I think the idea of cloning the repo in the htdocs folder is just wrong. A much better approac

by Hamcha 9y ago

I don't like the advice he gives on just denying access to .git. I think the idea of cloning the repo in the htdocs folder is just wrong. A much better approach (or at least, what I use) would be to set up the repo somewhere private with --bare and set a receive hook to checkout HEAD to the htdocs folder, this way the htdocs only has the content and you get the extra feature that you can sneak extra commands on the checked out source (such as building/minifying) without changing the original source

bananaboy 9y ago
Yeah this sounds like a much better idea. You could also do a shallow clone (for performance and so you don't have the full history there).
ljoshua 9y ago
This sounds like an awesome approach. Do you have any resources you could share on a few of the details? Using --bare I get, but I've not yet played with hooks and such.
- jdwithit 9y ago
  Git hooks are just arbitrary scripts. They need to exist in a specific location, and accept certain arguments depending on when in the lifecycle they are meant to execute. But they can be written to do basically anything. From linting and syntax checking, to complex deploy behaviors. http://githooks.com/ http://githooks.com/
glandium 9y ago
It's actually kind of mentioned at the end of the article: > Another approach is to use git’s --git-dir and --work-tree switches to move the git repository out of the document root. Yet another option is to make the htdocs directory a worktree of the git repository, which doesn't require passing flags around, or setting environment variables. Technically, this still leaves a .git, but it's only a file containing the actual location to the real .git directory. https://git-scm.com/docs/git-worktree https://git-scm.com/docs/git-worktree
- paraknight 9y ago
  Or have a `www` directory and symlink it.
throwji32134 9y ago
Or you could just set permissions to 700.
shanavasm 9y ago
I would use a build script to copy only required files to htdocs directory

by Hamcha 9y ago

bananaboy 9y ago

Yeah this sounds like a much better idea. You could also do a shallow clone (for performance and so you don't have the full history there).

ljoshua 9y ago

This sounds like an awesome approach. Do you have any resources you could share on a few of the details? Using --bare I get, but I've not yet played with hooks and such.

jdwithit 9y ago
Git hooks are just arbitrary scripts. They need to exist in a specific location, and accept certain arguments depending on when in the lifecycle they are meant to execute. But they can be written to do basically anything. From linting and syntax checking, to complex deploy behaviors. http://githooks.com/ http://githooks.com/

glandium 9y ago

It's actually kind of mentioned at the end of the article: > Another approach is to use git’s --git-dir and --work-tree switches to move the git repository out of the document root. Yet another option is to make the htdocs directory a worktree of the git repository, which doesn't require passing flags around, or setting environment variables. Technically, this still leaves a .git, but it's only a file containing the actual location to the real .git directory. https://git-scm.com/docs/git-worktree https://git-scm.com/docs/git-worktree

paraknight 9y ago
Or have a `www` directory and symlink it.

throwji32134 9y ago

Or you could just set permissions to 700.

shanavasm 9y ago

I would use a build script to copy only required files to htdocs directory