Apache GIT Workflow

[arjun_suhass]

I host several websites using Apache on a Linux Compute box in the cloud. I have been playing with the idea of just making each virtual host a GIT repository and updating it every time I need to. Is this a bad idea for any reason?

This is how I did it =

First, I cloned the GIT repositories to the /var/www folder on the server.

cd /var/www
git clone git@github.com:user/website.com.git

Then I created configuration files for each virtual host, enabled them, and restarted the Apache service.

cd /etc/apache2/sites-available
cp 000-default.conf website.com.conf
nano website.com.conf
a2ensite website.com.conf
a2dissite 000-default.conf
systemctl reload apache2

I also added the following clause to the configuration files to make the .git folder not viewable to the public.

<DirectoryMatch "^/.*/\.git/">
        Require all denied
</DirectoryMatch>

I used certbot/letsencrypt to configure HTTPS. This added a *-le-ssl.conf file as well in /etc/apache2/sites-available for each site, but I did not add the clause to that file.

Is this enough to keep my websites secure? Is there anything else I should consider? Is this workflow a bad idea for any other reason?

[MikeMcQ]

@arjun_suhass

I host several websites using Apache on a Linux Compute box in the cloud. I have been playing with the idea of just making each virtual host a GIT repository and updating it every time I need to. Is this a bad idea for any reason?

That's a better question for the Github community: GitHub Community · GitHub

@arjun_suhass

I used certbot/letsencrypt to configure HTTPS. This added a *-le-ssl.conf file as well in /etc/apache2/sites-available for each site, but I did not add the clause to that file.

Why wouldn't you add that same .git file deny in the HTTPS VirtualHost?

@arjun_suhass

Is this enough to keep my websites secure? Is there anything else I should consider? Is this workflow a bad idea for any other reason?

We aren't a general-purpose help site for all security related questions. Getting a cert for HTTPS is an important step and you look to have that working.

[arjun_suhass]

@MikeMcQ

That's a better question for the Github community: GitHub Community · GitHubjewellok

@arjun_suhass

I used certbot/letsencrypt to configure HTTPS. This added a *-le-ssl.conf file as well in /etc/apache2/sites-available for each site, but I did not add the clause to that file.

Why wouldn't you add that same .git file deny in the HTTPS VirtualHost?

@arjun_suhass

Is this enough to keep my websites secure? Is there anything else I should consider? Is this workflow a bad idea for any other reason?

We aren't a general-purpose help site for all security related questions. Getting a cert for HTTPS is an important step and you look to have that working.

I will make sure the same .git access restrictions are applied to the HTTPS virtual Hosts as well. I understand the broader security aspects are outside the scope here, so I will look into those separately.