# Apache GIT Workflow **URL:** \ **Category:** Help\ **Created:** [June 9, 2026, 11:40am UTC](https://community.letsencrypt.org/t/apache-git-workflow/248075 "2026-06-09T11:40:01Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![arjun\_suhass](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@arjun\_suhass](https://community.letsencrypt.org/u/arjun_suhass)\ **Post date:** [June 9, 2026, 11:40am UTC](https://community.letsencrypt.org/t/apache-git-workflow/248075/1 "2026-06-09T11:40:01Z")
I host several websites using Apache on a Linux Compute box in the cloud. I have been playing with the idea of just making each virtual host a GIT repository and updating it every time I need to. Is this a bad idea for any reason? This is how I did it = First, I cloned the GIT repositories to the `/var/www` folder on the server. ```nohighlight cd /var/www git clone git@github.com:user/website.com.git ``` Then I created configuration files for each virtual host, enabled them, and restarted the Apache service. ```nohighlight cd /etc/apache2/sites-available cp 000-default.conf website.com.conf nano website.com.conf a2ensite website.com.conf a2dissite 000-default.conf systemctl reload apache2 ``` I also added the following clause to the configuration files to make the `.git` folder not viewable to the public. ```nohighlight Require all denied ``` I used certbot/letsencrypt to configure HTTPS. This added a `*-le-ssl.conf` file as well in `/etc/apache2/sites-available` for each site, but I did not add the clause to that file. Is this enough to keep my websites secure? Is there anything else I should consider? Is this workflow a bad idea for any other reason? ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [June 9, 2026, 1:32pm UTC](https://community.letsencrypt.org/t/apache-git-workflow/248075/2 "2026-06-09T13:32:24Z")
> [@arjun\_suhass](#): > > I host several websites using Apache on a Linux Compute box in the cloud. I have been playing with the idea of just making each virtual host a GIT repository and updating it every time I need to. Is this a bad idea for any reason? That's a better question for the Github community: [GitHub Community · GitHub](https://github.com/community) > [@arjun\_suhass](#): > > I used certbot/letsencrypt to configure HTTPS. This added a `*-le-ssl.conf` file as well in `/etc/apache2/sites-available` for each site, but I did not add the clause to that file. Why wouldn't you add that same .git file deny in the HTTPS VirtualHost? > [@arjun\_suhass](#): > > Is this enough to keep my websites secure? Is there anything else I should consider? Is this workflow a bad idea for any other reason? We aren't a general-purpose help site for all security related questions. Getting a cert for HTTPS is an important step and you look to have that working. ---
**Author:** ![arjun\_suhass](https://avatars.discourse-cdn.com/v4/letter/a/a587f6/32.png) [@arjun\_suhass](https://community.letsencrypt.org/u/arjun_suhass)\ **Post date:** [June 23, 2026, 2:03pm UTC](https://community.letsencrypt.org/t/apache-git-workflow/248075/3 "2026-06-23T14:03:59Z")
> [@MikeMcQ](#): > > That's a better question for the Github community: [GitHub Community · GitHub](https://github.com/community)[jewellok](https://www.jewellok.com/) > > > [@arjun\_suhass](#): > > > > I used certbot/letsencrypt to configure HTTPS. This added a `*-le-ssl.conf` file as well in `/etc/apache2/sites-available` for each site, but I did not add the clause to that file. > > Why wouldn't you add that same .git file deny in the HTTPS VirtualHost? > > > [@arjun\_suhass](#): > > > > Is this enough to keep my websites secure? Is there anything else I should consider? Is this workflow a bad idea for any other reason? > > We aren't a general-purpose help site for all security related questions. Getting a cert for HTTPS is an important step and you look to have that working. I will make sure the same .git access restrictions are applied to the HTTPS virtual Hosts as well. I understand the broader security aspects are outside the scope here, so I will look into those separately. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [July 23, 2026, 2:04pm UTC](https://community.letsencrypt.org/t/apache-git-workflow/248075/4 "2026-07-23T14:04:22Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.