Git-based website deployment workflow

Question

On my server, I have two users, www-data (which is used by nginx) and git. The git user owns a repository that contains my website's code, and the www-data user owns a clone of that repository (which serves as the webroot for nginx). I want to set up a workflow such that pushing to git's repository causes www-data's repository to update, thus updating my website.

What is the correct way to set up the hooks for these repositories (that also takes into consideration privileges and permissions of these two users)?

Is it really a good idea to have all your public content owned by the user account that runs the server? If the server or your code is exploited, the exploit could modify persistent data, rather than just have access to scribble on your database connections... — sarnold
– sarnold, Commented Mar 26, 2011 at 1:06
Then should I make the public content owned by git, and make it readable by everyone? That would also simplify the permission issues in this question... — Chetan
– Chetan, Commented Mar 26, 2011 at 1:11
If you're content with it as a solution, then yes, it would save you the hassle of finding a new way to push from git to www-data repos. :) Do you prefer having two git repos on the server? Another option is to set the group ownership of the files to be one of the server's groups, and allow read access through group privileges. — sarnold
– sarnold, Commented Mar 26, 2011 at 1:18

Arrowmaster · Accepted Answer · 2011-03-26 02:35:05Z

5

Remove the repository owned by www-data and follow the solution on this webpage for setting up a post-receive hook in the repository owned by git.

answered Mar 26, 2011 at 2:35

Arrowmaster

9,3012 gold badges30 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Chetan · Accepted Answer · 2011-03-26 02:42:09Z

2

I ended up making the public content owned by the git user, and readable by all. Then, I did the following to set up the hooks:

Assuming the repository is called mysite:

Create a detached work tree that will act as the webroot (as the user git)

mkdir /var/www/mysite
cd /path/to/repository/mysite.git
git config core.worktree /var/www/mysite
git config core.bare false
git config receive.denycurrentbranch ignore

Add a post-receive hook that will update the website and set correct permissions for it

touch hooks/post-receive
chmod +x hooks/post-receive
vim hooks/post-receive

The post-receive script:

#!/bin/sh
git checkout -f
chmod -R o+rX /var/www/mysite

Reference:
http://www.deanoj.co.uk/programming/git/using-git-and-a-post-receive-hook-script-for-auto-deployment/

Update: Here is a better solution.

Note: earlier versions of this howto depended on setting the git config variables core.worktree to the target directory, core.bare to false, and receive.denycurrentbranch to ignore. But these changes are not needed if you use GIT_WORK_TREE (which didn't work when I first wrote the howto), and the remote repository can remain bare.

edited Mar 26, 2011 at 2:42

answered Mar 26, 2011 at 2:33

Chetan

48.4k32 gold badges110 silver badges146 bronze badges

2 Comments

Arrowmaster Over a year ago

Ack why do people keep finding all of these nasty solutions people blog about instead of the proper ones.

Chetan Over a year ago

@Arrowmaster: Thanks, simpler is always better.

Collectives™ on Stack Overflow

Git-based website deployment workflow

2 Answers 2

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related