I have an Amazon EC2 instance with a bare git repository containing my app. I've setup a post-receive hook that does a git checkout -f
into my www. To push to this repo I've setup a remote in my local repository so I can run git push dev
and everything seems to work.
The problem is that this code also exists as is on GitHub. This is a bit redundant and lacks the ability to see commit history and updates for activity going into the dev (or soon to be live) environments. Also if my EC2 setup grew into a cluster, I don't think it would be possible to run git push dev
and push to multiple repos in the cluster.
GitHub has several https post hooks that can tell my server that someone has committed. My question is, what is the best way to do this while not compromising security, or dependency on the application I am pushing to. For example if the application is unavailable, I still want to be able to deploy.
If the url is impossible to guess, say https://myserver.com/SOME_RANDOM_TOKEN
, is that enough to prevent anything malicious? I would like to avoid having to implement auth for this post-recieve URL.
How should configurations be setup since there won't be an easy way to push something to the server separately from the repository? What should the branches look like?
Any answers or suggestions on these would be very helpful. Thanks in advance.