Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How Git servers work, and how to keep yours secure

gemini.nytpu.com

Post reply on HN
Print view View original

11–20 of 51 posts

Re: How Git servers work, and how to keep yours secure

#11

Post by ghostbrainalpha »

neilv wrote: post #10

Is there a rock-solid git server that I can use on a home server for versioned immutable backups of misc. files on personal devices (e.g., account config), as well as private software development git repos? (I've done a cheaper version of this -- except for the immutable part, and the separation of accounts between devices -- in the past using SSH+SVN to a home server, and it was great.) I was thinking immutable from…

Is there any reason your example would ever happen? That seems a little far fetched of a security concern to me.

Re: How Git servers work, and how to keep yours secure

#12

Post by nucleardog »

neilv wrote: post #10

Is there a rock-solid git server that I can use on a home server for versioned immutable backups of misc. files on personal devices (e.g., account config), as well as private software development git repos? (I've done a cheaper version of this -- except for the immutable part, and the separation of accounts between devices -- in the past using SSH+SVN to a home server, and it was great.) I was thinking immutable from…

gitea is super easy to set up and self-host. It has branch permissions. Relatively straightforward to, e.g., allow devices to push only to their own branch but not allow force pushes that overwrite old commits.

Re: How Git servers work, and how to keep yours secure

#14

Post by LanternLight83 »

neilv wrote: post #10

Is there a rock-solid git server that I can use on a home server for versioned immutable backups of misc. files on personal devices (e.g., account config), as well as private software development git repos? (I've done a cheaper version of this -- except for the immutable part, and the separation of accounts between devices -- in the past using SSH+SVN to a home server, and it was great.) I was thinking immutable from…

I was going to say, I've got my got server on my NAS, which is itself on a ZFS filesystem, through which snapshots provide immutable backups;

But considering the case of a malicious got contributer, access to any of my devices and ssh keys is already a wayyy bigger issue to begin with, and likely entails restoring the rest of the system to a known-secure state due the sheer number of files an intruder could have tampered with outside of version-controlled directories.

Re: How Git servers work, and how to keep yours secure

#15

Post by cogman10 »

neilv wrote: post #10

Is there a rock-solid git server that I can use on a home server for versioned immutable backups of misc. files on personal devices (e.g., account config), as well as private software development git repos? (I've done a cheaper version of this -- except for the immutable part, and the separation of accounts between devices -- in the past using SSH+SVN to a home server, and it was great.) I was thinking immutable from…

Depends on what you are after, but why not GIT + SSH and run regular snapshots of the repo? That way a dodgy person doing bad things could ultimately be undone relatively quickly.

Any sort of backup of the git repo would also achieve the same thing.

If you are super paranoid, you could also do git over email ala the linux kernel on sensitive repos and only apply trusted patches yourself.

Re: How Git servers work, and how to keep yours secure

#16

Post by rsync »

neilv wrote: post #10

Is there a rock-solid git server that I can use on a home server for versioned immutable backups of misc. files on personal devices (e.g., account config), as well as private software development git repos? (I've done a cheaper version of this -- except for the immutable part, and the separation of accounts between devices -- in the past using SSH+SVN to a home server, and it was great.) I was thinking immutable from…

"Is there a rock-solid git server that I can use on a home server for versioned immutable backups ..."

A few things ...

First, 'git' is built into the rsync.net platform and you can do anything you like with it, remotely, over ssh:

  ssh user@rsync.net "git clone git://github.com/freebsd/freebsd.git freebsd"
I personally track a number of repos I consider important and keep my own source trees up to date without running git locally.

Second, the ZFS snapshots that are taken, nightly, of your entire rsync.net account are immutable (read-only) so if you clone/update your git repos into your account, they are protected from ransomeware/mallory.

Third, we finally have LFS / git-lfs support which pleases me greatly.

Re: How Git servers work, and how to keep yours secure

#17

Post by Sebb767 »

gnabgib wrote: post #13
1337shadow wrote: post #8

Earlier quoted context omitted.

What CI runner ?

Not OP, but we use Drone[ https://www.drone.io/ ] with Gitea[ https://gitea.io/en-us/ ]

We actually use drone, too! It has its quirks (for example, it would be nice to be able to start jobs via the web interface), but it works well for us.

Re: How Git servers work, and how to keep yours secure

#18

Post by elevation »

I like self hosting git but these tutorials set you up with only a one-machine solution. I'd like to be able to self-host a git service that's robust in the face of network/hardware/OS maintenance.

I know git is distributed by design. So if I want to push code to a pair of servers for better availability, I can do it explicitly:

  git push  
  git push
But what if I wanted to make this transparent but still highly available, such that the remote URL in

  git push
is actually backed by a HA cluster?

Some of the software and ops to make this happen is Github's secret sauce. I'm not looking to compete with them, but would love an open source solution that had a better uptime than a single digital ocean droplet running debian. Ideally, I could get there without green-fielding raft consensus shims into a modified git binary.

Re: How Git servers work, and how to keep yours secure

#19

Post by Ajedi32 »

elevation wrote: post #18

I like self hosting git but these tutorials set you up with only a one-machine solution. I'd like to be able to self-host a git service that's robust in the face of network/hardware/OS maintenance. I know git is distributed by design. So if I want to push code to a pair of servers for better availability, I can do it explicitly: git push git push But what if I wanted to make this transparent but still highly availabl…

  git remote set-url --add origin $second_url
Not quite HA cluster levels of redundancy, but it's also way simpler to set up.

Re: How Git servers work, and how to keep yours secure

#20

Post by moistbar »

chungy wrote: post #6

The article makes the presumptions that one would be running Arch on a server and that you must be using nginx as a web server. The latter half of that is particularly striking to me, given that he immediately dives into a shortcoming of nginx... rather than reaching for Apache, he works around nginx's shortcoming.

Arch also doesn't make for a particularly good server OS.
Post reply on HN