News for hackers. Stuff that matters.
Re:Let's deploy via Git by tux1968 on Sunday June 23, 2013 @11:51AM (#5927972)
I'm a huge Git fan and use it every day, but Git was never designed as a deployment tool. There may be situations where you want the entire history of your development to be included on your live server, but often this just isn't appropriate. Also, when deploying to multiple servers you have to invent adhoc methods to handle configuration differences. Even native ssh seems like a more prudent deployment method than Git. This smacks of using the closest hammer at hand, rather than choosing the best tool.
Re:Let's deploy via Git by snprbob86 on Sunday June 23, 2013 @12:15PM (#5928065)
> There may be situations where you want the entire history of your development to be included on your live server, but often this just isn't appropriate.

Are you concerned about being wasteful with disk space? Or is there some other concern here? Some security issue perhaps?

Re:Let's deploy via Git by ohwp on Sunday June 23, 2013 @12:35PM (#5928167)
I once committed my DB settings (Mercurial) and noticed my mistake only later. It's very hard to get it out of the history. Ofcourse it could be fixed but this is one example.

Imho version control could be used for deployment but only when you use the release-branch of your project.

And ofcourse NEVER put your config in version-control ;)

Re:Let's deploy via Git by mnutt on Sunday June 23, 2013 @01:26PM (#5928426)
And of course NEVER put your config in version-control ;)

I'm not sure I'd make that blanket statement. Version control seems like a great place for configuration. It allows you to centrally manage configuration details and provides an audit trail for debugging. You just want to make sure it is in a separate, secure repository and not mixed in with your app development.

Re:Let's deploy via Git by jlgreco on Sunday June 23, 2013 @04:29PM (#5929287)
FWIW, removing things from history entirely is easy with git using git-filter-branch. The real problem is realizing that you need to do that in the first place.
Re:Let's deploy via Git by scott_w on Sunday June 23, 2013 @01:36PM (#5928463)
I want to reinforce what mnutt said. A separate, secured repository for your settings is a very good thing.

You may want to look into salt, chef or puppet, which let you separate out your configuration from your security credentials.

Re:Let's deploy via Git by jwilliams on Sunday June 23, 2013 @09:04PM (#5930347)
I'm sure many people have done this - the most prudent thing would be to change the sensitive settings? That would solve your history problem as well.
Re:Let's deploy via Git by rdtsc on Sunday June 23, 2013 @09:58PM (#5930553)
> And ofcourse NEVER put your config in version-control ;)

Why wouldn't you want to version your configurations in general? Maybe I am not sure what you mean by "config" but in general version controlled configuration is always good. I even set up git in my etc sometimes to track changes I make to it manually (not in production, on my home machine).

Re:Let's deploy via Git by bpatrianakos on Sunday June 23, 2013 @01:34PM (#5928459)
I think what everyone is getting at here is to be smart about when to use git for deployment. Rsync is great for small static sites the same way git is. Now, I'm not going to use it on my medium to large size web app (actually I do for the testing server but that's another story). It's just another way to get a site deployed. I think its great for small static sites and prefer it over rsync for no other reason than I'm already using git and its just an extra git push when I'm ready. I actually use different remotes for deployment rather than a branching strategy.
Re:Let's deploy via Git by tux1968 on Sunday June 23, 2013 @12:35PM (#5928164)
Both reasons.

Mostly it's because it seems people are using Git to deploy without a good reason. At least I haven't heard of an advantage enjoyed by those using Git for deployment.

There are some obvious disadvantages, so what is the compensation? It seems the only reason is that it's easy to type "git push". But of course any deployment method can be wrapped in an equally easy script command.

Okay, I have to admit to knowing of one advantage, and that is that only the delta of your changes will be transmitted over the wire, rather than a complete checkout. It's just that in practice the savings aren't usually enough to warrant the potential downsides. For my money i'd prefer rsync or any number of other solutions.

Re:Let's deploy via Git by mnutt on Sunday June 23, 2013 @01:37PM (#5928477)
The way we have it set up in capistrano, git is used as the distribution mechanism. It offers a lot of flexibility in that you can deploy a tag or a revision hash or whatever without having to worry about consistencies between users' machines or having to deal with an external packaging machine.

Once the repo has been fetched, we just check out the right tag/revision and do a local copy from the git repo into the app directory. At this step you can exclude .git if you want.

This process has an advantage over direct git checkout in that if you (heaven forbid) ssh onto the server and directly modify anything, you won't end up with conflicts.

Re:Let's deploy via Git by RussianCow on Sunday June 23, 2013 @01:18PM (#5928376)
What are the potential downsides? I've been deploying with Git for over a year and am interested in learning why it's not a good idea.
Re:Let's deploy via Git by Marc_Paradise on Sunday June 23, 2013 @01:53PM (#5928556)
Security.

Are you 100% sure that there is nothing you are exposing via your git repo that you want to keep away from the person who manages to hack your server or discover some means to reach the repo externally?

Getting hacked is not inevitable, but if you treat your systems as if it were you'll be a lot safer if it does ever occur.

Re:Let's deploy via Git by zzzeek on Sunday June 23, 2013 @05:42PM (#5929621)
If you push via git or via rsync, you're typically going over SSH in both cases. As far as the .git directory, my post-receive hook also does a "cp -R" of the files to the actual web-served directory (there's a build step in between anyway), so there's no .git exposed. As far as security, as long as one knows to handle the .git directory, there's no difference.
Re:Let's deploy via Git by kyrias on Sunday June 23, 2013 @05:50PM (#5929663)
If there's anything in your repo history that you don't want a hacker to find you can just remove it and force push.
Re:Let's deploy via Git by Peaker on Sunday June 23, 2013 @08:00PM (#5930125)
"Just remove it" is hard, because:

* It may be hidden in some old commit (e.g: some password)

* You'd need to rewrite all history from that point

* Force push doesn't necessarily clean the data from the remote

Re:Let's deploy via Git by michaelmior on Sunday June 23, 2013 @09:35PM (#5930475)
FWIW, the "hidden in some old commit" problem is easily solvable with git-filter-branch. But the second two points are certainly valid :)
Re:Let's deploy via Git by eru on Sunday June 23, 2013 @11:31PM (#5930834)
Change the old passwords?
Re:Let's deploy via Git by Peaker on Monday June 24, 2013 @04:12AM (#5931630)
I think the main problem is unknown exposure: Do you audit all old commits to find any sensitive data?
Re:Let's deploy via Git by eru on Monday June 24, 2013 @05:34AM (#5931899)
Shouldn't you audit all commits in any case?
Re:Let's deploy via Git by bradleyland on Monday June 24, 2013 @12:26PM (#5933946)
So, you have two choices:

1) You can go through the trouble of identifying and resolving all the edge cases that you encounter when using Git as a deployment tool. Keeping in mind that one of those may result in an embarrassing security disclosure. Woops.

2) You can use a deployment tool that was developed for that purpose, has existed for years, and has had many sets of eyes on it; many of which are inevitably more experienced than you. And you still may end up with an embarrassing security disclosure, but the chances are better that you'll hear about it through responsible disclosure channels first, rather than waking up at 3 AM to the voice of your boss/client asking why the site is redirecting users to buy Viagra at a discount.

A bonus third choice:

3) You look at existing deployment tools and ask yourself "I wonder why they do that?" Then, maybe ask around a bit. Once you've got a good idea of all idiosyncrasies involved with deploying software, then you embark upon building your own tool. I think you'll find that simply `git pull`ing from your httpd document root and `rm -R`ing the .git/ directory won't be your final solution.

Re:Let's deploy via Git by kyrias on Tuesday June 25, 2013 @12:57PM (#5940796)
If anything you should have the webroot directory in the git repo, not have the repo be the webroot
Re:Let's deploy via Git by Peaker on Monday June 24, 2013 @07:26PM (#5936424)
The audit of commits in the general case (Checking for errors in the code) and the audit for the deployment case (Checking for sensitive data that may be exposed in a security breach) are different audits. I don't think many tend to do the second kind of audit.

Also, minimizing your exposure in case of a security issue is probably a good idea, so the convenience of deploying with git may or may not be worth this extra exposure.

Re:Let's deploy via Git by kaoD on Sunday June 23, 2013 @11:57AM (#5927995)
I agree on the configuration issue, but you can export the working tree[1] in the hook to avoid including the Git history (and in fact it is a sensible choice).

The configuration can be handled in the post-receive hook too.

I advise against using Git as a deployment tool for serious development (you should use Puppet instead), but for quick hacking and personal projects it's perfectly fine.

[1] http://stackoverflow.com/questions/160608/how-to-do-a-git-ex...

Re:Let's deploy via Git by tux1968 on Sunday June 23, 2013 @12:05PM (#5928025)
When you Git push to a live server as the article in question suggests you're sending the entire repo history not just the latest commit. The remote hook only checks out the latest change, but the entire history is sitting right there on the live server. Which is silliness in most cases.

As is suggested in the SO article you link, it's more appropriate to locally export the version you want to deploy and use ssh (or whatever) to transfer it to the live server. Nobody ever seems to try to justify _why_ you would want to use git-push, they just go about explaining how you do it.

Re:Let's deploy via Git by Aqueous on Sunday June 23, 2013 @12:57PM (#5928261)
In this example they are checking out into a work tree that is detached from the central repo, which is bare (or could be.) Therefore there is no .git directory in the work tree and the history is inaccessible from the outside world. I don't see how having the entire history sitting in a private directory on the server is silly, as long as only you can access it.

Honestly we are just talking about transferring files here. However you automate it, as long as it gets the files from point a from point b, is fine. I happen to find it most convenient to use git since that is how I send and receive code changes everywhere else, and it seems foolhardy to introduce another file transferring tool without a really good reason why. Moreover it lets me very easily tell exactly what revision is sitting on the server, and also causes me to pause before I push. It is also really easy to integrate git, through hooks, with a continuous integration setup.

Re:Let's deploy via Git by gkop on Sunday June 23, 2013 @02:20PM (#5928708)
> _why_ you would want to use git-push

Many of us like to have some recent past releases sitting on the production servers in order to make instant rollbacks if we discover a bug after the code has been deployed. Git provides that for free.

Re:Let's deploy via Git by bradleyland on Monday June 24, 2013 @12:31PM (#5933977)
This is almost exactly what Capistrano does. What's hilarious is that this entire thread reads like a discussion that could have lead to the development of Capistrano.

* Capistrano can deploy via git (it uses export)

* Capistrano keeps a configurable number of releases around in case you need to rollback

* Capistrano provides an ordered task system with before/after hooks at every one of its pre-defined tasks

* Capistrano can be just as lightweight as using git to deploy:

    cap deploy
    git push
Two additional characters!

* You may not need all the stuff that Capistrano provides today, but as your project grows, you will need it. Why waste your time with a compromised deployment hack when better tools are available and easy to use?

Re:Let's deploy via Git by kaoD on Sunday June 23, 2013 @01:19PM (#5928383)
> _why_ you would want to use git-push

Faster deployment.

As I said you shouldn't use this for critical services, but it works great for quick hacking. It's also very convenient for non-production (i.e. testing/staging) machines, to automate continuous integration.

Re:Let's deploy via Git by tacticus on Sunday June 23, 2013 @09:18PM (#5930405)
Puppet does add some significant runtime lag unless you add in other orchestration tools. additionally if operations include cross host dependencies puppet is probably the wrong tool to use.