I'm setting up a server to do automatic deployment from a Bitbucket git repository, using Bitbucket's postback facility.
Briefly, how it works it:
- I commit to Bitbucket
- Bitbucket POSTs to a specified script (which only runs if it's called from BB's IP Address)
- My script chdirs to the appropriate directory, runs git reset, and git pull to update to latest version (it's a php script using exec()).
I got the idea from:
And overall it seems ok, but it has one major security concern for me - to make it work, you'd need to give apache write access to/ownership of the site directory to do the deployment. This strikes me as a Bad Idea, because then an attacker use apache to write arbitrary files within the directory.
My idea as an alternative is to:
- Create another user, 'deploy' then make that the user which owns the site directory.
- Use sudoers to enable apache to run a specific shell script as user deploy, and put my git reset, pull command etc in that shell script.
- In my exec() calls, do e.g. "sudo -u deploy shell-script.sh"
Can anyone see any flaws/holes with this?