想比production server自動pull gitlab, 但唔想比太多權限, 可以點set?

3ldk

想搞自動deploy, 寫左個bat, 每個鐘都會pull一次gitlab上某個branch

但係如果想pull, 就要整個access token,

雖然可以淨係set read_repository, write_repository權限比某個token

但如果得到token, 係可以access晒gitlab全部project

production server無理由可以access唔相關既project, 而且仲要set埋developer個gitlab account落去, 咁唔係好妥當

雖然可以每個server開一個gitlab account, 然後add account落project

但咁就要管理大量account, 又係唔可行

有無方法可以限制server只可以access一個project? 最好連developer account name都唔洗暴露

KamSing

https://docs.gitlab.com/ee/user/ ... _access_tokens.html
有project token

https://docs.gitlab.com/ee/topic ... es.html#auto-deploy
用CI tool 會唔會好D?

hihihi123hk

GitLab CI  Zip 起啲 Source code 再 scp/sftp 上去 production

delete .git folder

ci remote trigger unzip

via HKEPC IR Extreme 4.2.3 - iOS(4.0.2)

rabbit82047

點解唔係 change detect 再 push 上去 server, 而係要 server pull

係要用 pull 形式, 可以考慮 git server 打包個 deployable package 去特定位置
server 定時 pull 果個 package, deploy 完 issue delete / archive command

3ldk

研究過上面幾種方法, 暫時覺得比較可行既只有依個deploy token,
唯一係差一樣, 無write_repository, 如果個網站有config可以set, admin tune完個config無得push返上去

https://docs.gitlab.com/ee/topic ... es.html#auto-deploy



至於其他方法

project token:

porject token要用gitlab console先可以用到, gitlab console要self host先有, 我係用gitlab的service, 所以用唔到

GitLab CICD / Jenkins

依類方法最大問題係要在server開個缺口(22)

我之前set既server經常比人hack, 就算係wordpress hosting(即係os/panel係set好晒比你, 你直接用wordpress果種)
都一樣比人hack, 所以我想做好D security, 所以先諗住由server主動pull
當然, 如果deploy token最後都係無辧法解決最後一個問題, 應該都會改用CICD

macross7ra

You are using Gitlab, so you should use Gitlab CI to setup a deployment job by projects.

You did mention server and project is 1 to 1 pair, the deployment job could just ssh into the target server and use the CI token to pull the repo and then reload you app.

To the SSH credential, you can use the secret CI variable by projects.

macross7ra

You can check how to pass along the CI token to the server via SSH

https://superuser.com/questions/ ... ough-an-ssh-command

macross7ra

https://docs.gitlab.com/ee/user/ ... endent-repositories

louislam

我自己用開 Deploy Keys，係用得tick write access

hihihi123hk

研究過上面幾種方法, 暫時覺得比較可行既只有依個deploy token,
唯一係差一樣, 無write_repository, 如果 ...
3ldk 發表於 2020-7-11 17:17

「成日俾人 Hack」

係唔係因為 ssh 你用 password login?

Btw, 另外一個方法係，喺你 Production Server 裝 GitLab Runner，成為 GitLab CI 嘅一部份直接同 GitLab 溝通

via HKEPC IR Extreme 4.2.3 - iOS(4.0.2)