What is the easiest way to work with project configuration files?

Question

It is very common to have at least one configuration file in any project. Every time I share a project with git , I have the same problem:

• confidential information (each developer has different database passwords, etc.)
• task-specific information (when a developer is working on a specific task, where some settings need to be changed)

Obviously, configs need to be ignored in some way to prevent developer-specific data from filling in the main repository. Now I used several methods, each of which had some disadvantages:

• .gitignore configuration files
  • The easiest way
  • when the developer clones the repo, the configuration file is missing, and you need to find out where the configurations were updated.
• The configuration file is not ignored. It contains some kind of fictitious information, and each developer either does not pay attention, or puts it in his .git/info/exclude or sets git update-index --assume-unchanged ... to a file
  • files are available to anyone who clones the repo
  • it contains best practices that can confuse people who work with git for the first time
  • when someone accidentally creates configuration files, he will not allow people to pull / pull (since the exception does not work the same as .gitignore )
• Distribute configuration files suffix, for example, _original , having real files in .gitignore . Each developer then renames the files to real names.
  • files are available to anyone who clones the repo
  • you need to search for all configs throughout the application and rename them

Are there other, possibly better ways to handle this? I suspect that I missed something, at least the plugin.

Answer 1

Filter drivers are an “automatic” way to implement option 3, as indicated in “ when you have a secret key in your project, how can I click Is GitHub possible? ”:

smudge script will be on check:

• identify the correct configuration files to modify
• select the necessary information (it’s best to save it outside any Git repo ) and replace the template values ​​with the actual ones.

From there, developers can make any modifications they want for these configuration files.
It does not matter, because a clean script will, when committed, restore the contents of this file to its original (boilerplate) value. No accidental click.

Answer 2

The way we did this in the last project that I was working on was to have a main configuration file that loaded the local user configuration file if it was present, which could overwrite the default values ​​in master, if specified, and declared his own configuration information if not in the wizard. A local file has been added to gitignore. Thus, all common things can be shared, and some configurations are always present, and each developer can change their local ones.

Answer 3

In the projects that I had, we have the default configuration, and the developers have their own configuration in a certain place outside of version control (configuration agreement) - the values ​​from the latter are used to override those that were in the first.

We started using encryption for sensitive information in config: Handling passwords in production configuration for automatic deployment

In the case of git, you can look at the git attributes filter attribute to perform both the replacement of local values ​​and the decryption of sensitive values ​​in automatic mode.

You can also have submodules that say production.yml and with limited access to the submodule repository.

Answer 4

Since it took me a while to find a working solution with @VonC hints, here is a complete example of how to ignore passwords with a clean git filter in the Objective-C header file.

• Suppose you have a default script configuration called Config.h containing this

   // Change "12345" to your password #define kPass @"12345" #define kConstant 42 

• Create a hidepass.sh script that matches the critical line and prints the default line instead

   #!/bin/sh awk '{ if (/#define kPass/) print "#define kPass @\"12345\""; else print $0; }' exit 0 

• Make a script executable and add it to the repo

• Tell git to filter your config file by adding this line to .gitattributes (also add .gitattributes to your repo)

   Config.h filter=hidepass 

• Tell git to use hidepass.sh script for the hidden filter during cleanup:

   git config filter.hidepass.clean ./hidepass.sh 

To have it now, you can change the password in Config.h , but git will not perform this change, because it always replaces this line with the default line with checkin.

This is a quick solution for a one-line password, you can go crazy and, for example, end the lines that you want to ignore with a special line, and check the lines with this line.

Answer 5

One thing I can think of is similar to method 2 and method 1 above. Where you have a directory that stores complex things unique to the site, such as directories for configuration files, user-uploaded files, etc.

You save only the configuration file itself outside of version control, but then you have a dummy copy that is slightly different from what the site actually uses, and this file contains detailed instructions on the configuration parameters and make a renamed copy.

For example, let's say you have a site_profile directory. In this directory, you create a file called "README.settings.php" along with the "files" directory, which contains the files uploaded by the user (both for administrators and front-end users). All of this is under version control.

However, the site will launch its settings with "settings.php", which will not be here. But if you rename "README.settings.php" to "settings.php", then you will have the necessary configuration file (after you, of course, make your user settings).

This will allow you to tell other developers what they need from their configuration file, while maintaining their own configuration file. Just set your configuration file to ignore or never commit the protective layer for this directory and below.

This is what we do with the Drupal sites where I work, and it works very well.

Answer 6

In two cases, you mentioned:

• confidential information (each developer has different database passwords, etc.)

  Write your scripts so that these sensitive files are saved in the developer's home directory, and not in the project directory.

• information about a specific task (when a developer is working on a specific task, where some settings need to be changed)

  Usually I have the default settings set in the repository, and then when you prepare your commits, you can easily check if you have changed any of these parameters and return them before committing.

Answer 7

I saved my local configuration changes in stash git. I use the git stash application instead of pop, so I never remove it from the stash queue. That way I can use reset -hard whenever I want.

Answer 8

Having no experience with Git, but dealing with the same problems in other contexts (Hibernate login creds in Spring JUnit suite, or ANT), for everything that depends on the user or depends on the user's local environment:

• README lists these dependencies and how to configure the local env to run the script.
• Replace these dependencies in your conf with calls to system properties or some kind of wireframe way of inferring external values. For example, in an ANT script, you can replace the lines <sysproperty key="jdbc.username" value="${jdbc.username}"/> , where jdbc.username is a system variable (which you can set in Eclipse).

Developers can check whatever they want because conf is a user agnostic.

Answer 9

The list includes many good options. A few more options:

• Add all configs to .gitignore. Then create a separate git project with only configuration files. (Save this git # 2 in a completely different folder.) In this git # 2, create several scripts similar to apply-config /path/to/my_git1 , save-config /path/to/my_git1 that copy or save the configuration files for The main git of REPO transactions.
  • I prefer to use submodules. I found work with bulky submodules in a large team.
  • You can then track configurations or use multiple git repos for things like production settings, debugging settings, more optimized settings, etc.
  • Uses one tool (GIT) that everyone understands.
• I like the idea of ​​searching the home folder for sensitive things like DB connection info. (Mentioned @avh)
• For devOps, you can consider things like Ansible / Salt / Chef / Puppet to automate deployments and settings.

Answer 10

Another very common option, popularized by the Twelve Factors , is the absence of any configuration variables that are hard-coded into files, and loading them from environmental variables. Thus, files in the repository do not need special processing.