`.git-privacy-template`

401 lines
# Git Privacy Configuration Template
# ====================================
# This template ensures new repositories are created as private by default
# and includes security best practices for both GitHub and GitLab platforms.
#
# Usage:
#   1. Copy this file to your new repository root as .git-privacy-config
#   2. Run: bash .git-privacy-config
#   3. Verify privacy settings with the provided verification commands

# ============================================================================
# GITHUB PRIVACY CONFIGURATION
# ============================================================================

# Create a new private GitHub repository using GitHub CLI
# The --private flag ensures the repository is not publicly visible
# Syntax: gh repo create <repo-name> --private --source=. --remote=origin
#
# Example:
#   gh repo create my-new-project --private --source=. --remote=origin

# Verify GitHub repository privacy status
# This command checks if the repository is private (should return: {"isPrivate": true})
#
# Command:
#   gh repo view owner/repo --json isPrivate

# Change existing GitHub repository to private
# Use this if you accidentally created a public repository
#
# Command:
#   gh repo edit owner/repo --visibility private

# ============================================================================
# GITLAB PRIVACY CONFIGURATION
# ============================================================================

# Create a new private GitLab repository using GitLab CLI
# The --private flag ensures the repository visibility is set to private
#
# Command:
#   glab repo create my-new-project --private

# Create private GitLab repository using API
# Useful when GitLab CLI is not available or for automation scripts
#
# Command:
#   curl --request POST "https://gitlab.com/api/v4/projects" \
#     --header "PRIVATE-TOKEN: <your_access_token>" \
#     --data "name=my-repo&visibility=private"

# Verify GitLab repository privacy status
# This command checks visibility level (should return: {"visibility": "private"})
#
# Command:
#   glab repo view owner/repo --json visibility

# ============================================================================
# REPOSITORY SECURITY SETTINGS CHECKLIST
# ============================================================================

# GitHub Security Settings:
# - [ ] Repository visibility: Private
# - [ ] Branch protection rules: Enabled for main/master
# - [ ] Require pull request reviews: Enabled
# - [ ] Disable force pushes: Enabled
# - [ ] Disable repository deletion: Enabled

# GitLab Security Settings:
# - [ ] Visibility level: Private
# - [ ] Merge request approvals: Required
# - [ ] Protected branches: Enabled for main/master
# - [ ] Push rules: Configured
# - [ ] Repository mirroring: Disabled (unless explicitly needed)

# ============================================================================
# AUTOMATED PRIVACY VERIFICATION SCRIPT
# ============================================================================

# The following script can be saved as verify-repo-privacy.sh
# It automatically checks if the repository is private before allowing pushes
#
# Save this script to: /root/scripts/verify-repo-privacy.sh
# Then make it executable: chmod +x /root/scripts/verify-repo-privacy.sh

cat > /root/scripts/verify-repo-privacy.sh << 'VERIFY_SCRIPT'
#!/bin/bash
# Git Repository Privacy Verification Script
# Checks if repository is private before allowing git push operations

REPO_URL=$(git config --get remote.origin.url)

if [[ $REPO_URL == *"github.com"* ]]; then
  # GitHub repository verification
  REPO=$(echo $REPO_URL | sed 's/.*github.com[:/]\(.*\)\.git/\1/')
  PRIVACY=$(gh repo view $REPO --json isPrivate -q .isPrivate)

  if [ "$PRIVACY" != "true" ]; then
    echo "❌ ERROR: GitHub repository is PUBLIC! Aborting push."
    echo "Run: gh repo edit $REPO --visibility private"
    exit 1
  fi
  echo "✅ GitHub repository is private"

elif [[ $REPO_URL == *"gitlab.com"* ]]; then
  # GitLab repository verification
  REPO=$(echo $REPO_URL | sed 's/.*gitlab.com[:/]\(.*\)\.git/\1/')
  VISIBILITY=$(glab repo view $REPO --json visibility -q .visibility)

  if [ "$VISIBILITY" != "private" ]; then
    echo "❌ ERROR: GitLab repository is PUBLIC! Aborting push."
    echo "Run: glab repo edit $REPO --visibility private"
    exit 1
  fi
  echo "✅ GitLab repository is private"

else
  echo "⚠️  Warning: Unknown git platform. Cannot verify privacy status."
fi
VERIFY_SCRIPT

chmod +x /root/scripts/verify-repo-privacy.sh

# ============================================================================
# GIT PRE-PUSH HOOK SETUP
# ============================================================================

# Automatically verify privacy before every push by adding a pre-push hook
# This hook runs the verification script before allowing any git push operation
#
# Setup instructions:
#   1. Navigate to your repository: cd /path/to/your/repo
#   2. Create the pre-push hook: cat > .git/hooks/pre-push << 'HOOK'
#   3. Make it executable: chmod +x .git/hooks/pre-push

cat > .git/hooks/pre-push << 'HOOK'
#!/bin/bash
# Git pre-push hook that verifies repository privacy before pushing
# This prevents accidental pushes to public repositories

/root/scripts/verify-repo-privacy.sh || exit 1
HOOK

chmod +x .git/hooks/pre-push

# ============================================================================
# GITIGNORE TEMPLATE FOR SENSITIVE DATA
# ============================================================================

# Always include these patterns in .gitignore to prevent committing sensitive data
# This protects API keys, credentials, and other secrets from being exposed

cat > .gitignore << 'GITIGNORE'
# Environment variables and secrets
.env
.env.local
.env.production
.env.development
*.key
*.pem
*.p12
*.pfx

# Credentials and tokens
secrets/
credentials/
config/secrets.json
*-credentials.json

# Node.js dependencies
node_modules/
npm-debug.log*
yarn-debug.log*
yarn-error.log*

# Build outputs
dist/
build/
.next/
out/

# System files
.DS_Store
Thumbs.db
*.log

# Database files
*.sqlite
*.db

# IDE and editor files
.vscode/
.idea/
*.swp
*.swo
*~

GITIGNORE

# ============================================================================
# REPOSITORY CREATION AUTOMATION SCRIPT
# ============================================================================

# Complete script for creating a new private repository with all security settings
# This automates the entire process of creating a secure, private repository
#
# Save as: create-private-repo.sh
# Usage: ./create-private-repo.sh <repo-name> [github|gitlab]

cat > create-private-repo.sh << 'CREATE_SCRIPT'
#!/bin/bash
# Automated Private Repository Creation Script
# Creates a new private repository with security best practices

set -e  # Exit on any error

REPO_NAME=$1
PLATFORM=${2:-github}  # Default to GitHub if not specified

if [ -z "$REPO_NAME" ]; then
  echo "Usage: $0 <repo-name> [github|gitlab]"
  exit 1
fi

echo "Creating private repository: $REPO_NAME on $PLATFORM"

# Create .gitignore file
cat > .gitignore << 'EOF'
.env
.env.local
*.key
*.pem
node_modules/
.DS_Store
secrets/
*.log
EOF

echo "✅ Created .gitignore"

# Initialize git repository
git init
git add .gitignore
git commit -m "Initial commit: Add .gitignore"

echo "✅ Initialized git repository"

# Create private repository on selected platform
if [ "$PLATFORM" == "github" ]; then
  # Create private GitHub repository
  gh repo create "$REPO_NAME" --private --source=. --remote=origin

  # Set up branch protection for main branch
  sleep 2  # Wait for repository to be fully created
  gh api "repos/$(gh repo view --json nameWithOwner -q .nameWithOwner)/branches/main/protection" \
    -X PUT \
    -f required_status_checks='null' \
    -f enforce_admins=true \
    -f required_pull_request_reviews='{"required_approving_review_count":1}' \
    -f restrictions='null' 2>/dev/null || echo "⚠️  Branch protection will be set after first push"

  echo "✅ Created private GitHub repository"

elif [ "$PLATFORM" == "gitlab" ]; then
  # Create private GitLab repository
  glab repo create "$REPO_NAME" --private

  echo "✅ Created private GitLab repository"

else
  echo "❌ Unknown platform: $PLATFORM"
  echo "Supported platforms: github, gitlab"
  exit 1
fi

# Add pre-push hook
mkdir -p .git/hooks
cat > .git/hooks/pre-push << 'EOF'
#!/bin/bash
/root/scripts/verify-repo-privacy.sh || exit 1
EOF
chmod +x .git/hooks/pre-push

echo "✅ Added pre-push privacy verification hook"

# Verify repository is private
echo ""
echo "Verifying repository privacy..."
/root/scripts/verify-repo-privacy.sh

echo ""
echo "🎉 Private repository created successfully!"
echo "Repository: $REPO_NAME"
echo "Platform: $PLATFORM"
echo "Privacy: Private ✅"
echo "Security: Pre-push verification enabled ✅"

CREATE_SCRIPT

chmod +x create-private-repo.sh

# ============================================================================
# EMERGENCY RESPONSE PROCEDURES
# ============================================================================

# If a repository was accidentally made public, follow these steps immediately:

# 1. Make repository private immediately
#    GitHub: gh repo edit owner/repo --visibility private
#    GitLab: glab repo edit owner/repo --visibility private

# 2. Rotate all credentials that may have been exposed
#    - API keys
#    - Database passwords
#    - SSH keys
#    - OAuth tokens
#    - Any other sensitive credentials

# 3. Scan commit history for exposed secrets
#    git log --all --full-history --source -- .env
#    git log --all --full-history --source -- "*password*"
#    git log --all --full-history --source -- "*secret*"
#    git log --all --full-history --source -- "*.key"

# 4. Remove secrets from git history if found (DANGEROUS - backup first!)
#    git filter-repo --path-glob '*.env' --invert-paths
#    git filter-repo --path-glob '*.key' --invert-paths

# 5. Force push cleaned history (if secrets were removed)
#    git push origin --force --all

# 6. Document the incident
#    - What was exposed
#    - How long it was public
#    - What actions were taken
#    - Who was notified

# ============================================================================
# VERIFICATION CHECKLIST
# ============================================================================

# Before pushing code to any repository, verify:
# [ ] Repository is set to private
# [ ] No API keys or credentials in code
# [ ] .gitignore includes sensitive files
# [ ] Branch protection enabled
# [ ] Only authorized collaborators have access
# [ ] Pre-push hook configured (optional but recommended)
# [ ] Secrets scanning enabled (GitHub: Settings > Code security and analysis)
# [ ] Dependabot alerts enabled (GitHub: Settings > Code security and analysis)

# ============================================================================
# MAINTENANCE AND AUDITING
# ============================================================================

# Regular maintenance tasks to ensure ongoing privacy and security:

# Monthly: Audit repository visibility
#   GitHub: gh repo list --json name,isPrivate
#   GitLab: glab repo list --mine

# Monthly: Review collaborator access
#   GitHub: gh api repos/owner/repo/collaborators
#   GitLab: glab api projects/:id/members

# Monthly: Check for exposed secrets
#   Use tools like: git-secrets, truffleHog, or gitleaks
#   GitHub: Enable secret scanning in repository settings

# Quarterly: Review branch protection rules
#   Ensure all important branches have appropriate protection

# Annually: Security audit
#   Review all repositories for compliance with security policies
#   Update access controls and permissions

# ============================================================================
# ADDITIONAL RESOURCES
# ============================================================================

# GitHub Documentation:
#   - Repository visibility: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/managing-repository-settings/setting-repository-visibility
#   - Branch protection: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches
#   - Security advisories: https://docs.github.com/en/code-security/security-advisories

# GitLab Documentation:
#   - Project visibility: https://docs.gitlab.com/ee/user/public_access.html
#   - Protected branches: https://docs.gitlab.com/ee/user/project/protected_branches.html
#   - Security scanning: https://docs.gitlab.com/ee/user/application_security/

# Best Practices:
#   - Never commit secrets to git (use environment variables)
#   - Always use .gitignore for sensitive files
#   - Enable two-factor authentication on git platforms
#   - Regularly audit repository access and permissions
#   - Use SSH keys instead of passwords for git operations
#   - Keep dependencies up to date (use Dependabot/Renovate)

echo "Git Privacy Configuration Template loaded successfully!"
echo "Review the comments above for usage instructions and best practices."