Skip to main content

Git Private Repository Authentication Guide

This guide provides the step-by-step procedure for setting up SSH Deploy Key authentication on production servers to clone and pull private GitHub repositories (scannersky-django).

Overview & Security Principles​

Because scannersky-django is a private repository, deployment servers require authenticated access to run git clone, git fetch, and git pull.

Server Security Rule
Production servers must use Read-Only SSH Deploy Keys. SSH Deploy Keys provide dedicated, non-expiring access restricted strictly to a single repository without exposing personal account credentials or passwords.

Standard SSH Deploy Key Setup (Server Authentication)​

Step 1: Generate an SSH Keypair on the Server​

Log into the target server (10.0.25.180) and generate a dedicated SSH key:

# Generate Ed25519 keypair on the server
ssh-keygen -t ed25519 -C "scannersky-production-server" -f ~/.ssh/id_ed25519_deploy -N ""

Step 2: Add Public Key to GitHub Repository Settings​

  1. Display the public key on your terminal: 
    cat ~/.ssh/id_ed25519_deploy.pub
  2. Open your GitHub Repository in a web browser: https://github.com/codexcancerion/scannersky-django/settings/keys
  3. Click Add deploy key:
    • Title: Production Server - 10.0.25.180
    • Key: Paste the string starting with ssh-ed25519 ...
    • Allow write access: Leave unchecked (Read-Only)
  4. Click Add key.

Step 3: Configure SSH Client & Permissions on Server​

Configure SSH so Git automatically uses your deploy key for GitHub host requests:

# Ensure strict permissions on SSH directory
mkdir -p ~/.ssh && chmod 700 ~/.ssh

# Add GitHub configuration entry to ~/.ssh/config
cat << 'EOF' >> ~/.ssh/config
Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_deploy
  IdentitiesOnly yes
EOF

# Enforce secure file permissions
chmod 600 ~/.ssh/config ~/.ssh/id_ed25519_deploy

Step 4: Test Connection & Clone Repository​

CRITICAL: Always Clone via SSH URL (git@github.com:)
Do NOT use https://github.com/... URLs. HTTPS URLs bypass SSH keys and force Git to prompt for a username and password.

  1. Test connection to GitHub:

    ssh -T git@github.com

    Expected Output: Hi codexcancerion/scannersky-django! You've successfully authenticated...

  2. Clone repository directly into your home directory using SSH:

    # Clone directly using SSH URL
    git clone -b docker/compose-migration git@github.com:codexcancerion/scannersky-django.git ~/scannersky-django
    cd ~/scannersky-django

Troubleshooting: Switching an Existing Clone from HTTPS to SSH​

If a repository was previously cloned using an https:// URL (which causes Git to prompt for username/password on git pull), switch the remote URL to SSH:

cd ~/scannersky-django

# Switch remote URL to SSH:
git remote set-url origin git@github.com:codexcancerion/scannersky-django.git

# Verify remote configuration:
git remote -v
# Output should show: origin git@github.com:codexcancerion/scannersky-django.git (fetch & push)