Permission denied with endpoints, but not with manual command push (or pull) about kirby-git-content HOT 9 CLOSED

Great !
That's work !

Maybe this very useful information need to be in the readme ?
Anyway, Thank you so much Markus. :)
I close this issue.

from kirby-git-content.

Most of the time this happens due to php using the wrong ssh key or using the wrong username because the shell environment of php is different to the one you use via ssh.

So I think you have two options:

1. Try to emulate the webserver env as closely as possible and debug from this point (eg. setting env vars etc)
2. Since you have shell access on your server you can also create a cron running the push command via shell and not via the plugin’s webhooks (cd /path/to/website && git push).

Best,
Markus

from kirby-git-content.

Thanks for the amazingly quick response.

I am just doing my tests on a local docker environment, and I also initially thought that php was not using the same user as the one I was pushing or pulling in ssh with.
I corrected. The problem remains ...
And unfortunately, I wouldn't be able to do real cron jobs on the production server, only run webhooks.

from kirby-git-content.

The users and groups in my docker environment were messy.
I reccomanced everything on a "new" server, a replica of the production one.
I still have the same error.
How do I get php to use a user who has rights to ssh keys?

from kirby-git-content.

You can run docker run -ti php:fpm-alpine sh or (you need to replace php:fpm-alpine with the image you’re using). Then you can check the home dir of all users by running cat /etc/passwd. There you need to find the user the image is starting the php process (in case of the official PHP image it’s www-data).

When running the image you need to put a folder called .ssh in the homedir containing the private key which has access to the git repo.

You can test this by starting the image with docker run -ti -u www-data php:fpm-alpine and try to fetch/push afterwards.

Hope that helps! :)

from kirby-git-content.

Hi Markus

Thanks a lot for your time.

On my Docker image, I connected via

sudo docker exec -it -u ben:www-data docker_web_1 bash

In order to force the ben user and the www-data group, which are the ones with which I had configured php-apache in my docker file.
I was in doubt that my user / group ssh was the same as the one used by php.
I put everything back on a new config, online, and on which I am sure that the users and groups are the same.
It continues to produce this error ...

I have a question, maybe stupid. Could the know_hosts file be the cause?
I think about this because it makes sense to me that when kirby uses his own end-points, he is recognized.
But if, as I've been trying to do for a few hours, I hit them from a simple remote http request, how can I be recognized as a know host?

Another lead. Does the git config (config.name and config.email) have to reflect that of the repo?

I keep digging ...

from kirby-git-content.

Without knowing your exact setup it’s hard to give you any new hints, I’m sorry… :)

But at least I can let you know that we use this plugin with Docker in various setups and it’s working very well. So I think it’s “just” a matter of finding the right place to put the right ssh-key.

from kirby-git-content.

Hi Markus,
Thanks again for your time.

Yes, I know that without having my configuration, it's not easy to help me more than you have already done.
I tried to re-start everything on two completely different servers, my local docker and a remote cloud. It does not work.
I tried to change the users, groups, permissions. It does not work.

I 'm dropping these "conventional" attempts and return to pragmatism .

Related to kbjr/Git.php#14, I tested modifying the push() method. And it works.
For the moment, I have simply hardcoded

$ this->getRepo()->push('https://USERNAME:[email protected]/USERNAME/REPO.git', $branch);

Instead of

$this->getRepo()->push('origin', $branch);

Obviously, this implies abandoning SSH authentication in favor of HTTPS.
Certainly much less secure but it works.

For my project, this level of security is sufficient, I think I will fork your repo to allow the user and the password to be injected from Kirby's options. Then I will change the arguments passed in the push and pull methods conditionally.
I'm not a fan of storing the password in the config file.
Maybe grabbing an environment variable would be a more secure way.

from kirby-git-content.

You can also change the origin using this full url. git remote set-url origin https://USERNAME:[email protected]/USERNAME/REPO.git that might work too without the need to modify the plugin code.

from kirby-git-content.