docs: Add warning about private tokens - #387
Conversation
for more information, see https://pre-commit.ci
|
Cool! I have transferred across content from https://infrastructure.2i2c.org/howto/features/private-nbgitpuller/#helm-values-configuration and included a warning about using PAT tokens to authorize acces to private repos. 
|
| Please do not include [personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#about-personal-access-tokens) in the nbgitpuller link, e.g. using a GitHub repo URL of the form `https://login:<TOKEN>@hostname/path.git`, since this is logged on the Jupyter server. Anyone with access to server can therefore see your private token. | ||
| ``` | ||
|
|
||
| If you would like to share content from a private repository, you can use [git-credential-helpers](https://github.com/yuvipanda/git-credential-helpers) to do so. |
There was a problem hiding this comment.
Let's note this only works on github?
| You must use the **private key**, not a **client secret**. | ||
| ``` | ||
|
|
||
| - To configure helm chart values for [Zero to JupyterHub](https://z2jh.jupyter.org/en/stable/) clusters, see [this example](https://infrastructure.2i2c.org/howto/features/private-nbgitpuller/#helm-values-configuration). |
There was a problem hiding this comment.
We can link to https://z2jh.jupyter.org/en/latest/resources/reference.html#singleuser-extrafiles instead
|
|
||
| - Create a new private key for authentication with the `Generate a private key` button. This should download a private key file, that you should keep secure and configure in the next step. | ||
|
|
||
| 1. Update `gitconfig` file with the following |
There was a problem hiding this comment.
Let's add a note about what the location of this is? In my experience this is the hardest. On JupyterHub, let's recommend /etc/gitconfig (for system-wide config), with a caveat that it needs to be $PREFIX/etc/gitconfig if you're using git from conda-forge (conda-forge/git-feedstock#113). This avoids the pitfall of people putting it in per-user git config for themselves (under ~/.gitconfig) and confused why it doesn't affect anyone else
There was a problem hiding this comment.
git can suggest the path via git config --system --list --show-origin, if there is some doubt, but @yuvipanda 's /etc/ and ${PREFIX}/etc/ suggestions are probably sufficient.
| Please do not include [personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#about-personal-access-tokens) in the nbgitpuller link, e.g. using a GitHub repo URL of the form `https://login:<TOKEN>@hostname/path.git`, since this is logged on the Jupyter server. Anyone with access to server can therefore see your private token. | ||
| ``` | ||
|
|
||
| If you would like to share content from a private repository, you can use [git-credential-helpers](https://github.com/yuvipanda/git-credential-helpers) to do so. |
There was a problem hiding this comment.
Though people can click through to read the description and code of git-credential-helpers, maybe it'd be useful to briefly describe what it is here? Something like: (from a comment in its code)
git-credential-helperslets git automatically create GitHub app installation tokens for interacting with private repos that have the GitHub app installed.
|
|
||
| - Create a new private key for authentication with the `Generate a private key` button. This should download a private key file, that you should keep secure and configure in the next step. | ||
|
|
||
| 1. Update `gitconfig` file with the following |
There was a problem hiding this comment.
git can suggest the path via git config --system --list --show-origin, if there is some doubt, but @yuvipanda 's /etc/ and ${PREFIX}/etc/ suggestions are probably sufficient.
|
I've made a few more edits to take into account the suggestions, so open for review again :) |
|
Hey @ryanlovett could you give this a glance over and let me know what you think? |
|
ty for your review, @ryanlovett |
3 participants
Ref #342