How do you hide .git project directories?
Now that I have nginx setup I need to be able to hide my .git
directories. What kind of rewrite would I need to stop prying eyes? And where in the server {}
or http {}
block would it go?
Solution 1:
http {
server {
location ~ /\.git {
deny all;
}
}
}
This location
directive will deny access to any .git
directory in any subdirectory.
Note: This location block must be before your main location block, so that it can be evaluated first.
Solution 2:
Hidden directories and files should never be web accessible. The general answer to your question is:
location ~ /\. { return 403; }
This denies access to .git, .svn, .htaccess and similar files in any subdirectory.
Solution 3:
With other solutions I could download /.git/config
and others, just /.git
was protected. This one denies everything starting with a dot, regardless how deep the requested URL is:
location ~ /\.(.*)/?(.*)? {
return 404;
}