Git-based website deployment workflow

Question

On my server, I have two users, www-data (which is used by nginx) and git. The git user owns a repository that contains my website's code, and the www-data user owns a clone of that repository (which serves as the webroot for nginx). I want to set up a workflow such that pushing to git's repository causes www-data's repository to update, thus updating my website.

What is the correct way to set up the hooks for these repositories (that also takes into consideration privileges and permissions of these two users)?

Answer 1

Remove the repository owned by www-data and follow the solution on this webpage for setting up a post-receive hook in the repository owned by git.

Answer 2

I ended up making the public content owned by the git user, and readable by all. Then, I did the following to set up the hooks:

Assuming the repository is called mysite:

1. Create a detached work tree that will act as the webroot (as the user git)

   mkdir /var/www/mysite
   cd /path/to/repository/mysite.git
   git config core.worktree /var/www/mysite
   git config core.bare false
   git config receive.denycurrentbranch ignore
   

2. Add a post-receive hook that will update the website and set correct permissions for it

   touch hooks/post-receive
   chmod +x hooks/post-receive
   vim hooks/post-receive
   

   The post-receive script:

   #!/bin/sh
   git checkout -f
   chmod -R o+rX /var/www/mysite
   

Reference:
http://www.deanoj.co.uk/programming/git/using-git-and-a-post-receive-hook-script-for-auto-deployment/

---

Update: Here is a better solution.

Note: earlier versions of this howto depended on setting the git config variables core.worktree to the target directory, core.bare to false, and receive.denycurrentbranch to ignore. But these changes are not needed if you use GIT_WORK_TREE (which didn't work when I first wrote the howto), and the remote repository can remain bare.