

Ask HN: Would you store basic server information in your GitHub repository? - yllus

A few weeks ago, I mentioned offhandedly to our Operations team that for each website our developers work on, we create a README.md file geared towards allowing anyone to jump in and have a chance in hell of debugging a critical issue.<p>What that means in concrete terms is that the README.md file lists:<p>A) The hostnames of each Nginx server used for that site<p>B) The hostname(s) of the MySQL servers used<p>C) The memcached server hostname and port<p>D) The document root folder the website runs at<p>E) The path to the error and access logs for that site<p>Yesterday I received an e-mail from the head of Operations requested that I take that information out of GitHub and place it on our internal corporate wiki. The rationale was that &quot;this information resides on a third-party system that details out information that could be easily used to penetrate our systems.&quot;<p>I replied back that I&#x27;d remove information about the database (passwords were never listed) completely, but as we dole out work to outside vendors, and our corporate wiki cannot be accessed externally without VPN, I wasn&#x27;t willing to remove basic hostname or path information and add a step or two to basic understanding of the system without good reason. As we trust 100% of our intellectual property (code) to GitHub, getting a list of hostnames by accessing our repositories is to me the least of our concerns.<p>I am wrong to not comply with the request?
======
diminish
Is the repository public? In this case there may be security risks, and a
cracker may end up guessing clues about your internal network and
infrastructure architecture.

~~~
yllus
It's private. Sorry, that's sort of pertinent information.

