Tracking changes to configuration.
WHY IT APPLIES TO SERVERS
Configuration changes, and knowing what changed is most of diagnosis.
WHAT TO TRACK
Web server configuration Service configuration Scripts Scheduled task definitions Documentation
WHAT NOT TO TRACK
Secrets, unless encrypted Large binary data Anything generated
WHAT THE SIMPLEST APPROACH IS
A repository holding copies of the files, committed after every change.
WHAT THAT PROVIDES
A history The ability to see what changed The ability to restore a previous version
WHAT TO COMMIT WITH
A message stating why, not what.
WHY
The change itself is visible; the reason is not.
WHAT DEPLOYING FROM VERSION CONTROL PROVIDES
Consistency between environments A record of what is running
WHAT TO BE CAREFUL WITH
A repository directory exposed through the web server.
WHY THAT IS SERIOUS
It can expose the entire history, including credentials committed by mistake.
WHAT TO DO
Keep it outside the document root, or deny access to it explicitly.
WHAT TO CHECK ON ANY SERVER
Whether such a directory is reachable publicly.
WHAT TO DO ABOUT SECRETS ALREADY COMMITTED
Rotate them, since history is permanent.
