Skip to content

Commit 9eff6b4

Browse files
authored
Revert "Make a section for the tribal knowledge contained in the schema files" (#1232)
Reverts #1216 We're not going to need these sections now with an improved schema marshalling logic introduced here: sourcegraph/sourcegraph#6369
1 parent 2129714 commit 9eff6b4

File tree

13 files changed

+1
-1641
lines changed

13 files changed

+1
-1641
lines changed

docs/admin/code_hosts/aws_codecommit.mdx

Lines changed: 0 additions & 125 deletions
Original file line numberDiff line numberDiff line change
@@ -114,131 +114,6 @@ To add CodeCommit repositories in Docker Container:
114114
}
115115
```
116116

117-
## Configuration Notes
118-
119-
### Git Credentials Requirement
120-
AWS CodeCommit **requires** Git credentials for HTTPS authentication since Sourcegraph version 3.4:
121-
- Git credentials consist of a username and password generated in AWS IAM
122-
- These are different from your regular AWS access keys
123-
- Follow the [AWS Git credentials setup guide](https://docs.aws.amazon.com/codecommit/latest/userguide/setting-up-gc.html) for detailed instructions
124-
125-
### Repository Path Patterns
126-
The `repositoryPathPattern` field allows customization of repository URLs within Sourcegraph:
127-
- Default pattern: `"{name}"` results in URLs like `src.example.com/myrepo`
128-
- Region-specific pattern: `"git-codecommit.us-west-1.amazonaws.com/{name}"` for better organization
129-
- Ensure patterns generate unique repository names to avoid conflicts
130-
131-
### Authentication Methods
132-
AWS CodeCommit supports both HTTPS and SSH authentication:
133-
- **HTTPS**: Uses Git credentials (username/password) - recommended for simplicity
134-
- **SSH**: Uses SSH key pairs - requires additional key management setup
135-
136-
## Security Considerations
137-
138-
### IAM Permissions
139-
- The AWS access key must have the **AWSCodeCommitReadOnly** IAM policy attached minimum
140-
- Consider using more restrictive custom policies that limit access to specific repositories
141-
- Never use root account credentials - create dedicated IAM users for Sourcegraph
142-
143-
### Credential Storage
144-
- Store AWS access keys and secrets securely using Sourcegraph's secret management
145-
- For SSH setups, ensure private keys are base64 encoded and properly secured
146-
- Regularly rotate AWS access keys according to security best practices
147-
148-
### Network Access
149-
- Ensure Sourcegraph can reach AWS CodeCommit endpoints in your configured region
150-
- Consider VPC endpoints for private network access to CodeCommit
151-
- Review AWS CloudTrail logs for monitoring repository access
152-
153-
### SSH Key Security
154-
- Generate SSH keys without passphrases for automated access
155-
- Store private keys securely and base64 encode them for configuration
156-
- Regularly rotate SSH keys and update configurations accordingly
157-
158-
## Common Examples
159-
160-
### Basic HTTPS Configuration
161-
```json
162-
{
163-
"accessKeyID": "AKIA...",
164-
"secretAccessKey": "your-secret-key",
165-
"region": "us-east-1",
166-
"gitCredentials": {
167-
"username": "git-username",
168-
"password": "git-password"
169-
},
170-
"repositoryPathPattern": "{name}"
171-
}
172-
```
173-
174-
### Region-Specific Setup
175-
```json
176-
{
177-
"accessKeyID": "AKIA...",
178-
"secretAccessKey": "your-secret-key",
179-
"region": "eu-central-1",
180-
"gitCredentials": {
181-
"username": "git-username",
182-
"password": "git-password"
183-
},
184-
"repositoryPathPattern": "git-codecommit.eu-central-1.amazonaws.com/{name}"
185-
}
186-
```
187-
188-
### SSH Configuration
189-
```json
190-
{
191-
"accessKeyID": "AKIA...",
192-
"secretAccessKey": "your-secret-key",
193-
"region": "us-west-1",
194-
"gitURLType": "ssh",
195-
"gitSSHKeyID": "APKA...",
196-
"gitSSHCredential": {
197-
"privateKey": "LS0tLS1CRUdJTi...",
198-
"passphrase": ""
199-
}
200-
}
201-
```
202-
203-
### Selective Repository Sync
204-
```json
205-
{
206-
"accessKeyID": "AKIA...",
207-
"secretAccessKey": "your-secret-key",
208-
"region": "us-east-1",
209-
"gitCredentials": {
210-
"username": "git-username",
211-
"password": "git-password"
212-
},
213-
"exclude": [
214-
{"name": "internal-temp-repo"},
215-
{"name": "archived-project"}
216-
]
217-
}
218-
```
219-
220-
## Best Practices
221-
222-
### Performance and Reliability
223-
- **Regional Deployment**: Deploy Sourcegraph in the same AWS region as your CodeCommit repositories for optimal performance
224-
- **Repository Exclusion**: Use the `exclude` field to avoid syncing temporary or archived repositories
225-
- **Connection Monitoring**: Regularly verify that your AWS credentials remain valid and have appropriate permissions
226-
227-
### Operational Management
228-
- **Credential Rotation**: Implement regular rotation of AWS access keys and Git credentials
229-
- **Monitoring**: Set up CloudWatch alarms for CodeCommit API usage and authentication failures
230-
- **Backup Strategy**: Ensure your repository syncing strategy aligns with your backup and disaster recovery plans
231-
232-
### Deployment Considerations
233-
- **Docker Deployments**: For SSH setups, properly mount SSH configuration files into containers
234-
- **Kubernetes Deployments**: Use secrets for credential management and configure SSH access appropriately
235-
- **Container Restart**: Plan for service restarts when updating SSH keys or credentials
236-
237-
### Migration and Setup
238-
- **Testing**: Always test your configuration with a small subset of repositories first
239-
- **Documentation**: Document your repository path patterns and credential management processes
240-
- **Access Validation**: Verify Sourcegraph can access all intended repositories before full deployment
241-
242117
### Mounting SSH keys into the container
243118

244119
1. Copy all the files at your `$HOME/.ssh directory` to `$HOME/.sourcegraph/config/ssh` directory. See [docs](/admin/deploy/docker-single-container/#ssh-authentication-config-keys-knownhosts) for more information about our ssh file system.

docs/admin/code_hosts/azuredevops.mdx

Lines changed: 0 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -129,111 +129,6 @@ Azure DevOps connections support the following configuration options, which are
129129
```
130130
{/* SCHEMA_SYNC_END: admin/code_hosts/azuredevops.schema.json */}
131131

132-
## Configuration Notes
133-
134-
### Token Requirements
135-
- Personal Access Token must have **All accessible organizations** scope to support connection checks and multi-organization syncing
136-
- Required scopes: Code (Read), Project and Team, User Profile
137-
- Consider creating a dedicated service account with minimal required permissions for production deployments
138-
139-
### Organization Access
140-
Azure DevOps connections support both organization-level and project-level syncing:
141-
- Use `"orgs": ["org1", "org2"]` to sync all repositories from specific organizations
142-
- Use `"projects": ["org1/project1", "org2/project2"]` for granular project-level control
143-
- Both options can be combined in a single configuration
144-
145-
### Repository Exclusion
146-
The `exclude` configuration supports both exact name matching and pattern-based exclusion:
147-
- Exact match: `{"name": "myorg/myproject/myrepo"}`
148-
- Pattern match: `{"pattern": "^topsecretproject/.*"}`
149-
150-
## Security Considerations
151-
152-
### Access Control
153-
- **Permissions Enforcement**: Set `"enforcePermissions": true` to sync user-level access controls from Azure DevOps
154-
- **OAuth Configuration**: Required for permission syncing - users must authenticate with Azure DevOps OAuth
155-
- **Third-party OAuth**: Must be enabled in Azure DevOps organization settings under Security → Policies
156-
157-
### Credential Management
158-
- Store Personal Access Tokens securely using Sourcegraph's secret management
159-
- Regularly rotate tokens according to your organization's security policies
160-
- Use dedicated service accounts rather than personal user accounts for production
161-
162-
### Network Security
163-
- Ensure HTTPS-only communication by using `"gitURLType": "http"` with HTTPS URLs
164-
- For SSH access, properly manage SSH keys and known_hosts configuration
165-
- Configure firewall rules to allow Sourcegraph access to Azure DevOPS endpoints
166-
167-
## Common Examples
168-
169-
### Basic Organization Sync
170-
```json
171-
{
172-
"url": "https://dev.azure.com/",
173-
"username": "service-account",
174-
"token": "your-personal-access-token",
175-
"orgs": ["your-organization"],
176-
"gitURLType": "http"
177-
}
178-
```
179-
180-
### Multi-Project Configuration
181-
```json
182-
{
183-
"url": "https://dev.azure.com/",
184-
"username": "service-account",
185-
"token": "your-personal-access-token",
186-
"projects": [
187-
"org1/frontend-project",
188-
"org1/backend-project",
189-
"org2/shared-libraries"
190-
],
191-
"exclude": [
192-
{"name": "org1/legacy-project"},
193-
{"pattern": "^.*/archived-.*"}
194-
]
195-
}
196-
```
197-
198-
### SSH Configuration
199-
```json
200-
{
201-
"url": "https://dev.azure.com/",
202-
"username": "service-account",
203-
"token": "your-personal-access-token",
204-
"orgs": ["your-organization"],
205-
"gitURLType": "ssh"
206-
}
207-
```
208-
209-
### Permissions-Enabled Setup
210-
```json
211-
{
212-
"url": "https://dev.azure.com/",
213-
"username": "service-account",
214-
"token": "your-personal-access-token",
215-
"orgs": ["your-organization"],
216-
"enforcePermissions": true
217-
}
218-
```
219-
220-
## Best Practices
221-
222-
### Performance Optimization
223-
- **Selective Syncing**: Use `projects` instead of `orgs` when you only need specific repositories
224-
- **Exclude Patterns**: Use exclusion patterns to avoid syncing unnecessary repositories like archived projects
225-
- **Rate Limit Awareness**: Sourcegraph automatically handles Azure DevOps rate limits, but consider the impact on large organizations
226-
227-
### Maintenance
228-
- **Regular Token Rotation**: Implement a process for rotating Personal Access Tokens
229-
- **Monitor Sync Status**: Regularly check repository sync status in the Site Admin interface
230-
- **Permission Sync Monitoring**: For permission-enabled setups, monitor user permission sync completion
231-
232-
### Troubleshooting
233-
- **Connection Issues**: Verify token permissions and organization access settings
234-
- **Missing Repositories**: Check exclude patterns and ensure the token has access to all target organizations/projects
235-
- **Permission Problems**: Verify OAuth is properly configured and Third-party application access is enabled
236-
237132
## Webhooks
238133

239134
Please consult [this page](/admin/config/webhooks/incoming) in order to configure webhooks.

0 commit comments

Comments
 (0)