Install, configure, and maintain content for Ubuntu webserver I made a script for my Ubuntu server(s) running on Google Cloud Platform. The idea behind it is I can create a new instance and paste this script in Google Cloud so it runs it on the new instance and every time it reboots. The script works, so no problem there.

The idea is that it installs all the required software to run my website the first time it boots up and then clones my git repository to /var/www/html/. Every other time it boots it only updates the software and then pulls the changes from the git repository.

My questions:


From what I understand, it's not very wise to put your git password in the startup script but I know no other way to automate this fully. Can this be done in another way while keeping it fully automated?
Cloning the git repository gave an error about the folder not being empty so I just deleted it upfront. It works now but I am not sure if that's the way to go ...


Here is my startup script:

file="/var/www/check.txt"

if [ -e $file ]
then
sudo apt-get update
sudo git -C /var/www/html pull https://username:password@bitbucket.org/username/repository.git
else
sudo apt-get update
sudo apt-get install apache2 libapache2-mod-php5 php5-mcrypt php5-mysql git -y
sudo cat &lt;&lt;EOF &gt; /etc/apache2/mods-enabled/dir.conf
&lt;IfModule mod_dir.c&gt;
        DirectoryIndex index.php index.cgi index.pl index.html index.xhtml index.htm
&lt;/IfModule&gt;

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
EOF
sudo rm -rf /var/www/html
sudo git clone https://username:password@bitbucket.org/username/repository.git /var/www/html/ /var/www/html/
sudo cat &lt;&lt;EOF &gt; /var/www/check.txt
aanwezig!
EOF
fi
So, this might not be quite in line with your 100% automation approach, but the best way to provide a shell script access to a git repository is to use ssh keys to allow access to your git repository. Of course, this means you either need to log on and set up that key and grant access it to Git  (goodbye 100% automation) or securely copy a private key that already has access to the repository to your server. You'll probably want to keep that key someplace that requires a password to access it, so... chicken and the egg scenario. Unless your cloud provider gives you the ability to create a template that already has that key on it's file system when it's created. If you can do that, then you definitely want to go the ssh route.

Your clone would look something like this.

git clone ssh://username@bitbucket.org/username/repository.git




Okay, let's review your code now.


You're using sudo very liberally. It would be better to set file permissions appropriately. You can run into weirdness when using sudo along with git. You can end up with a repository on the file system owned by root and.. it can get messy.
There's no error handling what so ever. If any given step of your script fails, it will continue on trying to execute the next line. 
If you needed to change the location of the repository, you'd need to change the /var/www/html string in 3 different places. If your repository changes locations, it would change in 2. Use variables appropriately.