Push Oxidized Git Commits to Remote GitLab with Post-Receive Hook

This setup wires Oxidized's local git output to a remote GitLab repository using a post-receive hook that pushes every new commit upstream. The hook script runs after each commit in the local bare repo, reads the list of new refs from stdin, and executes git push to the configured remote. Internally git invokes hooks/post-receive with the old and new SHA for each ref, and the script uses git --git-dir to push the master branch to origin. This gives you off-host durability and enables GitLab's diff, blame, and merge request features on network configs.

In production this pattern is common for organizations that want a single source of truth for infrastructure-as-code alongside application code. GitLab CI can then run policy checks on every config change, such as verifying that no plaintext passwords were introduced or that NTP servers match the standard. Compliance teams get a tamper-evident audit trail with GitLab's immutable commit history and access controls.

Security implications are major: the remote repo contains sensitive device configs, so it must be private, and the push must use SSH with a dedicated deploy key that has write access to only that project. Never store the private key in the hook script; use a passphrase-less key with restricted permissions or a GitLab project access token scoped to write_repository. Performance is fine for hourly pushes, but large configs can make the initial push slow; run git gc on the local repo monthly. A common pitfall is a non-executable hook file or a missing shebang, which causes silent failures; always chmod +x and test with a manual push first. Also ensure the oxidized user's SSH known_hosts includes GitLab's host key to avoid interactive prompts.

> System.Execute()

#!/bin/bash
# /srv/oxidized/git/network-configs.git/hooks/post-receive
set -euo pipefail
GIT_DIR=/srv/oxidized/git/network-configs.git
REMOTE=git@gitlab.example.com:netops/network-configs.git

export GIT_SSH_COMMAND="ssh -i /home/oxidized/.ssh/gitlab_deploy -o StrictHostKeyChecking=yes"

while read -r oldrev newrev refname; do
  echo "Pushing $refname ($oldrev -> $newrev) to $REMOTE"
  git --git-dir="$GIT_DIR" push "$REMOTE" "$refname"
done

# Make executable and test
chmod +x /srv/oxidized/git/network-configs.git/hooks/post-receive
sudo -u oxidized git --git-dir=/srv/oxidized/git/network-configs.git push git@gitlab.example.com:netops/network-configs.git master

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-B5AAA0E908D0