Private pages for a private Github repo

Question

Couldn't find anything in the github documentation and also here on SO. But I was wondering if there could be a http://foo.github.com for a private repository named foo which is accessible only one had access to the foo repository itself.

I remember having read something about github pages always being public but can't seem to find that anymore.

And surprisingly, I can't seem to find anyone else asking the question either.

Torrell

I suppose then that not a lot of people are using Github for hosting private repos. Or at least, very few of those are using gh-pages. – Heirship

I think the correct answer should now be https://mcmap.net/q/108412/-private-pages-for-a-private-github-repo – Ladanum

private pages for enterprise users is now on the github roadmap – Glimp

Answer 1

I had raised a support ticket against Github and got a response confirming the fact that ALL pages are public. I've now requested them to add a note to help.github.com/pages.

Torrell

Does your pages repo have to be public in order for GitHub pages to work? – Irena

@Dennis: No, it doesn't - your repo can be private. But the published pages will be public and GitHub doesn't have a built-in way to restrict view access to allow only contributors on that private repo to see them. – Pinchhit

FYI it can be seen VERY CLEARLY here – Mcgruder

// , Access control is a very interesting issue for Github. I like that this is getting some attention, @kashyap! Thanks. – Skinny

Adding to @Derek Adair comments above. The site says: "Warning: GitHub Pages sites are publicly available on the internet, even if their repositories are private. If you have sensitive data in your Page repository, you may want to remove it before publishing." – Bobsleigh

You can try to use "Custom domain" option and add IP restriction to your firewall to have 'kind of' private pages. – Overtake

This answer is sadly out of date. You must upgrade to GitHub Pro. See https://mcmap.net/q/108412/-private-pages-for-a-private-github-repo – Ladanum

Ha. Well, it is out of date, but it actually takes an Enterprise account to publish a private site via GH Pages. "Access control for GitHub Pages sites is available in private repositories with GitHub Enterprise Cloud." docs.github.com/en/pages/getting-started-with-github-pages/… – Marino

Answer 2

According to GitHub Pages documentation:

All project repositories are ready to use the generator for publishing. However, please note that private repositories will publish pages that are public.

So no, at this time there is no way to create private GitHub pages from a private GitHub repository.

EDIT:

A simple workaround

A workaround for some situations that might be helpful is to simply rename the repo to something other than the GitHub pages format while you want it to be private (for example in a development phase) and when ready to make it public then correct the name. Obviously this still doesn't help if you are looking for a way to publish pages that have authentication, but if you just want to hide a GH pages project while it's in progress, this could help.

An actual Auth Wrapper for Jekyll (GitHub pages)

Alternatively, there is a project called Jekyll Auth that GitHubber @benbalter made for such use. Jekyll Auth provides a basic authentication wrapper for jekyll projects, including GitHub pages. See the repo's README for use.

Fibrin

It looks like that first link is old. help.github.com/articles/what-is-github-pages now has a similar warning. – Anemophilous

Answer 3

Many answers are outdated (pre-Microsoft acquisition/free private repos). This one was written after the announcement of free private repos.

Github pages are not available on free private repos for individuals, as shown in the repo settings:

2020 (most basic plan is now "Team"):

NOTICE

All pages are public, even if you upgrade. Upgrading only enables the Pages feature on private repos, just like it enables other features. The Pages feature is publicly available static web hosting.

Congregation

This is a bummer. The advertise with bells and whistles the free availability of private repos but they cut them down in functionality massively. – Mccombs

it says: Warning: GitHub Pages sites are publicly available on the internet, even if their repositories are private or internal. If you have sensitive data in your site's repository, you may want to remove it before publishing. so that means that if the repo is private, the page will still be visible but not the code, right? – Denote

@Denote - I believe that's accurate. The page will be public, not the code. – Congregation

downvoted as it's really important to note the warning that the page itself is still public – Glimp

Answer 4

This is finally possible for GitHub Enterprise Cloud customers: Access control for GitHub Pages.

To enable access control on Pages, navigate to your repository settings, and click the dropdown menu to toggle between public and private visibility for your site.

Pes

The 'Cloud' in 'GitHub Enterprise Cloud' is important here! I could not find this setting inside my company's Github Enterprise instance. See also the discussion at github.community/t/access-control-for-github-pages/156911/20 – Tribalism

Answer 5

The page.github.com does mention:

Github Pages are hosted free and easily published through our site,

Without ever mentioning access control.

The GitHub page help doesn't mention any ACL either.
They are best managed in a gh-pages branch, and can be managed in their own submodule.
But again, without any restriction in term of visibility once published by GitHub.

Frostbitten

Indeed. All pages are public. I got a response (on a support ticket) from github confirming this. – Torrell

Answer 6

There is an article with a working idea on how to request oAuth authorization before loading static content dynamically:

(archive.org) Securing Site That Runs on Github Pages With JSON Backend In Private Repository (original article that became 404)

Content should be stored in a secret GitHub repository with a viewer having read access to it. GitHub pages stores only the serving JS code.

Mcnair

This is much better than using hasdocs, because you don't need to give permission to your repo to untrusted third-party app. – Threap

Answer 7

As outlined above, Github pages do not support that functionality. I had the same issue when our team decided to host project documentation (static HTML) internally and privately.

I ended up creating a service https://www.privatehub.cloud It is basically a simple proxy server with Github OAuth authentication, so it merely returns your GitHub repository content with a proper MIME type. By design, only who have access to foo will be able to see foo content at https://bar-foo.privatehub.cloud. From functional point of view, you can think about it as a simplified GitHub pages with built-in authentication.

Unfortunately, Github OAuth does not allow to request read-only access to private repos, so the server needs the full access (obviously, it does not write anything to your repo). As GitHub API allows to retrieve files under 1 Mb only, the service cannot return larger files. Yet, I found the service is quite suitable for small projects for internal documentation or staging version of a website.

Oblivion

Note: this service is now dead (or potentially temporarily crashed) – Langsyne

Answer 8

Jan. 2021: this is now possible for GitHub Enterprise (so: not yet for github.com).
See:

Access control for GitHub Pages

GitHub Pages now gives you the option to limit access, making the site visible only to users with access to the repository that published the Page.

With access control, you can use GitHub Pages to publish and share internal documentation and knowledge across your enterprise.

As part of this release, we are introducing the following capabilities:

• Repo admins can select whether GitHub Pages sites are publicly visible or limited to users who have access to the repository.
• Both private and internal repositories support private visibility. With an internal repository, everyone in your enterprise will be able to view the Page with the same credentials they use to login to github.com
• Org admins can configure the visibility options that members will be able to select for their Page. For example, you can enforce that your members can only publish content privately.

This feature is generally available today on GitHub Enterprise Cloud.
To enable access control on Pages, navigate to your repository settings, and click the dropdown menu to toggle between public and private visibility for your site.

Frostbitten

Answer 9

So sad It's 2020 and we are not able to have private GithubPäges:

Kookaburra

Answer 10

As an alternative, it is currently possible to do exactly what the OP is asking to do, using GitLab, rather than GitHub. See docs for feature GitLab Pages access control. Since GitHub doesn't support this feature, if porting a project over to GitLab is not an issue, this is a good workaround.

Etna

Answer 11

If you press admin on a private repo and scroll down to the part about pages, it writes that it'll be public. I'll check later if .htaccess control or similar is possible, but I don't have much hope for it.

Agincourt

The .htaccess method doesn't work. If there's any useful suggestions let me know :) – Agincourt

I couldn't find anything either. I guess this issue is closed for now. – Torrell

Answer 12

This GitHub app: https://github.com/apps/priv-page allows users to have private pages for their private repositories.

Impress

Note, contributor j8r says to "likely shut down this service in the future" github.com/Priv-Page/privpage/issues/16#issuecomment-950392311 – Etna

Answer 13

You could host password in a repository and then just hide the page behind hidden address, that is derived from that password. This is not a very secure way, but it is simple.

Demonstration

Blessed