How I configure my Git identities

I do something similar, but instead of `insteadOf`, I just clone the repo with `gh-work:org&#x2F;repo`, and in the git config:<p><pre><code> [includeIf &quot;hasconfig:remote.*.url:gh-work:**&#x2F;**&quot;] path = ~&#x2F;.gitconfig.d&#x2F;gh-work.inc </code></pre> So, any git repo cloned with the ssh identity defined under `gh-work` will take on the config of `gh-work.inc`, which includes the git identity, and also the same signing key as in the ssh config.<p>Essentially, the name `gh-work` becomes the distinguishing element in both my ssh identity and my git identity, and I find this easier to think about.

One even-better approach IMHO<p>Just keep a <i>.gitconfig</i> in your <i>HOME</i> with aliases for your identities. Then just after initializing&#x2F;cloning the repo do <i>git config-company</i> or <i>git config-personal</i><p><pre><code> er453r@r7:~$ cat ~&#x2F;.gitconfig [user] useConfigOnly = true [alias] config-personal = !echo CONFIG-PERSONAL &amp;&amp; \ git config --local user.email &#x27;personal@email.com&#x27; &amp;&amp; \ git config --local user.name &#x27;personal&#x27; &amp;&amp; \ git config --local core.sshCommand &#x27;ssh -i ~&#x2F;.ssh&#x2F;id_rsa_personal&#x27; config-company = !echo OLD CONFIG-COMPANY &amp;&amp; \ git config --local user.email &#x27;official@comapny.io&#x27; &amp;&amp; \ git config --local user.name &#x27;Name Surname&#x27; &amp;&amp; \ git config --local core.sshCommand &#x27;ssh -i ~&#x2F;.ssh&#x2F;id_rsa_company&#x27;</code></pre>

I used to work at a startup with a character who would set his identity to be random fairytale-sounding nonsense, changing every day. So his commits on Monday would be attributed to Mr. Bunnymann, and Tuesday would be Doctor Funtime, etc.<p>It was super unhelpful when trying to do version control forensics. But if I&#x27;m being generous, I think maybe he was trying to remind everyone that anyone can put anything in their identity config, and we shouldn&#x27;t trust whatever is in there for all that much.

you don&#x27;t have to mess with ~&#x2F;.ssh&#x2F;config<p>Just put this in your ~&#x2F;.gitconfig (or ~&#x2F;.config&#x2F;git&#x2F;personal as in the article)<p><pre><code> [core] sshCommand = &#x2F;usr&#x2F;bin&#x2F;ssh -o IdentitiesOnly=yes -i ~&#x2F;.ssh&#x2F;IdentityFile2 -a </code></pre> This makes submodules easy without the `insteadOf`

I&#x27;ve been using `includeIf` with directory for ages (<a href="https:&#x2F;&#x2F;www.bobek.cz&#x2F;til&#x2F;git-identities&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.bobek.cz&#x2F;til&#x2F;git-identities&#x2F;</a>), the `hasconfig:remote` is really neat. And it also works when cloning the repository.

The includeIf stuff is pretty neat. I currently keep the SSH complexity in ~&#x2F;.ssh, where I have several includes, one for each customer|project|identity. Things without unique hostnames, like github, get an alias assigned:<p><pre><code> Host customer-github Hostname github.com IdentityFile ~&#x2F;.ssh&#x2F;customer_rsa User git </code></pre> All I have to do is use the alias in any git clone command and I&#x27;m done.

Thank you for this! I have exactly the same problem and was waiting for the solution to present itself, which it now has.<p>Aside: I use NixOS with home-manager (on linux and mac), which makes this trivial [1]. Added the following lines to my home-manager config:<p><pre><code> programs.git = { enable = true; ... includes = [ { condition = &quot;hasconfig:remote.*.url:git@github.com:&lt;work&gt;&#x2F;**&quot;; contents = { user.email = &quot;&lt;work email&gt;&quot;; }; } ]; } </code></pre> [1]: <a href="https:&#x2F;&#x2F;nix-community.github.io&#x2F;home-manager&#x2F;options.xhtml#opt-programs.git.includes" rel="nofollow">https:&#x2F;&#x2F;nix-community.github.io&#x2F;home-manager&#x2F;options.xhtml#o...</a>

So glad I clicked on this link. I was already doing the `includeIf: &quot;gitdir&quot;` thing to separate work and personal stuff, but `hasconfig:remote` is a total game-changer.

I always strongly advise consultants to use a separate machine for work, or at the very least a separate OS user.<p>You’re risking putting yourself in a whole lot of trouble by using a personal machine for work.

Shameless plug for a tool I developed in order to easily switch git identities based on projects: <a href="https:&#x2F;&#x2F;github.com&#x2F;cquintana92&#x2F;git-switch-user">https:&#x2F;&#x2F;github.com&#x2F;cquintana92&#x2F;git-switch-user</a><p>After configuring the identities you just need to run<p><pre><code> $ git su Personal $ git su Work </code></pre> And all the identity configuration (email, name, SSH key and optionally PGP key) will be set up into the repo&#x27;s .git&#x2F;config file.<p>Saved me a ton of time.

&gt; Note: I&#x27;ve had this post drafted for 3 YEARS!!! It&#x27;s finally time to publish it.<p>I suddenly felt a deep connection with the author. It is not only me.<p>I promise you, my dear drafts, that one day, I will set you free to see the world!

This is a nice trick. But if you:<p>* use a dedicated work machine and<p>* also want to version control your dotfiles (including ~&#x2F;.config&#x2F;git&#x2F;) and<p>* don&#x27;t want to leak your work repository organisation via your dotfiles,<p>you can instead add something like<p><pre><code> [include] path = work.gitconfig </code></pre> which will override any settings above it and also fail gracefully&#x2F;silently if work.gitconfig does not exist.

I prefer to split work and personal repos into ~&#x2F;dev for work and ~&#x2F;src for personal.<p><pre><code> # file ~&#x2F;.gitconfig [includeIf &quot;gitdir:~&#x2F;src&#x2F;&quot;] path = &#x2F;Users&#x2F;metabeard&#x2F;.config&#x2F;git&#x2F;.gitconfig-personal [includeIf &quot;gitdir:~&#x2F;dev&#x2F;&quot;] path = &#x2F;Users&#x2F;metabeard&#x2F;.config&#x2F;git&#x2F;.gitconfig-work </code></pre> and<p><pre><code> # file .config&#x2F;git&#x2F;.gitconfig-personal and .config&#x2F;git&#x2F;.gitconfig-work # both are very similar with different email and signingkey [user] name = Meta Beard email = email@metabeard.me signingkey = ssh-rsa xxx== [gpg] format = ssh [gpg &quot;ssh&quot;] program = &quot;&#x2F;Applications&#x2F;1Password.app&#x2F;Contents&#x2F;MacOS&#x2F;op-ssh-sign&quot; [commit] gpgsign = true</code></pre>

I&#x27;ve written a short blogpost about how to link SSH Keys to Git identities: <a href="https:&#x2F;&#x2F;brainfood.xyz&#x2F;post&#x2F;20241030-use-a-specific-ssh-key-in-a-git-repo&#x2F;" rel="nofollow">https:&#x2F;&#x2F;brainfood.xyz&#x2F;post&#x2F;20241030-use-a-specific-ssh-key-i...</a>

Why does the page redirect me periodically to <a href="https:&#x2F;&#x2F;www.benji.dog&#x2F;%F0%9F%8D%AA&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.benji.dog&#x2F;%F0%9F%8D%AA&#x2F;</a> and hide its content?

Is there a risk with not using different keys for work and personal?<p>The private bits are all in the same place: if one is compromised, so are the rest.

I use `insteadOf` instead of ssh alias because my workplace use GitLab orgs. So instead of typing the full URL like:<p><pre><code> git clone gitlab.com&#x2F;acme-corp&#x2F;project-name </code></pre> I could use:<p><pre><code> git clone work:project-name </code></pre> But this kinda broke `includeIf` since it store the `insteadOf` remote url directly. I then had to convert existing repositories to use the `insteadOf` url.<p>I wrote a little bit about it here: <a href="https:&#x2F;&#x2F;bentinata.com&#x2F;log&#x2F;git-insteadof-includeif" rel="nofollow">https:&#x2F;&#x2F;bentinata.com&#x2F;log&#x2F;git-insteadof-includeif</a>

&gt; Note: I&#x27;ve had this post drafted for 3 YEARS!!! It&#x27;s finally time to publish it.<p>Did you say that just so we could imagine the world where you published it earlier?<p>Thanks anyway, and nice site!

I love that Rek drew the image on your about page. I knew I recognized their work as soon as I saw it.<p>Based on that and your 1.44MB Club, you might find Neat CSS interesting. :P<p><a href="https:&#x2F;&#x2F;neat.joeldare.com" rel="nofollow">https:&#x2F;&#x2F;neat.joeldare.com</a><p>My Neat CSS websites will almost always fit on a floppy and I have a case of old floppies right here in my closet. The Neat CSS home page is only about 12k. Things get bigger when you start adding images, of course.

Somewhat annoying, that the configuration is spread out across 2 config files of 2 separate programs (git and ssh) and that the `insteadOf` `url` must match the `Host` in `.ssh&#x2F;config`, which leaves a lot of room for mistakes and is fiddly, but at least this method works well!<p>Edit: Hmm it seems to ask me over and over again for my password for a key at every pull or push. Maybe this method somehow disables memorizing the SSH identity?

I hated configuring multiple Hosts&#x2F;aliases in my ~&#x2F;.ssh&#x2F;config for Github&#x2F;Bitbucket when dealing with different keys for different clients.<p>I ended up creating a &quot;SSH environment&quot; manager 4 years ago to help with this: <a href="https:&#x2F;&#x2F;github.com&#x2F;theonejb&#x2F;sshenv">https:&#x2F;&#x2F;github.com&#x2F;theonejb&#x2F;sshenv</a><p>It&#x27;s worked wonderfully for me since then, and it&#x27;s something I use almost daily.

This post is a great reference of what’s possible with git config wrt includes&#x2F;remotes, and I’m sure I’ll be getting back to it.<p>One thing though: what’s the point of using separate keys for work&#x2F;personal&#x2F;github&#x2F;gitlab? I fail to see a practical and security advantage over using one key (per workstation).

Great tips, did not know about the `hashconfig:remote` option.<p>Currently dealing with a difficult setup where we have subrepos (so just using an `~&#x2F;.ssh&#x2F;config` alias for github.com:org does not work), some dependencies downloaded with CMake CPM, and working in a vscode devcontainer.

As cool as this is, how many peoples&#x27; employers allow them to do either personal work from the work computers, or work work from their personal computers? My company is quite strict on both.

This works well enough for me with minimal configuration<p><a href="https:&#x2F;&#x2F;github.com&#x2F;TheYkk&#x2F;git-switcher">https:&#x2F;&#x2F;github.com&#x2F;TheYkk&#x2F;git-switcher</a>

Why have multiple git identities in the same machine? I use a single different key with each machine and that&#x27;s it.

Be careful what client you use, though. JGit unfortunately still doesn’t support <i>includeIf</i>.

I really liked the website, the layout, typography, icons etc. Really well done!

user.useconfigonly=true can also help

Eh, if I need a different identity[1], I just use a different identity[2] (ideally different machine or host when feasible).<p>I&#x27;m not a fan of mixing identities, like for example mixing a personal identity[2] with a work identity[1].<p>[1]: Git.<p>[2]: OS user.