Netlify Identity is being deprecated, what does the future of it's use with Decap and Git Gateway look like?

[TheNickOfTime]

I use Decap on a number of websites that I deploy for clients via Netlify. The integration with Netlify Identity, and more importantly with Git Gateway has made allowing clients to easily update the content on their websites a breeze. I was super bummed to log into my Netlify dashboard to see that Identity (which Git Gateway is a part of) is being deprecated.

As you can see, there is no intent for removing the feature outright right now, which is fine for the short term, but this has other implications. First of all, I don't trust when they say it that Identity will be around indefinitely - you deprecate something because you intend on getting rid of it eventually. Second of all, this means that there will be no updates/maintenance for Identity or Git Gateway from Netlify moving forward (it's been 9 months since the last Git Gateway update). Presumably at some point something could change with GitHub, for example, and everything will stop working - not to mention security issues. Finally, I don't get the impression (I need to look into it more though) that their alleged replacement, the Auth0 extension, offers functionality similar to Git Gateway (Auth0 is a third party service, by Okta I believe).

I guess potentially losing Git Gateway is the big concern for me, because it is the only relatively streamlined & affordable method I had found to authenticate CMS users for a static site without them needing something like a GitHub account (mom and pop shop down the street don't/won't have one, that's why they hire me in the first place). I know you can use Git Gateway without Netlify, but I think it's obvious that spinning up and maintaining authentication servers is not the next best option for most people using Identity + Git Gateway.

So I'm kind of wondering what the future of Netlify Identity and Git Gateway are looking like for this project? It is clear when you read the docs that the Identity + Git Gateway combo are basically the recommended way of doing things currently. I love this project and my current setup for using Decap with Netlify Identity + Git Gateway is truly unbeatable. As time goes on though, I am going to grow less okay with using something that has been deprecated. I imagine new users will not be okay from the get go using something that has been deprecated. Would love to hear anybody's thoughts/solutions/alternative on the matter, especially from the devs!

Thank you in advance 😁,
Nick

[martinjagodic]

@TheNickOfTime thanks for expressing your concern. Yes, Decap is basically married to Netlify Identity, and as maintainers, we are aware that a divorce is long overdue.

Since Netlify moved to auth0, we will also update our guides to recommend the new approach.

There is no timeline for this as this is a non-funded open-source project. We gladly accept contributions if anyone would like to speed up the process.

This will become our priority as soon as we merge some open PRs. In the meantime, I invite everyone to contribute to this discussion with ideas on moving away from Netlify.

[martinjagodic]

Task for integrating Auht0 here: #7420

[pspizzo]

Good day, all. I just submitted a PR that should help to separate the dependency of the git-gateway back-end on the Netlify Identity authentication. It adds optional PKCE support to the git-gateway backend, so any OAuth2 PKCE provider can be used for authentication with git-gateway. Here is my PR: #7439

This solves half of the problem, in my opinion -- git-gateway still needs to be runnable in a serverless environment (or at least without needing a database). But please take a look at my PR and see if you think it's a good start on using other authentication providers. I haven't specifically used Auth0, but I expect they fully support PKCE, so this could help out with that solution, too.

Note: this solution assumes you're using a custom git-gateway that is configured to recognize bearer tokens from your configured issuer. That's my next task, to see if I can get that up and running.

[TheNickOfTime]

Thank you for your response!

In terms of moving away from Netlify, I would take a look at how competitors are handling things. From my research looking into Git-based headless CMS options, the only other reasonably developed option was TinaCMS. Aside from DecapCMS, this was the one standout option that allows functionality similar to Git Gateway - authenticating users that aren't contributors to your repo. The way they achieve this (without Netlify Identity as a convenient backend) is interesting - they provide a paid cloud service for easy deployment, but you can also self-host the components of that cloud service. The tricky part seems to, of course, be authentication. With Tina, it seems you can 'self-host' a backend via Netlify Functions or similar, but by default they rely on an external database for authorizing users via Auth.js.

Obviously the architecture of Decap vs Tina are probably quite different, but I think the need to 'self-host' certain aspects in the absence of Netlify Identity is unavoidable. In terms of achieving the most with the least amount of work, I wonder about the feasibility of 'self-hosting' Git Gateway in Netlify functions and integrating it with something like Auth0 for authentication. I don't know much about Go, which is what Git Gateway appears to be written in, but it seems from preliminary research that Netlify Functions does support Go.

I'll try to spend some time today determining if it is possible or not to run Git Gateway in a serverless functions environment. If this is possible, perhaps a good way forward is simply more robust docs on setting up Git Gateway without Netlify in common serverless environments, and having a recommended Auth service (likely one with a good free tier) that can issue JWTs to a serverless instance of Git Gateway.

Of course the Git Gateway project is likely abandoned by Netlify, so other solutions may be necessary in the long term. While it is open sourced, the question of "who is going to fork and maintain it?" is relevant, since as you said Decap is a non-funded project, and I imagine already starved of ideal time and resources.

[bewuethr]

There's also Pages CMS: they run a hosted auth option for you, but provide instructions to deploy to Vercel yourself, or self-host. The limitation is that only GitHub is supported currently, but as a GitHub user, the experience was super smooth.

[TheNickOfTime]

I was able to get Git Gateway running locally as a Netlify Function via npx netlify dev. I made some modifications to the main.go file of Git Gateway, and managed to get it to run for 2 seconds before manually quitting and returning a success response 2 seconds later. Relevant code is here, keep in mind I have no idea what I'm doing in Go, so I'm sure this is attrocious.

I ran into issues with function errors deploying on Netlify because it needs access to a sqlite database, and as far as I can tell the way they have their orm configured doesn't work with a network sqlite db, like from Turso. Bit of a half success, but seems like it is plausible.

[pspizzo]

So, I don't know Go at all, either, so I spent some time and threw together a rough Node.js implementation of git-gateway that runs on AWS Lambda (serverless). It also currently does not use any database -- user assignments to repos are done through environment variables in the Lambda, although it could be improved in the future if more data is needed to be stored per user. So far, I only added Bitbucket support, but including Github/Gitlab shouldn't be too hard, since most of the work of the application is proxying the request directly to the vendor API. It would just be a matter of adding the correct proxy paths in the code.

The code is here, along with instructions for setting it up. MIT license, so free to use.

[martinjagodic]

We already had an idea of a paid cloud service you can self-host because it's also a way to fund the project.

Yes, git gateway seems abandoned. I believe Decap is the largest user, so it would make sense for us to fork it if we decide to use it in the future. If we can get it to run in a serverless environment, it's at least a temporary solution. In the long run, we have to determine if it's reliable enough.

[adamdjbrett]

I would gladly pay a monthly fee to suppor this project if the fee was setup where you pay X and you can use it on a large number of sites like 15-25+.

[Mr0grog]

I have a client who is overhauling their site and would like to continue using Decap, but the status of this auth situation is a major concern. Having a paid option that also helps support the project would be really great for them (most of the other CMS options we are evaluating are paid).

[loteoo]

A bit late to the party but I think I need to share that I've been slowly developing DecapBridge, a fully-featured auth solution specifically for DecapCMS.

It's been up for nearly a year now with hundreds of sites using it. I must admit new features development has been slower over the winter, but I'm still planning to complete the current roadmap, hopefully by the end of this summer, which includes an open-sourced self hosted version. The cloud version will always remain free for small sites (<10 users), but I'm planning an enterprise version to help support development and continue the free hosted service for smaller orgs.

When I started this last year, I did not know Netlify was going to deprecate Netlify Auth, so it was more meant as a "additional option" for DecapCMS and a smoother experience for my clients. Now that Netlify Auth is slowly stepping away, it seems it could become a bigger Open-Source solution for everyone to benefit from.

[samf01]

Seems like a game changer to me! I am trying to get it to work with an existing netlify site, but in spite of adding the backend config, to config.yml, the 'login' button still goes to netlify identity? Even if I disable Netlify identity, it still tries, is there a setting somewhere that is overriding backend config?