Hiding WLAN password when pushing to GitHub

Question

I have started to use GitHub to store Arduino code. However some of my code uses the SSID and password for my WLAN which I don’t want published.

A common way of handling this in non-embedded programming is to use a configuration file, but that doesn’t seem to be a viable approach in programming the Arduino. I’m currently just commenting out the sensitive information before pushing it to GitHub, but one day I’m sure I’ll forget.

Is there another – better - way of handling this?

Answer 1

Sure you can use a config file. It's called a "header" file, and you just #include it in your sketch.

[config.h (not pushed)]

const char *password = "DOD982yp398fhgpwbn09tupf0p04";

[sketch.ino (pushed)]

#include "config.h"

// Now you can use the password variable.

Another method, which is better if you have multiple files in your sketch, is to use #define instead of variables in your header file:

[config.h]

#define WIFI_PASSWORD "348r0yp80ytwp85tpj8yjp98y97t8t"

[sketch.ino]

#include "config.h"

const char *password = WIFI_PASSWORD;

Answer 2

You could commit the following file into your project, named credentials.h:

// Replace with your actual SSID and password:

#define WIFI_SSID "Your SSID here"
#define WIFI_PASSWD "WLAN AP password here"

Near the beginning of your sketch, you add:

#include "credentials.h"

const char ssid[] = WIFI_SSID;
const char password[] = WIFI_PASSWD;

Now, you can edit credentials.h to add your real SSID and password, and go on with your normal git workflow, with one exception: never git add credentials.h again, nor git commit -a.

Now, git will always remind you that credentials.h has been modified and is not staged for commit. It will do so even if you add the file to your .gitignore. If you always review your changes before committing, this is only a minor inconvenience. If, on the other hand, you tend to git commit -a without reviewing what you are committing, then this solution is likely not for you.

---

Edit: An idea I got from reading Chris Stratton's comments. If you use a Makefile in your own workflow (this has already been discussed in this site a few times), you could commit this credentials.h to your repo:

#ifndef CREDENTIALS_H
#define CREDENTIALS_H

// Replace with your actual SSID and password:
#define WIFI_SSID "Your SSID here"
#define WIFI_PASSWD "WLAN AP password here"

#endif

Make a copy of this file named true-credentials.h and put the real credentials there (but do not rename the include guard). Then add to your Makefile

CFLAGS += -include true-credentials.h

Keep true-credentials.h and the Makefile out of the repo. You can add them to your .gitignore or, better yet, to .git/info/exclude.

Now you have a compilable version with dummy credentials in the repository, you have the true credentials when you compile on your own machine, and git does not bother you about credentials.h being changed.

Answer 3

Building upon the shoulders of giants I took Edger Bonet's answer and used a slightly different twist. I went this route because I don't use a makefile and found this solution works well for me in my project.

I created a placeholder credentials.h file with the following info (Edger's answer).

#ifndef CREDENTIALS_H
#define CREDENTIALS_H

// Replace with your actual SSID and password:
#define WIFI_SSID "Your SSID here"
#define WIFI_PASSWD "WLAN AP password here"

#endif

I further added the reference to this new file in the .ino file.

#include "credentials.h"

const char ssid[] = WIFI_SSID;
const char pass[] = WIFI_PASSWD;

Now the twist.. I excluded the file from being checked for changes using the --assume-unchanged command.

git update-index --assume-unchanged credentials.h

You can then modify the credentials.h file and wont be prompted to add it to github.

Note, to re-check the file use --no-assume-unchanged.