DataMasque Portal

Git Integration Setup

This guide walks you through setting up DataMasque's Git integration end-to-end, so you can push and pull ruleset and ruleset library YAML to and from a remote Git repository. It is aimed at first-time setup — for the underlying reference pages, see Git Repository Settings, Git SSH key information, Push/Pull a ruleset, and Push/Pull a library.

Audience and prerequisites

This guide is for Admin and Mask Builder users. Other roles cannot manage Git integration in DataMasque.

DataMasque connects to remote Git repositories over SSH only.

Before you start, you need:

  • A reachable Git repository at one of the supported providers.
  • An SSH key pair (created in Step 1 if you don't have one).
  • A DataMasque user with the Admin or Mask Builder role. Configuring repository-wide settings in Step 4 additionally requires an Admin user.

Tip: Follow the steps in order. Uploading your SSH key before saving the repository URL lets DataMasque validate the SSH connection at save time, so you get immediate feedback if something is wrong.

Step 1: Generate an SSH key pair

If you already have a key pair you want to use with DataMasque, skip to Step 2.

Otherwise, generate one on your local machine:

ssh-keygen -t ed25519 -C "datamasque@yourcompany.com"

If your Git provider does not yet support Ed25519 keys, use RSA instead:

ssh-keygen -t rsa -b 4096 -C "datamasque@yourcompany.com"

This creates two files (defaults shown):

  • ~/.ssh/id_ed25519 (or ~/.ssh/id_rsa) — the private key. This goes to DataMasque.
  • ~/.ssh/id_ed25519.pub (or ~/.ssh/id_rsa.pub) — the public key. This goes to your Git provider.

Tip: Consider creating a dedicated SSH key pair for DataMasque rather than reusing a personal key, so it can be rotated or revoked independently.

Step 2: Upload the private key to DataMasque

Each user who needs to push or pull rulesets uploads their own SSH private key.

  1. Sign in to DataMasque and choose My Account from the main menu.
  2. In the Git SSH key information panel, upload the private key file (e.g. id_ed25519 or id_rsa).

For the full UI walkthrough — including screenshots and how to replace or delete a key — see Uploading a Git SSH key.

Important: Upload the private key (e.g. id_ed25519), not the public key (e.g. id_ed25519.pub). The public key goes to your Git provider in Step 3.

Note: Git SSH key management is only available for Admin and Mask Builder users, and each user can store one key.

Step 3: Add the public key at your Git provider

Add the contents of your public key file (*.pub) to your account at the Git provider. Pick your provider below for the SSH URL format and any provider-specific notes in Git Provider Setup, then follow the provider's own documentation to attach the public key:

Note: The public key you add at the provider must be the counterpart of the same private key you uploaded in Step 2. Mismatched key pairs are the most common cause of Permission denied errors.

Step 4: Configure Git Repository Settings

This step requires an Admin user.

  1. Sign in as an Admin user and choose Settings from the main menu.
  2. In the Git Repository Settings panel, click the Edit button to edit the configuration.
  3. Fill in:
    • Repository URL — the SSH URL of your repository, in the format shown for your provider in Git Provider Setup.
    • Branch Name — the branch to push to and pull from. Leave blank to auto-detect the default branch.
    • Directory Path — the path within the repository to store rulesets. Leave blank for the repo root.

For the full parameter reference, see Git Repository Parameters.

Tip: If you uploaded your SSH key in Step 2 already, saving these settings validates the SSH connection. A save error here usually means the public key isn't on the provider yet, the URL is wrong, or the branch doesn't exist.

Step 5: (Optional) Set a per-user Git directory

By default, every user pushes to and pulls from the directory configured in Settings. If individual users need their own directory — for example, to keep work-in-progress rulesets separate — they can override it on the My Account page.

See Git Directory information for the full UI walkthrough.

Note: Per-user Git directories are only available for Admin and Mask Builder users.

Step 6: Push or pull a ruleset or library

You are now set up. The same integration works for both rulesets and ruleset libraries, and each ruleset or library is managed independently as its own Git unit.

To verify the integration end-to-end, push a ruleset:

  1. Open any ruleset in the editor (or create a new one) and make sure it has a name.
  2. Click the Git button to open the Push/Pull Ruleset dialog, and navigate to the Push tab.
  3. Enter a commit message and click the Push button.

For the full push/pull UI — including pulling a specific commit, file extensions, and the file path layout — see:

  • Push/Pull a ruleset — rulesets are written to the configured directory path as {ruleset_name}.yml.
  • Push/Pull a library — libraries are written under a libraries/ directory and the library's namespace becomes the folder structure (e.g. libraries/pii/emails.yml).

A successful push (or pull, if there are already files in the repository) confirms that the SSH key, public-key registration at the provider, and the repository settings are all correct.

Audit trail

Every ruleset push or pull stores a Git snapshot on the ruleset (branch, commit, file path, and repository URL), and the same snapshot is recorded on every masking run when the run starts. This gives you a per-run record of which Git commit produced the ruleset used.

For details and the per-run Git Snapshot panel, see Git audit trail.

Troubleshooting

A few common failure modes and where to look:

  • SSH connection refused / could not resolve host — Your DataMasque instance can't reach the Git host on port 22 (or your provider's custom SSH port). Check network/firewall rules; for self-hosted Bitbucket Server, double-check the custom port in the ssh:// URL format.
  • Permission denied (publickey) — The public key isn't attached to your account at the provider, or the private key you uploaded to DataMasque is not the counterpart of that public key. Re-check Step 2 and Step 3. For AWS CodeCommit, also confirm the SSH key ID is embedded in the URL.
  • Branch not found — The Branch Name in Step 4 doesn't exist on the remote. Either create it on the remote first, or leave the field blank to auto-detect the default branch.
  • Pull shows no files — The Directory Path in Settings (or your per-user directory) is empty or contains no .yml / .yaml files. Click the Refresh Git Commits button to reload the list.

For broader issue triage, see General Troubleshooting.