# Zactonz Git: Requirements

> Deploy GitHub repositories to cPanel accounts automatically, with webhooks or a manual sync.

Page: https://developers.zactonz.com/cpanel-whm/zctzgit/requirements/

Complete documentation for this product: https://developers.zactonz.com/cpanel-whm/zctzgit.md

Check these before installing. The installer confirms it is running as `root` and stops if it is not; the rest of this page is your responsibility to verify.

## Compatible environments

- CentOS 7 / 8
- AlmaLinux 8 / 9
- Rocky Linux
- CloudLinux OS
- Any server running WHM/cPanel with the **Jupiter** theme

## Required software

| Component | Minimum |
|---|---|
| WHM / cPanel | 106 or newer |
| Git | 2.18 or newer |
| PHP | 7.2 or newer |
| Web server | Apache or LiteSpeed |

The webhook receiver is served from the account's document root and relies on `.htaccess`, so automatic deployment requires Apache or LiteSpeed. Manual **Sync now** works on any web server.

## Required access

- **Root SSH** (or WHM's Terminal feature) to run the installer. Regular cPanel users cannot install WHM plugins.
- **GitHub access**: public repositories need nothing; private repositories need a personal access token with read access to the repository.
- The PHP `exec` function must be enabled for the account so the plugin can run `git`.

## Network

The server needs outbound HTTPS to `github.com` to clone and pull. If GitHub webhooks are used for automatic deployment, GitHub must be able to reach the account's domain over HTTPS.

## A note on stored tokens

An access token for a private repository is stored twice on the server: encrypted in the account's `~/.zctzgit` directory, and in plaintext inside the repository's `.git/config`, where Git keeps the remote URL. Since 1.0.1 the plugin writes a deny rule into `.git` and restricts its permissions, which stops Apache and LiteSpeed serving it. NGINX ignores `.htaccess`, so on NGINX add a server-level rule blocking `.git` before deploying a private repository into a document root.

Issue tokens with the narrowest scope that works — read access to the single repository — and rotate them if a server is ever exposed.