web.config transformation + msdeploy - keeping production passwords out of source control

Question

Our web.config needs a database password.

How can we specify this password while building the msdeploy (aka Web Deploy) package or when actually deploying?

We build the msdeploy package using msbuild (/p:DeployOnBuild=true) and web.config transformations for environment-specific details.

Answer 1

Web.config transformations are, by design, build time transformations. I tend to only use them for "everything but debug" changes.

What you want is an MSDeploy parameter. Assuming you are using a pubxml publish profile, the generated package will automatically have a parameter named "Name-Web.config Connection String" (where "Name" matches the name attribute in web.config) that will apply to the connection string.

If you deploy the package, you can change the connection string by supplying the value using -setParam:

Website.deploy.cmd /Y ... ^
 -setParam:name="Name-Web.config Connection String",value="connection_string"

If you deploy using a publish profile, you can set the value in the pubxml file by updating the MSDeployParameterValue value (you should see the correct value near the bottom of the file):

<MSDeployParameterValue Include="$(DeployParameterPrefix)DBName-Web.config Connection String">
  <ParameterValue>connection_string</ParameterValue>
</MSDeployParameterValue>