Best way to protect public facing development environments?

Question

We're in the process of setting up individualized dev environments for our developers. All of our developers are remote and we don't have a VPN or anything to bring this in house.

But here's the question...

Our public facing site is domain.com, our beta site is domain.net. Each developer has their own subdomain, IE. peter.domain.net, robert.domain.net, etc. For larger projects we have things like commerce.domain.net, all of them are connected to our github repositories and we do automated pushes to our beta site at domain.net where we have a group of members who act as QA for us to help test. The question is, how can we protect the developer environments from public access while still allowing ALL of the developers access to each others dev environment?

I don't think .htpasswd or .htaccess rewrites are the way to go as we don't want developers to need to remember a password, nor do we want all of the developers to share the same password.

Any thoughts would be appreciated.

Answer 1

If you don't want to use htpasswrd then i'd suggest restricting access to the dev sites by IP address.

Even if the dev's don't have static IP addresses they won't change so frequently that this type of restriction would cause a major headache (I've had the same IP for months), just so long as they have someone to call if there is a change.