X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/0e57453d2b637a3d105d4e3d67031f3915f9d302..58fa1d8438cb613c6bf7bece8702146f3eed5205:/doc/install/install-arv-git-httpd.html.textile.liquid?ds=sidebyside diff --git a/doc/install/install-arv-git-httpd.html.textile.liquid b/doc/install/install-arv-git-httpd.html.textile.liquid index 44423e183f..2a4d103c7b 100644 --- a/doc/install/install-arv-git-httpd.html.textile.liquid +++ b/doc/install/install-arv-git-httpd.html.textile.liquid @@ -1,44 +1,253 @@ --- layout: default navsection: installguide -title: Install Git server +title: Install the Git server ... +{% comment %} +Copyright (C) The Arvados Authors. All rights reserved. -The arv-git-httpd server provides HTTP access to hosted git repositories, using Arvados authentication tokens instead of passwords. It is intended to be installed on the system where your git repositories are stored, and accessed through a web proxy that provides SSL support. +SPDX-License-Identifier: CC-BY-SA-3.0 +{% endcomment %} + +Arvados allows users to create their own private and public git repositories, and clone/push them using SSH and HTTPS. + +The git hosting setup involves three components. +* The "arvados-git-sync.rb" script polls the API server for the current list of repositories, creates bare repositories, and updates the local permission cache used by gitolite. +* Gitolite provides SSH access. +* arvados-git-http provides HTTPS access. + +It is not strictly necessary to deploy _both_ SSH and HTTPS access, but we recommend deploying both: +* SSH is a more appropriate way to authenticate from a user's workstation because it does not require managing tokens on the client side; +* HTTPS is a more appropriate way to authenticate from a shell VM because it does not depend on SSH agent forwarding (SSH clients' agent forwarding features tend to behave as if the remote machine is fully trusted). + +The HTTPS instructions given below will not work if you skip the SSH setup steps. + +h2. Set up DNS By convention, we use the following hostname for the git service: -
git.uuid_prefix.your.domain
+
+~$ sudo apt-get install git arv-git-httpd
+gitserver:~$ sudo apt-get install git openssh-server
~$ sudo yum install git arv-git-httpd
+gitserver:~$ sudo yum install git perl-Data-Dumper openssh-server
+
+
git@[...]:username/reponame.git
).
+
+On Debian- or Red Hat-based systems:
+
+gitserver:~$ sudo mkdir -p /var/lib/arvados/git
+gitserver:~$ sudo useradd --comment git --home-dir /var/lib/arvados/git git
+gitserver:~$ sudo chown -R git:git ~git
+
+ssh git@localhost
from scripts.)
+
+gitserver:~$ sudo -u git -i bash
+git@gitserver:~$ ssh-keygen -t rsa -P '' -f ~/.ssh/id_rsa
+git@gitserver:~$ cp .ssh/id_rsa.pub .ssh/authorized_keys
+git@gitserver:~$ ssh -o stricthostkeychecking=no localhost cat .ssh/id_rsa.pub
+Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7aBIDAAgMQN16Pg6eHmvc+D+6TljwCGr4YGUBphSdVb25UyBCeAEgzqRiqy0IjQR2BLtSirXr+1SJAcQfBgI/jwR7FG+YIzJ4ND9JFEfcpq20FvWnMMQ6XD3y3xrZ1/h/RdBNwy4QCqjiXuxDpDB7VNP9/oeAzoATPZGhqjPfNS+RRVEQpC6BzZdsR+S838E53URguBOf9yrPwdHvosZn7VC0akeWQerHqaBIpSfDMtaM4+9s1Gdsz0iP85rtj/6U/K/XOuv2CZsuVZZ52nu3soHnEX2nx2IaXMS3L8Z+lfOXB2T6EaJgXF7Z9ME5K1tx9TSNTRcYCiKztXLNLSbp git@gitserver
+git@gitserver:~$ rm .ssh/authorized_keys
+
+git@gitserver:~$ echo 'PATH=$HOME/bin:$PATH' >.profile
+git@gitserver:~$ source .profile
+git@gitserver:~$ git clone --branch v3.6.4 https://github.com/sitaramc/gitolite
+...
+Note: checking out '5d24ae666bfd2fa9093d67c840eb8d686992083f'.
+...
+git@gitserver:~$ mkdir bin
+git@gitserver:~$ gitolite/install -ln ~git/bin
+git@gitserver:~$ bin/gitolite setup -pk .ssh/id_rsa.pub
+Initialized empty Git repository in /var/lib/arvados/git/repositories/gitolite-admin.git/
+Initialized empty Git repository in /var/lib/arvados/git/repositories/testing.git/
+WARNING: /var/lib/arvados/git/.ssh/authorized_keys missing; creating a new one
+ (this is normal on a brand new install)
+
+git@gitserver:~$ git clone git@localhost:gitolite-admin
+Cloning into 'gitolite-admin'...
+remote: Counting objects: 6, done.
+remote: Compressing objects: 100% (4/4), done.
+remote: Total 6 (delta 0), reused 0 (delta 0)
+Receiving objects: 100% (6/6), done.
+Checking connectivity... done.
+git@gitserver:~$ cd gitolite-admin
+git@gitserver:~/gitolite-admin$ git config user.email arvados
+git@gitserver:~/gitolite-admin$ git config user.name arvados
+git@gitserver:~/gitolite-admin$ git config push.default simple
+git@gitserver:~/gitolite-admin$ git push
+Everything up-to-date
my $repo_aliases;
+my $aliases_src = "$ENV{HOME}/.gitolite/arvadosaliases.pl";
+if ($ENV{HOME} && (-e $aliases_src)) {
+ $repo_aliases = do $aliases_src;
+}
+$repo_aliases ||= {};
+
+~$ arv-git-httpd -h
-Usage of arv-git-httpd:
- -address="0.0.0.0:80": Address to listen on, "host:port".
- -git-command="/usr/bin/git": Path to git executable. Each authenticated request will execute this program with a single argument, "http-backend".
- -repo-root="/path/to/cwd": Path to git repositories.
+ REPO_ALIASES => $repo_aliases,
+
+
UMASK => 022,
+
+ # access a repo by another (possibly legacy) name
+ 'Alias',
+
+production:
+ gitolite_url: /var/lib/arvados/git/repositories/gitolite-admin.git
+ gitolite_tmp: /var/lib/arvados/git
+ arvados_api_host: uuid_prefix.example.com
+ arvados_api_token: "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
+ arvados_api_host_insecure: false
+ gitolite_arvados_git_user_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7aBIDAAgMQN16Pg6eHmvc+D+6TljwCGr4YGUBphSdVb25UyBCeAEgzqRiqy0IjQR2BLtSirXr+1SJAcQfBgI/jwR7FG+YIzJ4ND9JFEfcpq20FvWnMMQ6XD3y3xrZ1/h/RdBNwy4QCqjiXuxDpDB7VNP9/oeAzoATPZGhqjPfNS+RRVEQpC6BzZdsR+S838E53URguBOf9yrPwdHvosZn7VC0akeWQerHqaBIpSfDMtaM4+9s1Gdsz0iP85rtj/6U/K/XOuv2CZsuVZZ52nu3soHnEX2nx2IaXMS3L8Z+lfOXB2T6EaJgXF7Z9ME5K1tx9TSNTRcYCiKztXLNLSbp git@gitserver"
+
+*/5 * * * * git cd /var/www/arvados-api/current && /usr/local/rvm/bin/rvm-exec default bundle exec script/arvados-git-sync.rb production
+
+*/5 * * * * git cd /var/www/arvados-api/current && bundle exec script/arvados-git-sync.rb production
+
+git_repo_ssh_base: "git@git.uuid_prefix.your.domain:"
+
+~$ sudo apt-get install git arvados-git-httpd
+
+~$ sudo yum install git arvados-git-httpd
+~$ sudo systemctl enable arvados-git-httpd
+
+~$ arvados-git-httpd -h
+[...]
+Usage: arvados-git-httpd [-config path/to/arvados/git-httpd.yml]
+[...]
~$ git http-backend
Status: 500 Internal Server Error
Expires: Fri, 01 Jan 1980 00:00:00 GMT
@@ -49,27 +258,83 @@ fatal: No REQUEST_METHOD from server
Client:
+ APIHost: uuid_prefix.your.domain
+ Insecure: false
+GitCommand: /var/lib/arvados/git/gitolite/src/gitolite-shell
+GitoliteHome: /var/lib/arvados/git
+Listen: :9001
+RepoRoot: /var/lib/arvados/git/repositories
+
+~$ sudo systemctl restart arvados-git-httpd
+
+export ARVADOS_API_HOST=uuid_prefix.your.domain
-exec sudo -u git arv-git-httpd -address=:9001 -git-command="$(which git)" -repo-root=/var/lib/arvados/git 2>&1
+
+upstream arvados-git-httpd {
+ server 127.0.0.1:9001;
+}
+server {
+ listen [your public IP address]:443 ssl;
+ server_name git.uuid_prefix.your.domain;
+ proxy_connect_timeout 90s;
+ proxy_read_timeout 300s;
+
+ ssl on;
+ ssl_certificate /YOUR/PATH/TO/cert.pem;
+ ssl_certificate_key /YOUR/PATH/TO/cert.key;
+
+ # The server needs to accept potentially large refpacks from push clients.
+ client_max_body_size 50m;
+
+ location / {
+ proxy_pass http://arvados-git-httpd;
+ }
+}
git_repo_https_base: https://git.uuid_prefix.your.domain/
+
+git_http_base: git.uuid_prefix.your.domain
+gitserver:~$ sudo nginx -s reload