X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/821cb42d42976ec6f750e0b0b191ccc36cbad295..74ea7122c61a81b434e8f258ee104550c2f0b29e:/doc/install/install-arv-git-httpd.html.textile.liquid?ds=sidebyside
diff --git a/doc/install/install-arv-git-httpd.html.textile.liquid b/doc/install/install-arv-git-httpd.html.textile.liquid
index d853ac7c65..60139e10ab 100644
--- a/doc/install/install-arv-git-httpd.html.textile.liquid
+++ b/doc/install/install-arv-git-httpd.html.textile.liquid
@@ -70,9 +70,11 @@ On Red Hat-based systems:
+{% include 'install_git' %}
+
h2. Create a "git" user and a storage directory
-Gitolite and some additional scripts will be installed in @/var/lib/arvados/git@, which means hosted repository data will be stored in @/var/lib/arvados/git/repositories@. If you choose to install gitolite in a different location, make sure to update the @git_repositories_dir@ entry in your API server's @config/application.yml@ file accordingly: for example, if you install gitolite at @/data/gitolite@ then your @git_repositories_dir@ will be @/data/gitolite/repositories@.
+Gitolite and some additional scripts will be installed in @/var/lib/arvados/git@, which means hosted repository data will be stored in @/var/lib/arvados/git/repositories@. If you choose to install gitolite in a different location, make sure to update the @git_repositories_dir@ entry in your API server's @application.yml@ file accordingly: for example, if you install gitolite at @/data/gitolite@ then your @git_repositories_dir@ will be @/data/gitolite/repositories@.
A new UNIX account called "git" will own the files. This makes git URLs look familiar to users (git@[...]:username/reponame.git
).
@@ -85,7 +87,7 @@ gitserver:~$ sudo chown -R git:git ~git
-The git user needs its own SSH key. (It must be able to run @ssh git@localhost@ from scripts.)
+The git user needs its own SSH key. (It must be able to run ssh git@localhost
from scripts.)
gitserver:~$ sudo -u git -i bash
@@ -100,7 +102,7 @@ git@gitserver:~$ rm .ssh/authorized_keys
h2. Install gitolite
-Check https://github.com/sitaramc/gitolite/tags for the latest stable version (_e.g.,_ @v3.6.3@).
+Check "https://github.com/sitaramc/gitolite/tags":https://github.com/sitaramc/gitolite/tags for the latest stable version. This guide was tested with @v3.6.3@. _Versions below 3.0 are missing some features needed by Arvados, and should not be used._
Download and install the version you selected.
@@ -121,6 +123,8 @@ WARNING: /var/lib/arvados/git/.ssh/authorized_keys missing; creating a new one
+_If this didn't go well, more detail about installing gitolite, and information about how it works, can be found on the "gitolite home page":http://gitolite.com/._
+
Clone the gitolite-admin repository. The arvados-git-sync.rb script works by editing the files in this working directory and pushing them to gitolite. Here we make sure "git push" won't produce any errors or warnings.
@@ -140,7 +144,7 @@ Everything up-to-date
-h2. Configure gitolite
+h3. Configure gitolite
Configure gitolite to look up a repository name like @username/reponame.git@ and find the appropriate bare repository storage directory.
@@ -163,6 +167,13 @@ Add the following lines inside the section that begins @%RC = (@:
+Inside that section, adjust the 'UMASK' setting to @022@, to ensure the API server has permission to read repositories:
+
+
+ UMASK => 022,
+
+
+
Uncomment the 'Alias' line in the section that begins @ENABLE => [@:
@@ -188,9 +199,9 @@ Create a configuration file @/var/www/arvados-api/current/config/arvados-clients
-h2. Enable the synchronization script
+h3. Enable the synchronization script
-The API server package includes a script that retrieves the current set of repository names and permissions from the API, writes names and permissions to @arvadosaliases.pl@ in a format usable by gitolite, and creates new empty repositories if needed. This script should run every 2 to 5 minutes.
+The API server package includes a script that retrieves the current set of repository names and permissions from the API, writes them to @arvadosaliases.pl@ in a format usable by gitolite, and triggers gitolite hooks which create new empty repositories if needed. This script should run every 2 to 5 minutes.
If you are using RVM, create @/etc/cron.d/arvados-git-sync@ with the following content:
@@ -206,6 +217,17 @@ Otherwise, create @/etc/cron.d/arvados-git-sync@ with the following content:
+h3. Configure the API server to advertise the correct SSH URLs
+
+In your API server's @application.yml@ file, add the following entry:
+
+
+git_repo_ssh_base: "git@git.uuid_prefix.your.domain:"
+
+
+
+Make sure to include the trailing colon.
+
h2. Install the arvados-git-httpd package
This is needed only for HTTPS access.
@@ -246,11 +268,19 @@ fatal: No REQUEST_METHOD from server
h3. Enable arvados-git-httpd
-Install "runit":http://smarden.org/runit/ (if it's not already installed) and configure it to run arvados-git-httpd. Update the API host to match your site.
+On Debian-based systems, install runit:
~$ sudo apt-get install runit
-~$ cd /etc/sv
+
+
+
+On Red Hat-based systems, "install runit from source":http://smarden.org/runit/install.html or use an alternative daemon supervisor.
+
+Configure runit to run arvados-git-httpd, making sure to update the API host to match your site:
+
+
+~$ cd /etc/sv
/etc/sv$ sudo mkdir arvados-git-httpd; cd arvados-git-httpd
/etc/sv/arvados-git-httpd$ sudo mkdir log
/etc/sv/arvados-git-httpd$ sudo sh -c 'cat >log/run' <<'EOF'
@@ -270,37 +300,63 @@ EOF
+If you are using a different daemon supervisor, or if you want to test the daemon in a terminal window, an equivalent shell command to run arvados-git-httpd is:
+
+
+sudo -u git \
+ ARVADOS_API_HOST=uuid_prefix.your.domain \
+ GITOLITE_HTTP_HOME=/var/lib/arvados/git \
+ PATH="$PATH:/var/lib/arvados/git/bin" \
+ arvados-git-httpd -address=:9001 -git-command="$(which git)" -repo-root=/var/lib/arvados/git/repositories 2>&1
+
+
+
h3. Set up a reverse proxy to provide SSL service
The arvados-git-httpd service will be accessible from anywhere on the internet, so we recommend using SSL.
This is best achieved by putting a reverse proxy with SSL support in front of arvados-git-httpd, running on port 443 and passing requests to @arvados-git-httpd@ on port 9001 (or whichever port you used in your run script).
+Add the following configuration to the @http@ section of your Nginx configuration:
+
-http {
- upstream arvados-git-httpd {
- server localhost:9001;
- }
- server {
- listen *:443 ssl;
- server_name git.uuid_prefix.example.com;
- ssl_certificate /root/git.uuid_prefix.example.com.crt;
- ssl_certificate_key /root/git.uuid_prefix.example.com.key;
- location / {
- proxy_pass http://arvados-git-httpd;
- proxy_set_header X-Forwarded-For $remote_addr;
- }
+
+upstream arvados-git-httpd {
+ server 127.0.0.1:9001;
+}
+server {
+ listen [your public IP address]:443 ssl;
+ server_name git.uuid_prefix.your.domain;
+ proxy_connect_timeout 90s;
+ proxy_read_timeout 300s;
+
+ ssl on;
+ ssl_certificate /YOUR/PATH/TO/cert.pem;
+ ssl_certificate_key /YOUR/PATH/TO/cert.key;
+
+ location / {
+ proxy_pass http://arvados-git-httpd;
}
}
-
-h3. Tell the API server about the arvados-git-httpd service
+h3. Configure the API server to advertise the correct HTTPS URLs
+
+In your API server's @application.yml@ file, add the following entry:
+
+
+git_repo_http_base: https://git.uuid_prefix.your.domain/
+
+
+
+Make sure to include the trailing slash.
+
+h2. Restart Nginx
-In your API server's @config/application.yml@ file, add the following entry:
+Restart Nginx to make the Nginx and API server configuration changes take effect.
-git_http_base: git.uuid_prefix.your.domain
+gitserver:~$ sudo nginx -s reload