X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/908261de15c98553a4200f01aff1f26ef57c8fb8..fc6b3cd79ba9e07810330d0d47a0ab89ad8857f7:/doc/install/install-arv-git-httpd.html.textile.liquid?ds=sidebyside
diff --git a/doc/install/install-arv-git-httpd.html.textile.liquid b/doc/install/install-arv-git-httpd.html.textile.liquid
index 146dbe170b..b758903256 100644
--- a/doc/install/install-arv-git-httpd.html.textile.liquid
+++ b/doc/install/install-arv-git-httpd.html.textile.liquid
@@ -3,63 +3,52 @@ layout: default
navsection: installguide
title: Install the Git server
...
+{% comment %}
+Copyright (C) The Arvados Authors. All rights reserved.
-Arvados allows users to create their own private and public git repositories, and clone/push them using SSH and HTTPS.
+SPDX-License-Identifier: CC-BY-SA-3.0
+{% endcomment %}
-The git hosting setup involves three components.
-* The "arvados-git-sync.rb" script polls the API server for the current list of repositories, creates bare repositories, and updates the local permission cache used by gitolite.
-* Gitolite provides SSH access.
-* arvados-git-http provides HTTPS access.
-
-It is not strictly necessary to deploy _both_ SSH and HTTPS access, but we recommend deploying both:
-* SSH is a more appropriate way to authenticate from a user's workstation because it does not require managing tokens on the client side;
-* HTTPS is a more appropriate way to authenticate from a shell VM because it does not depend on SSH agent forwarding (SSH clients' agent forwarding features tend to behave as if the remote machine is fully trusted).
-
-The HTTPS instructions given below will not work if you skip the SSH setup steps.
-
-h2. Set up DNS
-
-By convention, we use the following hostname for the git service:
-
-
-git.uuid_prefix.your.domain
-
gitserver:~$ sudo apt-get install git openssh-server
+
# yum install git perl-Data-Dumper openssh-server
gitserver:~$ sudo yum install git perl-Data-Dumper openssh-server
+
# apt-get --no-install-recommends install git openssh-server
git@gitserver:~$ echo 'PATH=$HOME/bin:$PATH' >.profile
-git@gitserver:~$ source .profile
-git@gitserver:~$ git clone --branch v3.6.3 git://github.com/sitaramc/gitolite
+
$ sudo -u git -i bash
+git@gitserver:~$ echo 'PATH=$HOME/bin:$PATH' >.profile
+git@gitserver:~$ . .profile
+git@gitserver:~$ git clone --branch v3.6.11 https://github.com/sitaramc/gitolite
...
Note: checking out '5d24ae666bfd2fa9093d67c840eb8d686992083f'.
...
@@ -131,7 +121,7 @@ Everything up-to-date
production:
gitolite_url: /var/lib/arvados/git/repositories/gitolite-admin.git
gitolite_tmp: /var/lib/arvados/git
- arvados_api_host: uuid_prefix.example.com
+ arvados_api_host: ClusterID.example.com
arvados_api_token: "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
arvados_api_host_insecure: false
gitolite_arvados_git_user_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7aBIDAAgMQN16Pg6eHmvc+D+6TljwCGr4YGUBphSdVb25UyBCeAEgzqRiqy0IjQR2BLtSirXr+1SJAcQfBgI/jwR7FG+YIzJ4ND9JFEfcpq20FvWnMMQ6XD3y3xrZ1/h/RdBNwy4QCqjiXuxDpDB7VNP9/oeAzoATPZGhqjPfNS+RRVEQpC6BzZdsR+S838E53URguBOf9yrPwdHvosZn7VC0akeWQerHqaBIpSfDMtaM4+9s1Gdsz0iP85rtj/6U/K/XOuv2CZsuVZZ52nu3soHnEX2nx2IaXMS3L8Z+lfOXB2T6EaJgXF7Z9ME5K1tx9TSNTRcYCiKztXLNLSbp git@gitserver"
+$ sudo chown git:git /var/www/arvados-api/current/config/arvados-clients.yml +$ sudo chmod og-rwx /var/www/arvados-api/current/config/arvados-clients.yml +-The API server package includes a script that retrieves the current set of repository names and permissions from the API, writes them to @arvadosaliases.pl@ in a format usable by gitolite, and triggers gitolite hooks which create new empty repositories if needed. This script should run every 2 to 5 minutes. +h3. Test configuration -If you are using RVM, create @/etc/cron.d/arvados-git-sync@ with the following content: +notextile.
$ sudo -u git -i bash -c 'cd /var/www/arvados-api/current && bin/bundle exec script/arvados-git-sync.rb production'
-*/5 * * * * git cd /var/www/arvados-api/current && /usr/local/rvm/bin/rvm-exec default bundle exec script/arvados-git-sync.rb production
-
-*/5 * * * * git cd /var/www/arvados-api/current && bundle exec script/arvados-git-sync.rb production
+*/5 * * * * git cd /var/www/arvados-api/current && bin/bundle exec script/arvados-git-sync.rb production
git_repo_ssh_base: "git@git.uuid_prefix.your.domain:"
+ Services:
+ GitSSH:
+ ExternalURL: "ssh://git@git.ClusterID.example.com"
+ GitHTTP:
+ ExternalURL: https://git.ClusterID.example.com/
+ InternalURLs:
+ "http://localhost:9001": {}
+ Git:
+ GitCommand: /var/lib/arvados/git/gitolite/src/gitolite-shell
+ GitoliteHome: /var/lib/arvados/git
+ Repositories: /var/lib/arvados/git/repositories
upstream arvados-git-httpd {
+ server 127.0.0.1:9001;
+}
+server {
+ listen 443 ssl;
+ server_name git.ClusterID.example.com;
+ proxy_connect_timeout 90s;
+ proxy_read_timeout 300s;
-The arvados-git-httpd package provides HTTP access, using Arvados authentication tokens instead of passwords. It is intended to be installed on the system where your git repositories are stored, and accessed through a web proxy that provides SSL support.
+ ssl_certificate /YOUR/PATH/TO/cert.pem;
+ ssl_certificate_key /YOUR/PATH/TO/cert.key;
-On Debian-based systems:
+ # The server needs to accept potentially large refpacks from push clients.
+ client_max_body_size 128m;
-
-~$ sudo apt-get install git arvados-git-httpd
+ location / {
+ proxy_pass http://arvados-git-httpd;
+ }
+}
-On Red Hat-based systems:
+h2(#install-packages). Install the arvados-git-httpd package
-
-~$ sudo yum install git arvados-git-httpd
-
-
+The arvados-git-httpd package provides HTTP access, using Arvados authentication tokens instead of passwords. It must be installed on the system where your git repositories are stored.
-Verify that @arvados-git-httpd@ and @git-http-backend@ can be run:
+h3. Centos 7
-~$ arvados-git-httpd -h
-Usage of arvados-git-httpd:
- -address="0.0.0.0:80": Address to listen on, "host:port".
- -git-command="/usr/bin/git": Path to git executable. Each authenticated request will execute this program with a single argument, "http-backend".
- -repo-root="/path/to/cwd": Path to git repositories.
-~$ git http-backend
-Status: 500 Internal Server Error
-Expires: Fri, 01 Jan 1980 00:00:00 GMT
-Pragma: no-cache
-Cache-Control: no-cache, max-age=0, must-revalidate
-
-fatal: No REQUEST_METHOD from server
+# yum install arvados-git-httpd
-h3. Enable arvados-git-httpd
-
-On Debian-based systems, install runit:
+h3. Debian and Ubuntu
-~$ sudo apt-get install runit
+# apt-get --no-install-recommends install arvados-git-httpd
-On Red Hat-based systems, "install runit from source":http://smarden.org/runit/install.html or use an alternative daemon supervisor.
+h2(#restart-api). Restart the API server and controller
-Configure runit to run arvados-git-httpd, making sure to update the API host to match your site:
+After adding Workbench to the Services section, make sure the cluster config file is up to date on the API server host, and restart the API server and controller processes to ensure the changes are applied.
-~$ cd /etc/sv
-/etc/sv$ sudo mkdir arvados-git-httpd; cd arvados-git-httpd
-/etc/sv/arvados-git-httpd$ sudo mkdir log
-/etc/sv/arvados-git-httpd$ sudo sh -c 'cat >log/run' <<'EOF'
-#!/bin/sh
-mkdir -p main
-chown git:git main
-exec chpst -u git:git svlogd -tt main
-EOF
-/etc/sv/arvados-git-httpd$ sudo sh -c 'cat >run' <<'EOF'
-#!/bin/sh
-export ARVADOS_API_HOST=uuid_prefix.your.domain
-export GITOLITE_HTTP_HOME=/var/lib/arvados/git
-export GL_BYPASS_ACCESS_CHECKS=1
-export PATH="$PATH:/var/lib/arvados/git/bin"
-exec chpst -u git:git arvados-git-httpd -address=:9001 -git-command=/var/lib/arvados/git/gitolite/src/gitolite-shell -repo-root=/var/lib/arvados/git/repositories 2>&1
-EOF
-/etc/sv/arvados-git-httpd$ sudo chmod +x run log/run
+# systemctl restart nginx arvados-controller
-If you are using a different daemon supervisor, or if you want to test the daemon in a terminal window, an equivalent shell command to run arvados-git-httpd is:
+h2(#confirm-working). Confirm working installation
-
-sudo -u git \
- ARVADOS_API_HOST=uuid_prefix.your.domain \
- GITOLITE_HTTP_HOME=/var/lib/arvados/git \
- GL_BYPASS_ACCESS_CHECKS=1 \
- PATH="$PATH:/var/lib/arvados/git/bin" \
- arvados-git-httpd -address=:9001 -git-command=/var/lib/arvados/git/gitolite/src/gitolite-shell -repo-root=/var/lib/arvados/git/repositories 2>&1
-
-
-
-h3. Set up a reverse proxy to provide SSL service
-
-The arvados-git-httpd service will be accessible from anywhere on the internet, so we recommend using SSL.
-
-This is best achieved by putting a reverse proxy with SSL support in front of arvados-git-httpd, running on port 443 and passing requests to @arvados-git-httpd@ on port 9001 (or whichever port you used in your run script).
-
-Add the following configuration to the @http@ section of your Nginx configuration:
+Create 'testrepo' in the Arvados database.
-
-upstream arvados-git-httpd {
- server 127.0.0.1:9001;
-}
-server {
- listen [your public IP address]:443 ssl;
- server_name git.uuid_prefix.your.domain;
- proxy_connect_timeout 90s;
- proxy_read_timeout 300s;
-
- ssl on;
- ssl_certificate /YOUR/PATH/TO/cert.pem;
- ssl_certificate_key /YOUR/PATH/TO/cert.key;
-
- # The server needs to accept potentially large refpacks from push clients.
- client_max_body_size 50m;
+~$ arv --format=uuid repository create --repository '{"name":"myusername/testrepo"}'
+
- location / {
- proxy_pass http://arvados-git-httpd;
- }
-}
-
-git_repo_https_base: https://git.uuid_prefix.your.domain/
+~$ git clone git@git.ClusterID.example.com:username/testrepo.git
gitserver:~$ sudo nginx -s reload
+~$ git clone https://git.ClusterID.example.com/username/testrepo.git