X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/a7a482db3954fa6470be74f0e00f6e1e105e0b6c..fc6b3cd79ba9e07810330d0d47a0ab89ad8857f7:/doc/install/install-arv-git-httpd.html.textile.liquid?ds=sidebyside
diff --git a/doc/install/install-arv-git-httpd.html.textile.liquid b/doc/install/install-arv-git-httpd.html.textile.liquid
index 935f20dd69..b758903256 100644
--- a/doc/install/install-arv-git-httpd.html.textile.liquid
+++ b/doc/install/install-arv-git-httpd.html.textile.liquid
@@ -9,63 +9,46 @@ Copyright (C) The Arvados Authors. All rights reserved.
SPDX-License-Identifier: CC-BY-SA-3.0
{% endcomment %}
-Arvados allows users to create their own private and public git repositories, and clone/push them using SSH and HTTPS.
+# "Introduction":#introduction
+# "Install dependencies":#dependencies
+# "Create "git" user and storage directory":#create
+# "Install gitolite":#gitolite
+# "Configure gitolite":#config-gitolite
+# "Configure git synchronization":#sync
+# "Update config.yml":#update-config
+# "Update nginx configuration":#update-nginx
+# "Install arvados-git-httpd package":#install-packages
+# "Restart the API server and controller":#restart-api
+# "Confirm working installation":#confirm-working
+
+h2(#introduction). Introduction
+
+Arvados support for git repository management enables using Arvados permissions to control access to git repositories. Users can create their own private and public git repositories and share them with others.
The git hosting setup involves three components.
* The "arvados-git-sync.rb" script polls the API server for the current list of repositories, creates bare repositories, and updates the local permission cache used by gitolite.
-* Gitolite provides SSH access.
-* arvados-git-http provides HTTPS access.
+* Gitolite provides SSH access. Users authenticate by SSH keys.
+* arvados-git-http provides HTTPS access. Users authenticate by Arvados tokens.
-It is not strictly necessary to deploy _both_ SSH and HTTPS access, but we recommend deploying both:
-* SSH is a more appropriate way to authenticate from a user's workstation because it does not require managing tokens on the client side;
-* HTTPS is a more appropriate way to authenticate from a shell VM because it does not depend on SSH agent forwarding (SSH clients' agent forwarding features tend to behave as if the remote machine is fully trusted).
-* HTTPS is also used by Arvados Composer to access git repositories from the browser.
+Git services must be installed on the same host as the Arvados Rails API server.
-The HTTPS instructions given below will not work if you skip the SSH setup steps.
+h2(#dependencies). Install dependencies
-h2. Set up DNS
-
-By convention, we use the following hostname for the git service:
+h3. Centos 7
git.uuid_prefix.your.domain
+
# yum install git perl-Data-Dumper openssh-server
gitserver:~$ sudo apt-get install git openssh-server
+
# apt-get --no-install-recommends install git openssh-server
-gitserver:~$ sudo yum install git perl-Data-Dumper openssh-server
-
git@gitserver:~$ echo 'PATH=$HOME/bin:$PATH' >.profile
-git@gitserver:~$ source .profile
-git@gitserver:~$ git clone --branch v3.6.4 https://github.com/sitaramc/gitolite
+
$ sudo -u git -i bash
+git@gitserver:~$ echo 'PATH=$HOME/bin:$PATH' >.profile
+git@gitserver:~$ . .profile
+git@gitserver:~$ git clone --branch v3.6.11 https://github.com/sitaramc/gitolite
...
Note: checking out '5d24ae666bfd2fa9093d67c840eb8d686992083f'.
...
@@ -137,7 +121,7 @@ Everything up-to-date
production:
gitolite_url: /var/lib/arvados/git/repositories/gitolite-admin.git
gitolite_tmp: /var/lib/arvados/git
- arvados_api_host: uuid_prefix.example.com
+ arvados_api_host: ClusterID.example.com
arvados_api_token: "zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz"
arvados_api_host_insecure: false
gitolite_arvados_git_user_key: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7aBIDAAgMQN16Pg6eHmvc+D+6TljwCGr4YGUBphSdVb25UyBCeAEgzqRiqy0IjQR2BLtSirXr+1SJAcQfBgI/jwR7FG+YIzJ4ND9JFEfcpq20FvWnMMQ6XD3y3xrZ1/h/RdBNwy4QCqjiXuxDpDB7VNP9/oeAzoATPZGhqjPfNS+RRVEQpC6BzZdsR+S838E53URguBOf9yrPwdHvosZn7VC0akeWQerHqaBIpSfDMtaM4+9s1Gdsz0iP85rtj/6U/K/XOuv2CZsuVZZ52nu3soHnEX2nx2IaXMS3L8Z+lfOXB2T6EaJgXF7Z9ME5K1tx9TSNTRcYCiKztXLNLSbp git@gitserver"
+$ sudo chown git:git /var/www/arvados-api/current/config/arvados-clients.yml +$ sudo chmod og-rwx /var/www/arvados-api/current/config/arvados-clients.yml +-The API server package includes a script that retrieves the current set of repository names and permissions from the API, writes them to @arvadosaliases.pl@ in a format usable by gitolite, and triggers gitolite hooks which create new empty repositories if needed. This script should run every 2 to 5 minutes. +h3. Test configuration -If you are using RVM, create @/etc/cron.d/arvados-git-sync@ with the following content: - -
*/5 * * * * git cd /var/www/arvados-api/current && /usr/local/rvm/bin/rvm-exec default bundle exec script/arvados-git-sync.rb production
-
-$ sudo -u git -i bash -c 'cd /var/www/arvados-api/current && bin/bundle exec script/arvados-git-sync.rb production'
-Otherwise, create @/etc/cron.d/arvados-git-sync@ with the following content:
-
-*/5 * * * * git cd /var/www/arvados-api/current && bundle exec script/arvados-git-sync.rb production
-
-Clusters:
- uuid_prefix:
- Services:
- GitSSH:
- ExternalURL: git@git.uuid_prefix.your.domain:
-
-~$ sudo apt-get install git arvados-git-httpd
-
-~$ sudo yum install git arvados-git-httpd
-~$ sudo systemctl enable arvados-git-httpd
-
-~$ arvados-git-httpd -h
-[...]
-Usage: arvados-git-httpd [-config path/to/arvados/git-httpd.yml]
-[...]
-~$ git http-backend
-Status: 500 Internal Server Error
-Expires: Fri, 01 Jan 1980 00:00:00 GMT
-Pragma: no-cache
-Cache-Control: no-cache, max-age=0, must-revalidate
-
-fatal: No REQUEST_METHOD from server
+*/5 * * * * git cd /var/www/arvados-api/current && bin/bundle exec script/arvados-git-sync.rb production
Clusters:
- uuid_prefix:
- Services:
+ Services:
+ GitSSH:
+ ExternalURL: "ssh://git@git.ClusterID.example.com"
GitHTTP:
- ExternalURL: https://git.uuid_prefix.your.domain/
+ ExternalURL: https://git.ClusterID.example.com/
InternalURLs:
- "http://localhost:9001": {}
+ "http://localhost:9001": {}
Git:
GitCommand: /var/lib/arvados/git/gitolite/src/gitolite-shell
GitoliteHome: /var/lib/arvados/git
@@ -288,41 +215,25 @@ Edit the cluster config at @/etc/arvados/config.yml@ and set the following value
~$ sudo systemctl restart arvados-git-httpd
-
-
-upstream arvados-git-httpd {
+upstream arvados-git-httpd {
server 127.0.0.1:9001;
}
server {
- listen [your public IP address]:443 ssl;
- server_name git.uuid_prefix.your.domain;
+ listen 443 ssl;
+ server_name git.ClusterID.example.com;
proxy_connect_timeout 90s;
proxy_read_timeout 300s;
- ssl on;
ssl_certificate /YOUR/PATH/TO/cert.pem;
ssl_certificate_key /YOUR/PATH/TO/cert.key;
# The server needs to accept potentially large refpacks from push clients.
- client_max_body_size 50m;
+ client_max_body_size 128m;
location / {
proxy_pass http://arvados-git-httpd;
@@ -331,55 +242,57 @@ server {
# yum install arvados-git-httpd
+
+gitserver:~$ sudo nginx -s reload
+# apt-get --no-install-recommends install arvados-git-httpd
~$ uuid_prefix=`arv --format=uuid user current | cut -d- -f1`
-~$ echo "Site prefix is '$uuid_prefix'"
-~$ all_users_group_uuid="$uuid_prefix-j7d0g-fffffffffffffff"
-~$ repo_uuid=`arv --format=uuid repository create --repository "{\"owner_uuid\":\"$uuid_prefix-tpzed-000000000000000\", \"name\":\"arvados\"}"`
-~$ echo "Arvados repository uuid is '$repo_uuid'"
-
# systemctl restart nginx arvados-controller
+
+
-Create a link object to make the repository object readable by the "All users" group, and therefore by every active user. This makes it possible for users to run the bundled Crunch scripts by specifying @"script_version":"master","repository":"arvados"@ rather than pulling the Arvados source tree into their own repositories.
+h2(#confirm-working). Confirm working installation
+
+Create 'testrepo' in the Arvados database.
~$ read -rd $'\000' newlink <<EOF; arv link create --link "$newlink"
-{
- "tail_uuid":"$all_users_group_uuid",
- "head_uuid":"$repo_uuid",
- "link_class":"permission",
- "name":"can_read"
-}
-EOF
+~$ arv --format=uuid repository create --repository '{"name":"myusername/testrepo"}'
~$ cd /tmp
-/tmp$ git clone --bare https://github.com/arvados/arvados.git
-/tmp git --git-dir arvados.git push https://git.uuid_prefix.your.domain/arvados.git '*:*'
+~$ git clone git@git.ClusterID.example.com:username/testrepo.git
git@git.uuid_prefix.your.domain:arvados.git
using your SSH key, or by logging in to your git server and using sudo.
+h3. HTTP
+
+Set up git credential helpers as described in "install shell server":install-shell-server.html#config-git for the git command to use your API token instead of prompting you for a username and password.
gitserver:~$ sudo -u git -i bash
-git@gitserver:~$ git clone --bare https://github.com/arvados/arvados.git /tmp/arvados.git
-git@gitserver:~$ cd /tmp/arvados.git
-git@gitserver:/tmp/arvados.git$ gitolite push /var/lib/arvados/git/repositories/your_arvados_repo_uuid.git '*:*'
+~$ git clone https://git.ClusterID.example.com/username/testrepo.git