name : setup-git-server-over-http.txt From: Rutger Nijlunsing <rutger@nospam.com> Subject: Setting up a Git repository which can be pushed into and pulled from over HTTP(S). Date: Thu, 10 Aug 2006 22:00:26 +0200 Content-type: text/asciidoc How to setup Git server over http ================================= NOTE: This document is from 2006. A lot has happened since then, and this document is now relevant mainly if your web host is not CGI capable. Almost everyone else should instead look at linkgit:git-http-backend[1]. Since Apache is one of those packages people like to compile themselves while others prefer the bureaucrat's dream Debian, it is impossible to give guidelines which will work for everyone. Just send some feedback to the mailing list at git@vger.kernel.org to get this document tailored to your favorite distro. What's needed: - Have an Apache web-server On Debian: $ apt-get install apache2 To get apache2 by default started, edit /etc/default/apache2 and set NO_START=0 - can edit the configuration of it. This could be found under /etc/httpd, or refer to your Apache documentation. On Debian: this means being able to edit files under /etc/apache2 - can restart it. 'apachectl --graceful' might do. If it doesn't, just stop and restart apache. Be warning that active connections to your server might be aborted by this. On Debian: $ /etc/init.d/apache2 restart or $ /etc/init.d/apache2 force-reload (which seems to do the same) This adds symlinks from the /etc/apache2/mods-enabled to /etc/apache2/mods-available. - have permissions to chown a directory - have Git installed on the client, and - either have Git installed on the server or have a webdav client on the client. In effect, this means you're going to be root, or that you're using a preconfigured WebDAV server. Step 1: setup a bare Git repository ----------------------------------- At the time of writing, git-http-push cannot remotely create a Git repository. So we have to do that at the server side with Git. Another option is to generate an empty bare repository at the client and copy it to the server with a WebDAV client (which is the only option if Git is not installed on the server). Create the directory under the DocumentRoot of the directories served by Apache. As an example we take /usr/local/apache2, but try "grep DocumentRoot /where/ever/httpd.conf" to find your root: $ cd /usr/local/apache/htdocs $ mkdir my-new-repo.git On Debian: $ cd /var/www $ mkdir my-new-repo.git Initialize a bare repository $ cd my-new-repo.git $ git --bare init Change the ownership to your web-server's credentials. Use `"grep ^User httpd.conf"` and `"grep ^Group httpd.conf"` to find out: $ chown -R www.www . On Debian: $ chown -R www-data.www-data . If you do not know which user Apache runs as, you can alternatively do a "chmod -R a+w .", inspect the files which are created later on, and set the permissions appropriately. Restart apache2, and check whether http://server/my-new-repo.git gives a directory listing. If not, check whether apache started up successfully. Step 2: enable DAV on this repository ------------------------------------- First make sure the dav_module is loaded. For this, insert in httpd.conf: LoadModule dav_module libexec/httpd/libdav.so AddModule mod_dav.c Also make sure that this line exists which is the file used for locking DAV operations: DAVLockDB "/usr/local/apache2/temp/DAV.lock" On Debian these steps can be performed with: Enable the dav and dav_fs modules of apache: $ a2enmod dav_fs (just to be sure. dav_fs might be unneeded, I don't know) $ a2enmod dav The DAV lock is located in /etc/apache2/mods-available/dav_fs.conf: DAVLockDB /var/lock/apache2/DAVLock Of course, it can point somewhere else, but the string is actually just a prefix in some Apache configurations, and therefore the _directory_ has to be writable by the user Apache runs as. Then, add something like this to your httpd.conf <Location /my-new-repo.git> DAV on AuthType Basic AuthName "Git" AuthUserFile /usr/local/apache2/conf/passwd.git Require valid-user </Location> On Debian: Create (or add to) /etc/apache2/conf.d/git.conf : <Location /my-new-repo.git> DAV on AuthType Basic AuthName "Git" AuthUserFile /etc/apache2/passwd.git Require valid-user </Location> Debian automatically reads all files under /etc/apache2/conf.d. The password file can be somewhere else, but it has to be readable by Apache and preferably not readable by the world. Create this file by $ htpasswd -c /usr/local/apache2/conf/passwd.git <user> On Debian: $ htpasswd -c /etc/apache2/passwd.git <user> You will be asked a password, and the file is created. Subsequent calls to htpasswd should omit the '-c' option, since you want to append to the existing file. You need to restart Apache. Now go to http://<username>@<servername>/my-new-repo.git in your browser to check whether it asks for a password and accepts the right password. On Debian: To test the WebDAV part, do: $ apt-get install litmus $ litmus http://<servername>/my-new-repo.git <username> <password> Most tests should pass. A command-line tool to test WebDAV is cadaver. If you prefer GUIs, for example, konqueror can open WebDAV URLs as "webdav://..." or "webdavs://...". If you're into Windows, from XP onwards Internet Explorer supports WebDAV. For this, do Internet Explorer -> Open Location -> http://<servername>/my-new-repo.git [x] Open as webfolder -> login . Step 3: setup the client ------------------------ Make sure that you have HTTP support, i.e. your Git was built with libcurl (version more recent than 7.10). The command 'git http-push' with no argument should display a usage message. Then, add the following to your $HOME/.netrc (you can do without, but will be asked to input your password a _lot_ of times): machine <servername> login <username> password <password> ...and set permissions: chmod 600 ~/.netrc If you want to access the web-server by its IP, you have to type that in, instead of the server name. To check whether all is OK, do: curl --netrc --location -v http://<username>@<servername>/my-new-repo.git/HEAD ...this should give something like 'ref: refs/heads/master', which is the content of the file HEAD on the server. Now, add the remote in your existing repository which contains the project you want to export: $ git-config remote.upload.url \ http://<username>@<servername>/my-new-repo.git/ It is important to put the last '/'; Without it, the server will send a redirect which git-http-push does not (yet) understand, and git-http-push will repeat the request infinitely. Step 4: make the initial push ----------------------------- From your client repository, do $ git push upload master This pushes branch 'master' (which is assumed to be the branch you want to export) to repository called 'upload', which we previously defined with git-config. Using a proxy: -------------- If you have to access the WebDAV server from behind an HTTP(S) proxy, set the variable 'all_proxy' to `http://proxy-host.com:port`, or `http://login-on-proxy:passwd-on-proxy@proxy-host.com:port`. See 'man curl' for details. Troubleshooting: ---------------- If git-http-push says Error: no DAV locking support on remote repo http://... then it means the web-server did not accept your authentication. Make sure that the user name and password matches in httpd.conf, .netrc and the URL you are uploading to. If git-http-push shows you an error (22/502) when trying to MOVE a blob, it means that your web-server somehow does not recognize its name in the request; This can happen when you start Apache, but then disable the network interface. A simple restart of Apache helps. Errors like (22/502) are of format (curl error code/http error code). So (22/404) means something like 'not found' at the server. Reading /usr/local/apache2/logs/error_log is often helpful. On Debian: Read /var/log/apache2/error.log instead. If you access HTTPS locations, Git may fail verifying the SSL certificate (this is return code 60). Setting http.sslVerify=false can help diagnosing the problem, but removes security checks. Debian References: http://www.debian-administration.org/articles/285 Authors Johannes Schindelin <Johannes.Schindelin@gmx.de> Rutger Nijlunsing <git@wingding.demon.nl> Matthieu Moy <Matthieu.Moy@imag.fr>