Author: thomas Date: Mon Jan 4 08:07:19 2021 New Revision: 24069 Log: Add 'Running a git server' page
Added: trunk/BOOK/general/prog/gitserver.xml (contents, props changed) Modified: trunk/BOOK/general/prog/prog.xml Added: trunk/BOOK/general/prog/gitserver.xml ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ trunk/BOOK/general/prog/gitserver.xml Mon Jan 4 08:07:19 2021 (r24069) @@ -0,0 +1,332 @@ +<?xml version="1.0" encoding="ISO-8859-1"?> +<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN" + "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd"; [ + <!ENTITY % general-entities SYSTEM "../../general.ent"> + %general-entities; + <!ENTITY gitgid "58"> + <!ENTITY gituid "58"> +]> + +<sect1 id="gitserver" xreflabel="Running a git Server"> + <?dbhtml filename="gitserver.html"?> + + <sect1info> + <othername>$LastChangedBy$</othername> + <date>$Date$</date> + </sect1info> + + <title>Running a git Server</title> + + <sect2 role="package"> + <title>Running a git Server</title> + + <para> + This section will describe how to set up, administer and secure + a <application>git</application> server. It is recommended to + have a look to the <ulink url="https://git-scm.com/book/en/v2";>git-scm documentation</ulink> + as <application>git</application> has many options to set. + </para> + + <bridgehead renderas="sect3">git Server Dependencies</bridgehead> + + <bridgehead renderas="sect4">Required</bridgehead> + <para role="required"> + <xref linkend="git"/> and + <xref linkend="openssh"/> + </para> + + </sect2> + + <sect2 role="configuration"> + <title>Setting up a git Server.</title> + + <para> + The following instructions will install a + <application>git</application> server, which will be set + up to use <application>OpenSSH</application> as the secure + remote access method. + </para> + + <para> + Configuration of the <application>git</application> server + consists of the following steps: + </para> + + <sect3> + <title>1. Setup Users, Groups, and Permissions</title> + + <para> + You'll need to be user + <systemitem class='username'>root</systemitem> for the + initial portion of configuration. Create the <systemitem + class="username">git</systemitem> user and group with the + following commands: + </para> + +<screen role="root"><userinput>groupadd -g &gitgid; git && +useradd -c "git Owner" -d /home/git -m -g git -s /usr/bin/git-shell -u &gituid; git</userinput></screen> + + <para> + Create some files and directories in the home directory + of the git user. The current approach is to allow access + to the git repository using ssh keys. + </para> + +<screen role="root"><userinput>install -o git -g git -dm0700 /home/git/.ssh && +install -o git -g git -m0600 /dev/null /home/git/.ssh/authorized_keys +</userinput></screen> + + <para> + For any developer who should have access to the repository + add his/hers public ssh key to <filename>/home/git/.ssh/authorized_keys</filename>. + Prepending some options to prevent users to use the + connection to git for port forwarding to other machines + the git server might reach. + </para> + +<screen role="nodump"><userinput>echo -n "no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty " >> /home/git/.ssh/authorized_keys && +cat users-ssh-key >> /home/git/.ssh/authorized_keys</userinput></screen> + + </sect3> + + <sect3> + <title>2. Create a git repository.</title> + + <para> + The repository can be but has not to be in git users home + directory - it can be anywhere on the filesystem. It is + important that the git user has read/write access to that + location. We use <filename class="directory">/srv/git</filename> + as base directory. Create a new <application>git</application> + repository with the following commands (as the + <systemitem class="username">root</systemitem> user): + </para> + +<screen role="root"><userinput>install -o git -g git -m0755 -d /srv/git/project1.git && +cd /srv/git/project1.git && +git init --bare && +chown -R git:git .</userinput></screen> + + <para> + Now that the repository is created, it can be used by the + developers to put some files into it. Once the ssh key of + the user is imported to git's <filename>authorized_keys</filename> + file, the user can interact with the repository. + </para> + + <para> + A minimal configuration should be available on developers + machine specifying its user name and the email address. + Create this minimal config file on client side: + </para> + +<screen role="nodump"><userinput>cat > ~/.gitconfig <<EOF +[user] + name = <users-name> + email = <users-email-address> +EOF</userinput></screen> + + <para>On the developers machine, setup some files to be pushed + to the repository as the initial content: + </para> + +<screen role="nodump"><userinput>mkdir myproject +cd myproject +git init +git remote add origin git@gitserver:/srv/git/project1.git +cat >README <<EOF +This is the README file +EOF +git add README +git commit -m 'Initial creation of README' +git push --set-upstream origin master</userinput></screen> + + <para>The initial content is now pushed to the server and + is available for other users. On the current machine, the + argument <literal>--set-upstream origin master</literal> is + now no longer required as the local repository is now + connected to the remote repository. Subsequent pushes + can be performed as + </para> + +<screen role="nodump"><userinput>git push</userinput></screen> + + <para> + Other developers can now clone the repository and do + modifications to the content (as long as their ssh keys + has been installed): + </para> + +<screen role="nodump"><userinput>git clone git@gitserver:/srv/git/project1.git +cd project1 +vi README +git commit -am 'Fix for README file' +git push</userinput></screen> + + <note> + <para> + This is a very basic server setup based on <application>OpenSSH</application> + access. All developers are using the <systemitem + class="username">git</systemitem> user to perform actions + on the repository and the changes users are commiting can + be distiguished as the local user name (see + <filename>~/.gitconfig</filename>) is recorded in the + changesets.</para> + </note> + + <para>Access is restricted by the public keys added to git's + <filename>authorized_keys</filename> file and there is no + option for the public to export/clone the repository. To + enable this, continue with step 3 to setup the git server. + </para> + + </sect3> + + <sect3> + <title>3. Configure the Server</title> + + <para> + The setup described above makes a repository available for + authenticated users (via providing the ssh public key file). + There is also a quite simple server to publish the + repository to unauthenticated users - of course without write + access. + </para> + <para> + The compination of access via ssh (for authenticated users) and + the export of repositories to unauthenticated users via the + daemon is in most cases enough for a development site. + </para> + + <note> + <para> + The daemon will be reachable at port <literal>9418</literal> + by default. Make sure that your firewall setup allows + access to that port. + </para> + </note> + + <para> + As user <systemitem class='username'>root</systemitem> do: + </para> + +<screen role="root" revision="sysv"><userinput>cat > /etc/rc.d/init.d/git-daemon <<"EOF" +#!/bin/sh +######################################################################## +# Begin /etc/rc.d/init.d/git-daemon +# +# Description : Start/Stop git as a daemon +# +# Authors : +# +# Version : LFS x.x +# +# Notes : +# +######################################################################## + +### BEGIN INIT INFO +# Provides: git-daemon +# Required-Start: network +# Should-Start: +# Required-Stop: +# Should-Stop: +# Default-Start: +# Default-Stop: +# Short-Description: git as daemon +# Description: +# X-LFS-Provided-By: +### END INIT INFO + +. /lib/lsb/init-functions + +GIT_BIN="/usr/bin/git" +DFT_REPO_DIR="/srv/git/" +PID_FILE="/run/git-daemon.pid" + +case "${1}" in + start) + log_info_msg "Starting git-daemon ..." + $GIT_BIN daemon \ + --detach --pid-file=$PID_FILE \ + --user=git --group=git \ + --reuseaddr --base-path=$DFT_REPO_DIR $DFT_REPO_DIR + evaluate_retval + ;; + + stop) + log_info_msg "Stopping git-daemon ..." + killproc -p $PID_FILE $GIT_BIN + evaluate_retval + ;; + + restart) + ${0} stop + sleep 1 + ${0} start + ;; + + *) + echo "Usage: ${0} {start|stop|restart}" + exit 1 + ;; +esac + +exit 0 + +# End /etc/rc.d/init.d/git-daemon +EOF +chmod 755 /etc/rc.d/init.d/git-daemon +ln -v -sf ../init.d/git-daemon /etc/rc.d/rc0.d/K29git-daemon +ln -v -sf ../init.d/git-daemon /etc/rc.d/rc1.d/K29git-daemon +ln -v -sf ../init.d/git-daemon /etc/rc.d/rc2.d/K29git-daemon +ln -v -sf ../init.d/git-daemon /etc/rc.d/rc3.d/S50git-daemon +ln -v -sf ../init.d/git-daemon /etc/rc.d/rc4.d/S50git-daemon +ln -v -sf ../init.d/git-daemon /etc/rc.d/rc5.d/S50git-daemon +ln -v -sf ../init.d/git-daemon /etc/rc.d/rc6.d/K29git-daemon</userinput></screen> + +<screen role="root" revision="systemd"><userinput>cat > /etc/systemd/system/git-daemon.service <<EOF +[Unit] +Description=Start Git Daemon + +[Service] +ExecStart=/usr/bin/git daemon --reuseaddr --base-path=/srv/git/ /srv/git/ + +Restart=always +RestartSec=500ms + +StandardOutput=syslog +StandardError=syslog +SyslogIdentifier=git-daemon + +User=git +Group=git + +[Install] +WantedBy=multi-user.target +EOF</userinput></screen> + <para revision="systemd"> + Enable and start the daemon be executing + </para> +<screen role="root" revision="systemd"><userinput>systemctl enable git-daemon && +systemctl start git-daemon</userinput></screen> + <para revision="sysv"> + Start the daemon be executing + </para> +<screen role="root" revision="sysv"><userinput>/etc/rc.d/init.d/git-daemon start</userinput></screen> + + <para> + In order to make <application>git</application> exporting a + repository, a file named <filename>git-daemon-export-ok</filename> + is required in each repository directory on the server. The + file needs no content, just its existance enables, its absence + disables the export of that repository. + </para> + +<screen role="root"><userinput>touch /srv/git/project1.git/git-daemon-export-ok</userinput></screen> + + </sect3> + + </sect2> + +</sect1> Modified: trunk/BOOK/general/prog/prog.xml ============================================================================== --- trunk/BOOK/general/prog/prog.xml Mon Jan 4 04:29:20 2021 (r24068) +++ trunk/BOOK/general/prog/prog.xml Mon Jan 4 08:07:19 2021 (r24069) @@ -37,6 +37,7 @@ <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"; href="gc.xml"/> <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"; href="gdb.xml"/> <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"; href="git.xml"/> + <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"; href="gitserver.xml"/> <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"; href="guile.xml"/> <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"; href="librep.xml"/> <xi:include xmlns:xi="http://www.w3.org/2001/XInclude"; href="llvm.xml"/> -- http://lists.linuxfromscratch.org/listinfo/blfs-book FAQ: http://www.linuxfromscratch.org/blfs/faq.html Unsubscribe: See the above information page
