inz.fi

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs

nginx-cgit-and-git-http-backend.md (3447B)


      1 # nginx, cgit and git-http-backend
      2 
      3  Sounds simple, right. Plug in cgit and git-http-backend with nginx to get nice web interface and working clone URL. And pushable too, of course. It turned out not to be quite that easy, but seems doable with some quirks.
      4 
      5  There are plenty of instructions for parts of this lying around, but didn't find one that catches 'em all, so needed to some cuttin', pastin' and retryin'. The end result nginx configuration:
      6 
      7 	location ~ "(?x)^/git(?<path>/.*/(?:HEAD '
      8 	                             info/refs '
      9 	                             objects/(?:info/[^/]+ '
     10 	                                        [0-9a-f]{2}/[0-9a-f]{38} '
     11 	                                        pack/pack-[0-9a-f]{40}\.(?:pack '
     12 	                                                                   idx)) '
     13 	                             git-upload-pack))$" {
     14 	        error_page 491 = @auth;
     15 	        if ($query_string = service=git-receive-pack) {
     16 	                return 491;
     17 	        }
     18 	        client_max_body_size                    0;
     19 	
     20 	        fastcgi_param   SCRIPT_FILENAME         /usr/lib/git-core/git-http-backend;
     21 	        include         fastcgi_params;
     22 	        fastcgi_param   GIT_HTTP_EXPORT_ALL     "";
     23 	        fastcgi_param   GIT_PROJECT_ROOT        /srv/git;
     24 	        fastcgi_param   PATH_INFO               $path;
     25 	
     26 	        fastcgi_param   REMOTE_USER             $remote_user;
     27 	        fastcgi_pass    unix:/var/run/fcgiwrap.socket;
     28 	}
     29 	location ~ "^/git(?<path>/.*/git-receive-pack)$" {
     30 	        error_page 491 = @auth;
     31 	        return 491;
     32 	}
     33 	location @auth {
     34 	        auth_basic            "Git write access";
     35 	        auth_basic_user_file  /srv/git/.htpasswd;
     36 	
     37 	        client_max_body_size                    0;
     38 	
     39 	        fastcgi_param   SCRIPT_FILENAME         /usr/lib/git-core/git-http-backend;
     40 	        include         fastcgi_params;
     41 	        fastcgi_param   GIT_HTTP_EXPORT_ALL     "";
     42 	        fastcgi_param   GIT_PROJECT_ROOT        /srv/git;
     43 	        fastcgi_param   PATH_INFO               $path;
     44 	
     45 	        fastcgi_param   REMOTE_USER             $remote_user;
     46 	        fastcgi_pass    unix:/var/run/fcgiwrap.socket;
     47 	}
     48 	location ~ ^/git(?<path>/.*)$ {
     49 	        alias /usr/share/cgit;
     50 	        try_files $1 @cgit;
     51 	}
     52 	location @cgit {
     53 	        include         fastcgi_params;
     54 	        fastcgi_param   SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
     55 	        fastcgi_param   PATH_INFO       $path;
     56 	        fastcgi_param   QUERY_STRING    $args;
     57 	        fastcgi_param   HTTP_HOST       $server_name;
     58 	
     59 	        fastcgi_param   CGIT_CONFIG     /srv/git/.cgitrc;
     60 	
     61 	        fastcgi_pass    unix:/var/run/fcgiwrap.socket;
     62 	}
     63 
     64 cgit also requires configuration, it could be done system wide with /etc/cgitrc, but I opted defining `CGIT_CONFIG` environment variable to point to a custom path, the .cgitrc ended up like something like this:
     65 
     66 	css=/git/cgit.css
     67 	logo=/git/cgit.png
     68 	
     69 	virtual-root=/git
     70 	clone-url=https://$HTTP_HOST/git/$CGIT_REPO_URL
     71 	scan-path=/srv/git
     72 
     73 The binary and socket paths, and cgit data path, are those used by Debian default configuration, may need adjustment for different installations. Tried to get rid of the virtual-root directive in cgitrc, but that would require setting `SCRIPT_PATH`, which fcgiwrap eats away.
     74 
     75 For more access control, you could grab the repository name from the request paths: `"(?<path>/(?<repo>.*)/"`, and integrate the $repo into `auth_basic_user_file`.