nginx-cgit-and-git-http-backend.md (3447B)
1 # nginx, cgit and git-http-backend 2 3 Sounds simple, right. Plug in cgit and git-http-backend with nginx to get nice web interface and working clone URL. And pushable too, of course. It turned out not to be quite that easy, but seems doable with some quirks. 4 5 There are plenty of instructions for parts of this lying around, but didn't find one that catches 'em all, so needed to some cuttin', pastin' and retryin'. The end result nginx configuration: 6 7 location ~ "(?x)^/git(?<path>/.*/(?:HEAD ' 8 info/refs ' 9 objects/(?:info/[^/]+ ' 10 [0-9a-f]{2}/[0-9a-f]{38} ' 11 pack/pack-[0-9a-f]{40}\.(?:pack ' 12 idx)) ' 13 git-upload-pack))$" { 14 error_page 491 = @auth; 15 if ($query_string = service=git-receive-pack) { 16 return 491; 17 } 18 client_max_body_size 0; 19 20 fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend; 21 include fastcgi_params; 22 fastcgi_param GIT_HTTP_EXPORT_ALL ""; 23 fastcgi_param GIT_PROJECT_ROOT /srv/git; 24 fastcgi_param PATH_INFO $path; 25 26 fastcgi_param REMOTE_USER $remote_user; 27 fastcgi_pass unix:/var/run/fcgiwrap.socket; 28 } 29 location ~ "^/git(?<path>/.*/git-receive-pack)$" { 30 error_page 491 = @auth; 31 return 491; 32 } 33 location @auth { 34 auth_basic "Git write access"; 35 auth_basic_user_file /srv/git/.htpasswd; 36 37 client_max_body_size 0; 38 39 fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend; 40 include fastcgi_params; 41 fastcgi_param GIT_HTTP_EXPORT_ALL ""; 42 fastcgi_param GIT_PROJECT_ROOT /srv/git; 43 fastcgi_param PATH_INFO $path; 44 45 fastcgi_param REMOTE_USER $remote_user; 46 fastcgi_pass unix:/var/run/fcgiwrap.socket; 47 } 48 location ~ ^/git(?<path>/.*)$ { 49 alias /usr/share/cgit; 50 try_files $1 @cgit; 51 } 52 location @cgit { 53 include fastcgi_params; 54 fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi; 55 fastcgi_param PATH_INFO $path; 56 fastcgi_param QUERY_STRING $args; 57 fastcgi_param HTTP_HOST $server_name; 58 59 fastcgi_param CGIT_CONFIG /srv/git/.cgitrc; 60 61 fastcgi_pass unix:/var/run/fcgiwrap.socket; 62 } 63 64 cgit also requires configuration, it could be done system wide with /etc/cgitrc, but I opted defining `CGIT_CONFIG` environment variable to point to a custom path, the .cgitrc ended up like something like this: 65 66 css=/git/cgit.css 67 logo=/git/cgit.png 68 69 virtual-root=/git 70 clone-url=https://$HTTP_HOST/git/$CGIT_REPO_URL 71 scan-path=/srv/git 72 73 The binary and socket paths, and cgit data path, are those used by Debian default configuration, may need adjustment for different installations. Tried to get rid of the virtual-root directive in cgitrc, but that would require setting `SCRIPT_PATH`, which fcgiwrap eats away. 74 75 For more access control, you could grab the repository name from the request paths: `"(?<path>/(?<repo>.*)/"`, and integrate the $repo into `auth_basic_user_file`.