5e3a051a95
- strictly speaking, this should be phrased: "deny" rules for the
first level access check
- requires a gitolite option to be set, like so:
config gitolite-options.deny-repo = 1
196 lines
14 KiB
Markdown
196 lines
14 KiB
Markdown
# (master copy of progit chapter on gitolite)
|
|
|
|
## Gitolite ##
|
|
|
|
Note: the latest copy of this section of the ProGit book is always available within the [gitolite documentation][gldpg]. The author would also like to humbly state that, while this section is accurate, and *can* (and often *has*) been used to install gitolite without reading any other documentation, it is of necessity not complete, and cannot completely replace the enormous amount of documentation that gitolite comes with.
|
|
|
|
[gldpg]: http://sitaramc.github.com/gitolite/doc/progit-article.html
|
|
|
|
Git has started to become very popular in corporate environments, which tend to have some additional requirements in terms of access control. Gitolite was originally created to help with those requirements, but it turns out that it's equally useful in the open source world: the Fedora Project controls access to their package management repositories (over 10,000 of them!) using gitolite, and this is probably the largest gitolite installation anywhere too.
|
|
|
|
Gitolite allows you to specify permissions not just by repository, but also by branch or tag names within each repository. That is, you can specify that certain people (or groups of people) can only push certain "refs" (branches or tags) but not others.
|
|
|
|
<a name="_Installing_"></a>
|
|
|
|
### Installing ###
|
|
|
|
Installing Gitolite is very easy, even if you don't read the extensive documentation that comes with it. You need an account on a Unix server of some kind; various Linux flavours, and Solaris 10, have been tested. You do not need root access, assuming git, perl, and an openssh compatible ssh server are already installed. In the examples below, we will use the `gitolite` account on a host called `gitserver`.
|
|
|
|
Gitolite is somewhat unusual as far as "server" software goes -- access is via ssh, and so every userid on the server is a potential "gitolite host". As a result, there is a notion of "installing" the software itself, and then "setting up" a user as a "gitolite host".
|
|
|
|
Gitolite has 3 methods of installation. People using Fedora or Debian systems can obtain an RPM or a DEB and install that. People with root access can install it manually. In these two methods, any user on the system can then become a "hosting user". However, most people don't want/need to install gitolite system-wide -- they can just install it within one specific hosting user.
|
|
|
|
We will describe this last method in this article; for the other methods please see the documentation.
|
|
|
|
To begin, create a user called `git` on your server and login to this user. Copy your ssh pubkey (a file called `~/.ssh/id_rsa.pub` if you did a plain `ssh-keygen` with all the defaults) from your workstation, renaiming it to `YourName.pub`. Then run these commands:
|
|
|
|
git clone git://github.com/sitaramc/gitolite
|
|
cd gitolite
|
|
src/gl-system-install
|
|
gl-setup -q ~/YourName.pub
|
|
# for example, I would run 'gl-setup -q ~/sitaram.pub'
|
|
|
|
Finally, back on your workstation, run `git clone git@server:gitolite-admin`.
|
|
|
|
And you're done! Gitolite has now been installed on the server, and you now have a brand new repository called `gitolite-admin` in your workstation. You administer your gitolite setup by making changes to this repository and pushing. See [adding users and repos][aur] to start with.
|
|
|
|
[aur]: http://sitaramc.github.com/gitolite/doc/2-admin.html#_adding_users_and_repos
|
|
|
|
<a name="_Customising_the_Install_"></a>
|
|
|
|
### Customising the Install ###
|
|
|
|
While the default, quick, install works for most people, there are some ways to customise the install if you need to. If you omit the `-q` argument, an editor pops up with a file for you to edit, so you can change certain server-side parameters, such as the location of the actual repositories. This "rc" file is documented in [doc/gitolite.rc.mkd][rcdoc] so you should be able to make any changes you need quite easily, save it, and continue.
|
|
|
|
<a name="_Config_File_and_Access_Control_Rules_"></a>
|
|
|
|
### Config File and Access Control Rules ###
|
|
|
|
Once the install is done, you switch to the `gitolite-admin` repository (placed in your HOME directory) and poke around to see what you got:
|
|
|
|
$ cd ~/gitolite-admin/
|
|
$ ls
|
|
conf/ keydir/
|
|
$ find conf keydir -type f
|
|
conf/gitolite.conf
|
|
keydir/sitaram.pub
|
|
$ cat conf/gitolite.conf
|
|
#gitolite conf
|
|
# please see doc/gitolite.conf.mkd for details on syntax and features
|
|
|
|
|
|
repo gitolite-admin
|
|
RW+ = sitaram
|
|
|
|
repo testing
|
|
RW+ = @all
|
|
|
|
Notice that "sitaram" (the name of the pubkey in the gl-setup command you used earlier) has read-write permissions on the `gitolite-admin` repository as well as a public key file of the same name.
|
|
|
|
The config file syntax for gitolite is documented in [doc/gitolite.conf.mkd][confdoc] so we'll only mention some highlights here.
|
|
|
|
You can group users or repos for convenience. The group names are just like macros; when defining them, it doesn't even matter whether they are projects or users; that distinction is only made when you *use* the "macro".
|
|
|
|
@oss_repos = linux perl rakudo git gitolite
|
|
@secret_repos = fenestra pear
|
|
|
|
@admins = scott # Adams, not Chacon, sorry :)
|
|
@interns = ashok # get the spelling right, Scott!
|
|
@engineers = sitaram dilbert wally alice
|
|
@staff = @admins @engineers @interns
|
|
|
|
You can control permissions at the "ref" level. In the following example, interns can only push the "int" branch. Engineers can push any branch whose name starts with "eng-", and tags that start with "rc" followed by a digit. And the admins can do anything (including rewind) to any ref.
|
|
|
|
repo @oss_repos
|
|
RW int$ = @interns
|
|
RW eng- = @engineers
|
|
RW refs/tags/rc[0-9] = @engineers
|
|
RW+ = @admins
|
|
|
|
The expression after the `RW` or `RW+` is a regular expression (regex) that the refname (ref) being pushed is matched against. So we call it a "refex"! Of course, a refex can be far more powerful than shown here, so don't overdo it if you're not comfortable with perl regexes.
|
|
|
|
Also, as you probably guessed, Gitolite prefixes `refs/heads/` as a syntactic convenience if the refex does not begin with `refs/`.
|
|
|
|
An important feature of the config file's syntax is that all the rules for a repository need not be in one place. You can keep all the common stuff together, like the rules for all `oss_repos` shown above, then add specific rules for specific cases later on, like so:
|
|
|
|
repo gitolite
|
|
RW+ = sitaram
|
|
|
|
That rule will just get added to the ruleset for the `gitolite` repository.
|
|
|
|
At this point you might be wondering how the access control rules are actually applied, so let's go over that briefly.
|
|
|
|
There are two levels of access control in gitolite. The first is at the repository level; if you have read (or write) access to *any* ref in the repository, then you have read (or write) access to the repository.
|
|
|
|
The second level, applicable only to "write" access, is by branch or tag within a repository. The username, the access being attempted (`W` or `+`), and the refname being updated are known. The access rules are checked in order of appearance in the config file, looking for a match for this combination (but remember that the refname is regex-matched, not merely string-matched). If a match is found, the push succeeds. A fallthrough results in access being denied.
|
|
|
|
<a name="_Advanced_Access_Control_with_deny_rules_"></a>
|
|
|
|
### Advanced Access Control with "deny" rules ###
|
|
|
|
So far, we've only seen permissions to be one or `R`, `RW`, or `RW+`. However, gitolite allows another permission: `-`, standing for "deny". This gives you a lot more power, at the expense of some complexity, because now fallthrough is not the *only* way for access to be denied, so the *order of the rules now matters*!
|
|
|
|
Let us say, in the situation above, we want engineers to be able to rewind any branch *except* master and integ. Here's how to do that:
|
|
|
|
RW master integ = @engineers
|
|
- master integ = @engineers
|
|
RW+ = @engineers
|
|
|
|
Again, you simply follow the rules top down until you hit a match for your access mode, or a deny. Non-rewind push to master or integ is allowed by the first rule. A rewind push to those refs does not match the first rule, drops down to the second, and is therefore denied. Any push (rewind or non-rewind) to refs other than master or integ won't match the first two rules anyway, and the third rule allows it.
|
|
|
|
You can also use deny rules to hide specific repos from people (or gitweb, or git-daemon, etc.), when you have otherwise allowed them access to *all* repos. For example, a server containing open source repos may nevertheless wish to hide the special 'gitolite-admin' repo from gitweb, even though all the other repos can be made visible:
|
|
|
|
repo gitolite-admin
|
|
- = gitweb daemon
|
|
[... other access rules ...]
|
|
config gitolite-options.deny-repo = 1
|
|
|
|
repo @all
|
|
R = gitweb daemon
|
|
|
|
See the documentation for more on this.
|
|
|
|
<a name="_Restricting_pushes_by_files_changed_"></a>
|
|
|
|
### Restricting pushes by files changed ###
|
|
|
|
In addition to restricting what branches a user can push changes to, you can also restrict what files they are allowed to touch. For example, perhaps the Makefile (or some other program) is really not supposed to be changed by just anyone, because a lot of things depend on it or would break if the changes are not done *just right*. You can tell gitolite:
|
|
|
|
repo foo
|
|
RW = @junior_devs @senior_devs
|
|
|
|
RW NAME/ = @senior_devs
|
|
- NAME/Makefile = @junior_devs
|
|
RW NAME/ = @junior_devs
|
|
|
|
This powerful feature is documented in `conf/example.conf`.
|
|
|
|
<a name="_Personal_Branches_"></a>
|
|
|
|
### Personal Branches ###
|
|
|
|
Gitolite also has a feature called "personal branches" (or rather, "personal branch namespace") that can be very useful in a corporate environment.
|
|
|
|
A lot of code exchange in the git world happens by "please pull" requests. In a corporate environment, however, unauthenticated access is a no-no, and a developer workstation cannot do authentication, so you have to push to the central server and ask someone to pull from there.
|
|
|
|
This would normally cause the same branch name clutter as in a centralised VCS, plus setting up permissions for this becomes a chore for the admin.
|
|
|
|
Gitolite lets you define a "personal" or "scratch" namespace prefix for each developer (for example, `refs/personal/<devname>/*`); see the "personal branches" section in `doc/3-faq-tips-etc.mkd` for details.
|
|
|
|
<a name="_Wildcard_repositories_"></a>
|
|
|
|
### "Wildcard" repositories ###
|
|
|
|
Gitolite allows you to specify repositories with wildcards (actually perl regexes), like, for example `assignments/s[0-9][0-9]/a[0-9][0-9]`, to pick a random example. This is a *very* powerful feature, which has to be enabled by setting `$GL_WILDREPOS = 1;` in the rc file. It allows you to assign a new permission mode ("C") which allows users to create repositories based on such wild cards, automatically assigns ownership to the specific user who created it, allows him/her to hand out R and RW permissions to other users to collaborate, etc. This feature is documented in `doc/wildcard-repositories.mkd`.
|
|
|
|
<a name="_Other_Features_"></a>
|
|
|
|
### Other Features ###
|
|
|
|
We'll round off this discussion with a sampling of other features, all of which, and many more, are described in great detail in the "faqs, tips, etc" and other documents.
|
|
|
|
**Logging**: Gitolite logs all successful accesses. If you were somewhat relaxed about giving people rewind permissions (`RW+`) and some kid blew away "master", the log file is a life saver, in terms of easily and quickly finding the SHA that got hosed.
|
|
|
|
**Git outside normal PATH**: One extremely useful convenience feature in gitolite is support for git installed outside the normal `$PATH` (this is more common than you think; some corporate environments or even some hosting providers refuse to install things system-wide and you end up putting them in your own directories). Normally, you are forced to make the *client-side* git aware of this non-standard location of the git binaries in some way. With gitolite, just choose a verbose install and set `$GIT_PATH` in the "rc" files. No client-side changes are required after that :-)
|
|
|
|
**Access rights reporting**: Another convenient feature is what happens when you try and just ssh to the server. Gitolite shows you what repos you have access to, and what that access may be. Here's an example:
|
|
|
|
hello sitaram, the gitolite version here is v1.5.4-19-ga3397d4
|
|
the gitolite config gives you the following access:
|
|
R anu-wsd
|
|
R entrans
|
|
R W git-notes
|
|
R W gitolite
|
|
R W gitolite-admin
|
|
R indic_web_input
|
|
R shreelipi_converter
|
|
|
|
**Delegation**: For really large installations, you can delegate responsibility for groups of repositories to various people and have them manage those pieces independently. This reduces the load on the main admin, and makes him less of a bottleneck. This feature has its own documentation file in the `doc/` directory.
|
|
|
|
**Gitweb support**: Gitolite supports gitweb in several ways. You can specify which repos are visible via gitweb. You can set the "owner" and "description" for gitweb from the gitolite config file. Gitweb has a mechanism for you to implement access control based on HTTP authentication, so you can make it use the "compiled" config file that gitolite produces, which means the same access control rules (for read access) apply for gitweb and gitolite.
|
|
|
|
**Mirroring**: Gitolite can help you maintain multiple mirrors, and switch between them easily if the primary server goes down.
|
|
|
|
[rcdoc]:http://sitaramc.github.com/gitolite/doc/gitolite.rc.html
|
|
[confdoc]:http://sitaramc.github.com/gitolite/doc/gitolite.conf.html
|