1 | <?xml version="1.0" encoding="ISO-8859-1"?>
|
---|
2 | <!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
---|
3 | "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
|
---|
4 | <!ENTITY % general-entities SYSTEM "../../general.ent">
|
---|
5 | %general-entities;
|
---|
6 | ]>
|
---|
7 |
|
---|
8 | <sect1 id="svnserver" xreflabel="Running a Subversion Server">
|
---|
9 | <?dbhtml filename="svnserver.html"?>
|
---|
10 |
|
---|
11 | <sect1info>
|
---|
12 | <othername>$LastChangedBy$</othername>
|
---|
13 | <date>$Date$</date>
|
---|
14 | </sect1info>
|
---|
15 |
|
---|
16 | <title>Running a Subversion Server</title>
|
---|
17 |
|
---|
18 | <sect2 role="package">
|
---|
19 | <title>Running a Subversion Server</title>
|
---|
20 |
|
---|
21 | <para>
|
---|
22 | This section will describe how to set up, administer and secure
|
---|
23 | a <application>Subversion</application> server.
|
---|
24 | </para>
|
---|
25 |
|
---|
26 | <bridgehead renderas="sect3">Subversion Server Dependencies</bridgehead>
|
---|
27 |
|
---|
28 | <bridgehead renderas="sect4">Required</bridgehead>
|
---|
29 | <para role="required">
|
---|
30 | <xref linkend="subversion"/> and
|
---|
31 | <xref linkend="openssh"/>
|
---|
32 | </para>
|
---|
33 |
|
---|
34 | </sect2>
|
---|
35 |
|
---|
36 | <sect2 role="configuration">
|
---|
37 | <title>Setting up a Subversion Server.</title>
|
---|
38 |
|
---|
39 | <para>
|
---|
40 | The following instructions will install a
|
---|
41 | <application>Subversion</application> server, which will be set up
|
---|
42 | to use <application>OpenSSH</application> as the secure remote access
|
---|
43 | method, with <command>svnserve</command> available for anonymous
|
---|
44 | access.
|
---|
45 | </para>
|
---|
46 |
|
---|
47 | <para>
|
---|
48 | Configuration of the <application>Subversion</application> server
|
---|
49 | consists of the following steps:
|
---|
50 | </para>
|
---|
51 |
|
---|
52 | <sect3>
|
---|
53 | <title>1. Setup Users, Groups, and Permissions</title>
|
---|
54 |
|
---|
55 | <para>
|
---|
56 | You'll need to be user
|
---|
57 | <systemitem class='username'>root</systemitem> for the initial portion
|
---|
58 | of configuration. Create the <systemitem
|
---|
59 | class="username">svn</systemitem> user and group with the following
|
---|
60 | commands:
|
---|
61 | </para>
|
---|
62 |
|
---|
63 | <screen role="root"><userinput>groupadd -g 56 svn &&
|
---|
64 | useradd -c "SVN Owner" -d /home/svn -m -g svn -s /bin/false -u 56 svn</userinput></screen>
|
---|
65 |
|
---|
66 | <para>
|
---|
67 | If you plan to have multiple repositories, you should have a
|
---|
68 | group dedicated to each repository for ease of administration. Create
|
---|
69 | the <systemitem class="groupname">svntest</systemitem> group for the
|
---|
70 | test repository and add the <systemitem
|
---|
71 | class="username">svn</systemitem> user to that group with the
|
---|
72 | following commands:
|
---|
73 | </para>
|
---|
74 |
|
---|
75 | <screen role="root"><userinput>groupadd -g 57 svntest &&
|
---|
76 | usermod -G svntest -a svn</userinput></screen>
|
---|
77 |
|
---|
78 | <para>
|
---|
79 | Additionally you should set <command>umask 002</command> while
|
---|
80 | working with a repository so that all new files will be writable by
|
---|
81 | owner and group. This is made mandatory by creating a wrapper script
|
---|
82 | for <command>svn</command> and <command>svnserve</command>:
|
---|
83 | </para>
|
---|
84 |
|
---|
85 | <screen role="root"><userinput>mv /usr/bin/svn /usr/bin/svn.orig &&
|
---|
86 | mv /usr/bin/svnserve /usr/bin/svnserve.orig &&
|
---|
87 | cat >> /usr/bin/svn << "EOF"
|
---|
88 | <literal>#!/bin/sh
|
---|
89 | umask 002
|
---|
90 | /usr/bin/svn.orig "$@"</literal>
|
---|
91 | EOF
|
---|
92 | cat >> /usr/bin/svnserve << "EOF"
|
---|
93 | <literal>#!/bin/sh
|
---|
94 | umask 002
|
---|
95 | /usr/bin/svnserve.orig "$@"</literal>
|
---|
96 | EOF
|
---|
97 | chmod 0755 /usr/bin/svn{,serve}</userinput></screen>
|
---|
98 |
|
---|
99 | <note>
|
---|
100 | <para>
|
---|
101 | If you use <application>Apache</application> for working with
|
---|
102 | the repository over HTTP, even for anonymous access, you should wrap
|
---|
103 | <command>/usr/sbin/httpd</command> in a similar script.
|
---|
104 | </para>
|
---|
105 | </note>
|
---|
106 |
|
---|
107 | </sect3>
|
---|
108 |
|
---|
109 | <sect3>
|
---|
110 | <title>2. Create a Subversion repository.</title>
|
---|
111 |
|
---|
112 | <para>
|
---|
113 | There are several ways to set up a subversion repository. It is
|
---|
114 | recommended to have a look at the <ulink
|
---|
115 | url="http://svnbook.red-bean.com/nightly/en/svn.reposadmin.html">SVN
|
---|
116 | Book</ulink> corresponding chapter. A basic repository can be set up
|
---|
117 | with the instructions below.
|
---|
118 | </para>
|
---|
119 |
|
---|
120 | <para>
|
---|
121 | Create a new <application>Subversion</application> repository with
|
---|
122 | the following commands (as the <systemitem class="username">root
|
---|
123 | </systemitem> user):
|
---|
124 | </para>
|
---|
125 |
|
---|
126 | <screen role="root"><userinput>install -v -m 0755 -d /srv/svn &&
|
---|
127 | install -v -m 0755 -o svn -g svn -d /srv/svn/repositories &&
|
---|
128 | svnadmin create /srv/svn/repositories/svntest</userinput></screen>
|
---|
129 |
|
---|
130 | <para>
|
---|
131 | Now that the repository is created, it should be populated with
|
---|
132 | something useful. You'll need to have a predefined directory
|
---|
133 | layout set up exactly as you want your repository to look. For
|
---|
134 | example, here is a sample BLFS layout setup with a root of
|
---|
135 | <filename>svntest/</filename>. You'll need to setup a directory
|
---|
136 | tree similar to the following:
|
---|
137 | </para>
|
---|
138 |
|
---|
139 | <screen><literal>svntest/ # The name of the repository
|
---|
140 | trunk/ # Contains the existing source tree
|
---|
141 | BOOK/
|
---|
142 | bootscripts/
|
---|
143 | edguide/
|
---|
144 | patches/
|
---|
145 | scripts/
|
---|
146 | branches/ # Needed for additional branches
|
---|
147 | tags/ # Needed for tagging release points</literal></screen>
|
---|
148 |
|
---|
149 | <para>
|
---|
150 | Once you've created your directory layout as shown above, you
|
---|
151 | are ready to do the initial import:
|
---|
152 | </para>
|
---|
153 |
|
---|
154 | <screen role="root"><userinput>svn import -m "Initial import." \
|
---|
155 | <replaceable></path/to/source/tree></replaceable> \
|
---|
156 | file:///srv/svn/repositories/svntest</userinput></screen>
|
---|
157 |
|
---|
158 | <para>
|
---|
159 | Now change owner and group information on the
|
---|
160 | repository, and add an unprivileged user to the
|
---|
161 | <systemitem class="groupname">svn</systemitem> and
|
---|
162 | <systemitem class="groupname">svntest</systemitem> groups:
|
---|
163 | </para>
|
---|
164 |
|
---|
165 | <screen role="root"><userinput>chown -R svn:svntest /srv/svn/repositories/svntest &&
|
---|
166 | chmod -R g+w /srv/svn/repositories/svntest &&
|
---|
167 | chmod g+s /srv/svn/repositories/svntest/db &&
|
---|
168 | usermod -G svn,svntest -a <replaceable><username></replaceable></userinput></screen>
|
---|
169 |
|
---|
170 | <para>
|
---|
171 | <systemitem class="groupname">svntest</systemitem> is the group
|
---|
172 | assigned to the svntest repository. As mentioned earlier, this eases
|
---|
173 | administration of multiple repositories when using
|
---|
174 | <application>OpenSSH</application> for authentication. Going forward,
|
---|
175 | you'll need to add your unprivileged user, and any additional users
|
---|
176 | that you wish to have write access to the repository, to the
|
---|
177 | <systemitem class="groupname">svn</systemitem> and <systemitem
|
---|
178 | class="groupname">svntest</systemitem> groups.
|
---|
179 | </para>
|
---|
180 |
|
---|
181 | <para>
|
---|
182 | In addition, you'll notice that the new repository's
|
---|
183 | <filename>db</filename> directory is set-groupID. If the reasoning is
|
---|
184 | not immediately obvious, when using any external authentication method
|
---|
185 | (such as <command>ssh</command>), the sticky bit is set so that all
|
---|
186 | new files will be owned by the user, but group of
|
---|
187 | <systemitem class="groupname">svntest</systemitem>. Anyone in the
|
---|
188 | <systemitem class="groupname">svntest</systemitem> group can create
|
---|
189 | files, but still give the entire group write access to those
|
---|
190 | files. This avoids locking out other users from the repository.
|
---|
191 | </para>
|
---|
192 |
|
---|
193 | <para>
|
---|
194 | Now, return to an unprivileged user account, and take a
|
---|
195 | look at the new repository using <command>svnlook</command>:
|
---|
196 | </para>
|
---|
197 |
|
---|
198 | <screen><userinput>svnlook tree /srv/svn/repositories/svntest/</userinput></screen>
|
---|
199 |
|
---|
200 | <note>
|
---|
201 | <para>
|
---|
202 | You may need to log out and back in again to refresh your group
|
---|
203 | memberships. <command>su
|
---|
204 | <replaceable><username></replaceable></command>
|
---|
205 | should work as well.
|
---|
206 | </para>
|
---|
207 | </note>
|
---|
208 |
|
---|
209 | </sect3>
|
---|
210 |
|
---|
211 | <sect3>
|
---|
212 | <title>3. Configure the Server</title>
|
---|
213 |
|
---|
214 | <para>
|
---|
215 | As mentioned previously, these instructions will configure the
|
---|
216 | server to use only <command>ssh</command> for write access to the
|
---|
217 | repository and to provide anonymous access using
|
---|
218 | <command>svnserve</command>. There are several other ways to provide
|
---|
219 | access to the repository. These additional configurations are best
|
---|
220 | explained at <ulink url="http://svnbook.red-bean.com/"/>.
|
---|
221 | </para>
|
---|
222 |
|
---|
223 | <para>
|
---|
224 | Access configuration needs to be done for each repository.
|
---|
225 | Create the <filename>svnserve.conf</filename> file for the svntest
|
---|
226 | repository using the following commands:
|
---|
227 | </para>
|
---|
228 |
|
---|
229 | <screen role="root"><userinput>cp /srv/svn/repositories/svntest/conf/svnserve.conf \
|
---|
230 | /srv/svn/repositories/svntest/conf/svnserve.conf.default &&
|
---|
231 |
|
---|
232 | cat > /srv/svn/repositories/svntest/conf/svnserve.conf << "EOF"
|
---|
233 | <literal>[general]
|
---|
234 | anon-access = read
|
---|
235 | auth-access = write</literal>
|
---|
236 | EOF</userinput></screen>
|
---|
237 |
|
---|
238 | <para>
|
---|
239 | There is not a lot to the configuration file at all. You'll notice
|
---|
240 | that only the general section is required. Take a look at the
|
---|
241 | <filename>svnserve.conf.default</filename> file for information on
|
---|
242 | using <command>svnserve</command>'s built-in authentication method.
|
---|
243 | </para>
|
---|
244 |
|
---|
245 | </sect3>
|
---|
246 |
|
---|
247 | <sect3 id="svnserver-init">
|
---|
248 | <title>4. Starting the Server</title>
|
---|
249 |
|
---|
250 | <para revision="sysv">
|
---|
251 | To start the server at boot time, install the svn
|
---|
252 | bootscript included in the <xref linkend="bootscripts"/> package:
|
---|
253 | </para>
|
---|
254 |
|
---|
255 | <para revision="systemd">
|
---|
256 | To start the server at boot time, install the
|
---|
257 | <filename>svnserve.service</filename> unit from the
|
---|
258 | <xref linkend="systemd-units"/> package:
|
---|
259 | </para>
|
---|
260 |
|
---|
261 | <indexterm zone="svnserver svnserver-init" revision="sysv">
|
---|
262 | <primary sortas="f-svn">svn</primary>
|
---|
263 | </indexterm>
|
---|
264 |
|
---|
265 | <screen role="root" revision="sysv"><userinput>make install-svn</userinput></screen>
|
---|
266 |
|
---|
267 | <indexterm zone="svnserver svnserver-init" revision="systemd">
|
---|
268 | <primary sortas="f-svnserve">svnserve</primary>
|
---|
269 | </indexterm>
|
---|
270 |
|
---|
271 | <screen role="root" revision="systemd"><userinput>make install-svnserve</userinput></screen>
|
---|
272 |
|
---|
273 | <para revision="systemd">
|
---|
274 | Additionally, the instructions above require
|
---|
275 | that svn server uses <command>umask 002</command> so that all new files
|
---|
276 | will be writable by owner and group. This can be achieved by creating
|
---|
277 | a systemd unit override file by running the following command:
|
---|
278 | </para>
|
---|
279 |
|
---|
280 | <screen role="root" revision="systemd"><userinput>mkdir -p /etc/systemd/system/svnserve.service.d
|
---|
281 | echo "UMask=0002" > /etc/systemd/system/svnserve.service.d/99-user.conf</userinput></screen>
|
---|
282 |
|
---|
283 | <para revision="systemd">
|
---|
284 | Options which are passed to
|
---|
285 | <command>svnserve</command> daemon can be changed in
|
---|
286 | <filename>/etc/default/svnserve</filename>.
|
---|
287 | </para>
|
---|
288 |
|
---|
289 | </sect3>
|
---|
290 |
|
---|
291 | </sect2>
|
---|
292 |
|
---|
293 | </sect1>
|
---|