source: server/other/svnserver.xml@ bfb7882

<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
   "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
  <!ENTITY % general-entities SYSTEM "../../general.ent">
  %general-entities;
]>

<sect1 id="svnserver" xreflabel="Running a Subversion Server">
  <?dbhtml filename="svnserver.html"?>

  <sect1info>
  <othername>$LastChangedBy$</othername>
  <date>$Date$</date>
  </sect1info>

  <title>Running a Subversion Server</title>

  <sect2 role="package">
    <title>Running a Subversion Server</title>

    <para>This section will describe how to set up, administer and secure
    a <application>Subversion</application> server.</para>

    <bridgehead renderas="sect3">Subversion Server Dependencies</bridgehead>

    <bridgehead renderas="sect4">Required</bridgehead>
    <para><xref linkend="subversion"/> and
    <xref linkend="openssh"/></para>

  </sect2>

  <sect2 role="configuration">
    <title>Setting up a Subversion Server.</title>

    <para>The following instructions will install a
    <application>Subversion</application> server, which will be set up
    to use <application>OpenSSH</application> as the secure remote access
    method, with <command>svnserve</command> available for anonymous
    access.</para>

    <para>Configuration of the <application>Subversion</application> server
    consists of the following steps:</para>

    <sect3>
      <title>1. Setup Users, Groups, and Permissions</title>

      <para>You'll need to be user
      <systemitem class='username'>root</systemitem> for the initial portion of
      configuration. Create the <systemitem class="username">svn</systemitem>
      user and group with the following commands:</para>

<screen role="root"><userinput>groupadd -g 56 svn &amp;&amp;
useradd -c "SVN Owner" -d /home/svn -m -g svn -s /bin/false -u 56 svn</userinput></screen>

      <para>If you plan to have multiple repositories, you should have a
      group dedicated to each repository for ease of administration. Create
      the <systemitem class="groupname">svntest</systemitem> group for the test
      repository and add the <systemitem class="username">svn</systemitem>
      user to that group with the following commands:</para>

<screen role="root"><userinput>groupadd -g 57 svntest &amp;&amp;
usermod -G svntest svn</userinput></screen>

      <para>Additionally you should set <command>umask 002</command> while
      working with a repository so that all new files will be writable by
      owner and group. This is made mandatory by creating a wrapper script for
      <command>svn</command> and <command>svnserve</command>:</para>

<screen role="root"><userinput>mv /usr/bin/svn /usr/bin/svn.orig &amp;&amp;
mv /usr/bin/svnserve /usr/bin/svnserve.orig &amp;&amp;
cat &gt;&gt; /usr/bin/svn &lt;&lt; "EOF"
<literal>#!/bin/sh
umask 002
/usr/bin/svn.orig "$@"</literal>
EOF
cat &gt;&gt; /usr/bin/svnserve &lt;&lt; "EOF"
<literal>#!/bin/sh
umask 002
/usr/bin/svnserve.orig "$@"</literal>
EOF
chmod 0755 /usr/bin/svn{,serve}</userinput></screen>

      <note>
        <para>If you use <application>Apache</application> for working with
        the repository over HTTP, even for anonymous access, you should wrap
        <command>/usr/sbin/httpd</command> in a similar script.</para>
      </note>

    </sect3>

    <sect3>
      <title>2. Create a Subversion repository.</title>

      <para>With subversion-1.1.0 and greater, a new type of repository
      data-store is available, FSFS. There is a tradeoff for speed with
      the new backend, however, the repository can now be placed on a
      network mount, and any corruption does not require an admin to
      recover the repository.  For more information and comparison between
      FSFS and BDB, see <ulink
      url="http://svnbook.red-bean.com/svnbook-1.1/ch05.html#svn-ch-5-sect-1.2.A"/>.
      Optionally you can pass <option>bdb</option> in place of
      <option>fsfs</option> in the following command to create a
      BerkeleyDB data-store.</para>

      <para>Create a new <application>Subversion</application> repository with
      the following commands:</para>

<screen role="root"><userinput>install -d -m0755 /srv &amp;&amp;
install -d -m0755 -o svn -g svn /srv/svn/repositories &amp;&amp;
svnadmin create --fs-type fsfs /srv/svn/repositories/svntest</userinput></screen>

      <para>Now that the repository is created, we need to populate it
      with something useful. You'll need to have a predefined directory
      layout setup exactly as you want your repository to look. For
      example, here is a sample BLFS layout setup with a root of
      <filename>svntest/</filename>. You'll need to setup a directory
      tree similar to the following:</para>

<screen><literal>          svntest/            # The name of the repository
             trunk/           # Contains the existing source tree
                BOOK/
                bootscripts/
                edguide/
                patches/
                scripts/
             branches/        # Needed for additional branches
             tags/            # Needed for tagging release points</literal></screen>

      <para>Once you've created your directory layout as shown above, you
      are ready to do the initial import:</para>

<screen role="root"><userinput>svn import -m "Initial import." \
    <replaceable>[/path/to/source/tree]</replaceable> \
    file:///srv/svn/repositories/svntest</userinput></screen>

      <para>Now go ahead and change owner and group information on the
      repository, and add an unprivileged user to the
      <systemitem class="groupname">svn</systemitem> and
      <systemitem class="groupname">svntest</systemitem> groups:</para>

<screen role="root"><userinput>chown -R svn:svntest /srv/svn/repositories/svntest &amp;&amp;
chmod -R g+w /srv/svn/repositories/svntest &amp;&amp;
chmod g+s /srv/svn/repositories/svntest/db &amp;&amp;
usermod -G svn,svntest,<replaceable>[insert existing groups]</replaceable> <replaceable>[username]</replaceable></userinput></screen>

      <para><systemitem class="groupname">svntest</systemitem> is the group
      assigned to the svntest repository. As mentioned earlier, this eases
      administration of multiple repositories when using
      <application>OpenSSH</application> for authentication. Going forward,
      you'll need to add your unprivileged user, and any additional users that
      you wish to have write access to the repository, to the
      <systemitem class="groupname">svn</systemitem> and
      <systemitem class="groupname">svntest</systemitem> groups.</para>

      <para>In addition, you'll notice that the new repository's
      <filename>db</filename> directory is set-groupID. If the reasoning is
      not immediately obvious, when using any external authentication method
      (such as <command>ssh</command>), the sticky bit is set so that all
      new files will be owned by the user, but group of
      <systemitem class="groupname">svntest</systemitem>. Anyone in the
      <systemitem class="groupname">svntest</systemitem> group can create
      files, but still give the entire group write access to those
      files. This avoids locking out other users from the repository.</para>

      <para>Now, go ahead and return to an unprivileged user account, and take a
      look at your new repository using <command>svnlook</command>:</para>

<screen><userinput>svnlook tree /srv/svn/repositories/svntest/</userinput></screen>

      <note>
        <para>You may need to log out and back in again to refresh your group
        memberships. '<command>su <replaceable>[username]</replaceable></command>'
        should work around this as well.</para>
      </note>

    </sect3>

    <sect3>
      <title>3. Configure the Server</title>

      <para>As mentioned previously, these instructions will configure the
      server to use only <command>ssh</command> for write access to the
      repository and to provide anonymous access using
      <command>svnserve</command>. There are several other ways to provide
      access to the repository. These additional configurations are best
      explained at <ulink url="http://svnbook.red-bean.com/"/>.</para>

      <para>Access configuration needs to be done for each repository.
      Create the <filename>svnserve.conf</filename> file for the svntest
      repository using the following commands:</para>

<screen role="root"><userinput>cp /srv/svn/repositories/svntest/conf/svnserve.conf \
    /srv/svn/repositories/svntest/conf/svnserve.conf.default &amp;&amp;
cat &gt; /srv/svn/repositories/svntest/conf/svnserve.conf &lt;&lt; "EOF"
<literal>[general]
anon-access = read
auth-access = write</literal>
EOF</userinput></screen>

      <para>There is not a lot to the configuration file at all. You'll
      notice that only the general section is required. Take a look at the
      <filename>svnserve.conf.default</filename> file for information on using
      <command>svnserve</command>'s built-in authentication method.</para>

    </sect3>

    <sect3 id="svnserver-init">
      <title>4. Starting the Server</title>

      <para>There are a couple of ways to start <command>svnserve</command>.
      The most common way is to start it as an <command>inetd</command> or
      <command>xinetd</command> process. Alternately, you can use a
      bootscript to start the service at startup.</para>

      <note>
        <para>If you do not wish to provide anonymous access to your svn
        repositories or use <command>svnserve</command>'s built-in
        authentication, you do not need to run
        <command>svnserve</command>.</para>
      </note>

      <para>If you use <command>inetd</command>, add a line to
      <filename>/etc/inetd.conf</filename> using the following
      commands:</para>

      <indexterm zone="svnserver svnserver-init">
        <primary sortas="e-etc-inetd.conf">/etc/inetd.conf</primary>
      </indexterm>

<screen role="root"><userinput>cat &gt;&gt; /etc/inetd.conf &lt;&lt; "EOF"
<literal>svn stream tcp nowait svn /usr/bin/svnserve svnserve -i</literal>
EOF</userinput></screen>

      <para>If you use <command>xinetd</command>, the following command will
      create the <application>Subversion</application> server file as
      <filename>/etc/xinetd.d/svn</filename>:</para>

      <indexterm zone="svnserver svnserver-init ">
        <primary sortas="e-etc-xinetd.d-svn">/etc/xinetd.d/svn</primary>
      </indexterm>

<screen role="root"><userinput>cat &gt;&gt; /etc/xinetd.d/svn &lt;&lt; "EOF"
<literal># Begin /etc/xinetd.d/svn

service svn
{
        port                    = 3690
        socket_type             = stream
        protocol                = tcp
        wait                    = no
        user                    = svn
        server                  = /usr/bin/svnserve
        server_args             = -i -r /srv/svn/repositories
}

# End /etc/xinetd.d/svn</literal>
EOF</userinput></screen>

      <para>Finally, if you wish to simply start the sever at
      startup, install the svn bootscript included in the
      <xref linkend="intro-important-bootscripts"/> package.</para>

      <indexterm zone="svnserver svnserver-init">
        <primary sortas="f-svn">svn</primary>
      </indexterm>

<screen role="root"><userinput>make install-svn</userinput></screen>

    </sect3>

  </sect2>

</sect1>