Fossil Forum
Post: Fossil as its own CGI server, how to clone
I cannot figure out how to clone a CGI-hosted repository when the CGI server is Fossil. I'm not sure if it is possible as of now.
I have a server running Fossil directly answering port 443, something like:
fossil server \
--baseurl https://example.com \
--port 443 \
--jsmode bundled \
--cert /etc/letsencrypt/live/example.com/fullchain.pem \
--pkey /etc/letsencrypt/live/example.com/privkey.pem \
--acme \
--nojail \
--extroot /var/www/A/ext/ \
/var/www/A.fossil
I then host an additional repository using a CGI script, something like:
/var/www/A/ext/fossil:
#!/usr/bin/fossil
directory: /var/www
In /var/www, I place B.fossil.
I can interact over the HTTTPS interface with B just fine browsing to https://example.com/ext/fossil/B.
However, if I use fossil clone https://example.com/ext/fossil/B, I get a clone of repository A.
Yes, I know I could just relaunch my server as a multirepo server and I may just do that, but I wanted to know if I'm just missing how to specify the repo to clone (URI to use) to the client.
Further, I tried reading fslsrv, but that just confused me more as it looks like multiple processes are opening the same port. Is there some secret handshake these processes make?
When
I'm not sure if it is possible as of now.
I expect it's possible in principle, and that what's needed is to keep the "outer" Fossil from grabbing up the /xfer calls meant for the "inner" one.
However, this whole thing feels like an XY problem. Instead of chasing wacky fossil server + CGI lash-ups, let's get you operating on a sound foundation. Either pick CGI, or pick fossil server. If you want the latter, and you don't want --repolist, read on.
fslsrv…multiple processes are opening the same port.
You don't see the +1 for each subsequent port in the main loop?
This is then meant to work with a proxy server handling port 80+443, forwarding portions of the URL space to each Fossil repo in turn. This scheme is best justified when you have a static web site that also must expose multiple Fossils. For 100% Fossil sites, my fslsrv scheme is overkill.
The current version of that script now lives elsewhere, and with it I am serving roughly a dozen public Fossil instances off a cheapest-possible VPS, intermixed with my old static web site.
The primary feature in the current version of that script over the one in the main project repo is that I switched to a containerization scheme based on Podman 4.4+. This is superior to Fossil's own chroot(2) based scheme on many fronts. (Scroll down to "Why chroot was not enough" if you're feeling impatient.)
Yes, it's more complex, but it's also more secure. Z
fslsrv…multiple processes are opening the same port.
You don't see the +1 for each subsequent port in the main loop?
Well, I do now. :-D
For containerization, I'm using my own userns program, because understanding all these container programs is complicated and it is only about 4 Linux system calls to do the proper restrictions, once you fix-up AppArmor and userns settings in the kernel.
It seems that using repolist is my best option. I have several cgi-bin scripts that have some hard-coded URLs, so that is the worst of my problems moving in this direction. I needed to fix that hard-coding anyway.
Thanks for your kind response. Z