Fossil SCM
server docs
Commit
0c83e192c7f93579a7fa84d3f40d79b0846dc81c
Parent
c516e0d2a090470…
1 file changed
+60
-1
+60
-1
| --- www/server.wiki | ||
| +++ www/server.wiki | ||
| @@ -26,32 +26,91 @@ | ||
| 26 | 26 | <li>The option "--port NNN" will start the server on port "NNN" instead of 8080. |
| 27 | 27 | <li>If port 8080 is already being used (perhaps by another Fossil server), then |
| 28 | 28 | Fossil will use the next available port number. |
| 29 | 29 | <li>Starting either command from within an "open" Fossil checkout will start a |
| 30 | 30 | server using the repository corresponding to the checkout. |
| 31 | +<li>This is an excellent option for quickly sharing with coworkers on a small network. | |
| 32 | +<li>A huge advantage to this deployment scenario is that no special "root" or "administrator" access is required in order to share the repository. | |
| 31 | 33 | </ol> |
| 32 | 34 | </p> |
| 33 | 35 | </blockquote> |
| 34 | 36 | |
| 35 | 37 | <h2>Fossil as an ''inetd'' service</h2><blockquote> |
| 36 | 38 | <p> |
| 39 | +Modify your <tt>/etc/inetd.conf</tt> (on Linux, modify as appropriate for your platform) so it contains a line like this: | |
| 40 | +<blockquote> | |
| 41 | +<tt> | |
| 42 | +12345 stream tcp nowait.1000 root /path-to/fossil /path-to/fossil http /other-path-to/repository | |
| 43 | +</tt> | |
| 44 | +</blockquote> | |
| 45 | +In this example, you are telling "inetd" that when an incoming connection on port "12345" happens, it should launch the binary "/path-to/fossil". Obviously you will need to modify the "path-to" parts as appropriate for your particular setup. | |
| 46 | +</p> | |
| 47 | +<p> | |
| 48 | +This is a more complex setup than the "standalone" server, but it has the advantage of only using system resources when an actual connection is attempted. If no-one ever connects to that port, a Fossil server will not (automatically) run. It has the disadvantage of requiring "root" access and therefore may not normally be available to lower-priced "shared" servers on the internet. | |
| 37 | 49 | </p> |
| 38 | 50 | </blockquote> |
| 39 | 51 | |
| 40 | -<h2>Fossil as a ''CGI script''</h2> | |
| 52 | +<h2>Fossil as a ''CGI script''</h2><blockquote> | |
| 53 | +<p> | |
| 54 | +This is the most flexible and most likely to be widely usable of these deployment scenarios. In order for it to work, you must have the ability to install "CGI scripts" on the server you are interested in using. | |
| 55 | +</p> | |
| 56 | +</blockquote> | |
| 41 | 57 | |
| 42 | 58 | <h3>One script per repository</h3><blockquote> |
| 43 | 59 | <p> |
| 60 | +Create a script (let's call it 'repo') in your CGI directory which has content like this: | |
| 61 | +<blockquote><tt> | |
| 62 | +#!/path-to/fossil | |
| 63 | +repository: /path-to-repo/repository | |
| 64 | +</tt></blockquote> | |
| 65 | +</p> | |
| 66 | +<p> | |
| 67 | +It may be necessary to set permissions properly, or to modify an ".htaccess" file or other server-specific things like that. Consult with your server provider if you need that sort of assistance. | |
| 68 | +</p> | |
| 69 | +<p> | |
| 70 | +Once the script is set up correctly, and assuming your server is also set correctly, you should be able to access your repository with a URL like: <tt>http://mydomain.org/cgi-bin/repo</tt> (assuming the "repo" script is accessible under "cgi-bin", which would be a typical deployment on Apache for instance). | |
| 44 | 71 | </p> |
| 45 | 72 | </blockquote> |
| 46 | 73 | |
| 47 | 74 | <h3>Serving multiple repositories with one script</h3><blockquote> |
| 48 | 75 | <p> |
| 76 | +This scenario is almost identical to the previous one. However, here we will assume you have multiple repositories, in one directory (call it 'fossils'). So as before, create a script (again, 'repo'): | |
| 77 | +<blockquote><tt> | |
| 78 | +#!/path-to/fossil | |
| 79 | +directory: /path-to-repo/fossils | |
| 80 | +notfound: http://url-to-go-to-if-repo-not-found/ | |
| 81 | +</tt></blockquote> | |
| 82 | +</p> | |
| 83 | +<p> | |
| 84 | +Once deployed, a URL like: <tt>http://mydomain.org/cgi-bin/repo/XYZ</tt> will serve up the repository "fossils/XYX" (if it exists). This makes serving multiple projects on one server pretty painless. | |
| 49 | 85 | </p> |
| 50 | 86 | </blockquote> |
| 51 | 87 | |
| 52 | 88 | <h2>Securing a repository with SSL</h2><blockquote> |
| 53 | 89 | <p> |
| 90 | +Using either of the CGI script approaches, it is trivial to use SSL to secure the server. Simply set up the Fossil CGI scripts etc. as above, but modify the Apache (or IIS, etc.) server to require SSL (that is, a URL with "https://") in order to access the CGI script directory. This may also be accomplished (on Apache, at least) using appropriate ".htaccess" rules. | |
| 91 | +</p> | |
| 92 | +<p> | |
| 93 | +If you are using "inetd" to serve your repository, then you simply need to add "/usr/bin/stunnel" (perhaps on a different path, depending on your setup) before the command line to launch Fossil. | |
| 94 | +</p> | |
| 95 | +<p> | |
| 96 | +At this stage, the standalone server (e.g. "fossil server") does not support SSL. | |
| 97 | +</p> | |
| 98 | +</blockquote> | |
| 99 | + | |
| 100 | +<h2>Various security concerns with hosted repositories</h2><blockquote> | |
| 101 | +<p> | |
| 102 | +There are two main concerns relating to usage of Fossil for sharing sensitive information (source or any other data): | |
| 103 | +<ul> | |
| 104 | +<li>Interception of the Fossil synchronization stream, thereby capturing data, and | |
| 105 | +</ul>Direct access to the Fossil repository on the server | |
| 106 | +</p> | |
| 107 | +<p> | |
| 108 | +Regarding the first, it is adequate to secure the server using SSL, and disallowing any non-SSL access. The data stream will be encrypted by the HTTPS protocol, rendering the data reasonably secure. The truly paranoid may wish to deploy <i>ssh</i> encrypted tunnels, but that is quite a bit more difficult and cumbersome to set up (particularly for a larger number of users). | |
| 109 | +</p> | |
| 110 | +<p> | |
| 111 | +As far as direct access to the repository, the same steps must be taken as for any other internet-facing data-store. Access passwords to any disk-accessing accounts should be strong (and preferably changed from time to time). However, the data in the repository itself are <i>not</i> encrypted (unless you save encrypted data yourself), and so the system administrators of your server will be able to access your data (as with any hosting service setup). The only workaround in this case is to host the server yourself, in which case you will need to allocate resources to deal with administration issues. | |
| 54 | 112 | </p> |
| 113 | + | |
| 55 | 114 | </blockquote> |
| 56 | 115 | |
| 57 | 116 | </nowiki> |
| 58 | 117 |
| --- www/server.wiki | |
| +++ www/server.wiki | |
| @@ -26,32 +26,91 @@ | |
| 26 | <li>The option "--port NNN" will start the server on port "NNN" instead of 8080. |
| 27 | <li>If port 8080 is already being used (perhaps by another Fossil server), then |
| 28 | Fossil will use the next available port number. |
| 29 | <li>Starting either command from within an "open" Fossil checkout will start a |
| 30 | server using the repository corresponding to the checkout. |
| 31 | </ol> |
| 32 | </p> |
| 33 | </blockquote> |
| 34 | |
| 35 | <h2>Fossil as an ''inetd'' service</h2><blockquote> |
| 36 | <p> |
| 37 | </p> |
| 38 | </blockquote> |
| 39 | |
| 40 | <h2>Fossil as a ''CGI script''</h2> |
| 41 | |
| 42 | <h3>One script per repository</h3><blockquote> |
| 43 | <p> |
| 44 | </p> |
| 45 | </blockquote> |
| 46 | |
| 47 | <h3>Serving multiple repositories with one script</h3><blockquote> |
| 48 | <p> |
| 49 | </p> |
| 50 | </blockquote> |
| 51 | |
| 52 | <h2>Securing a repository with SSL</h2><blockquote> |
| 53 | <p> |
| 54 | </p> |
| 55 | </blockquote> |
| 56 | |
| 57 | </nowiki> |
| 58 |
| --- www/server.wiki | |
| +++ www/server.wiki | |
| @@ -26,32 +26,91 @@ | |
| 26 | <li>The option "--port NNN" will start the server on port "NNN" instead of 8080. |
| 27 | <li>If port 8080 is already being used (perhaps by another Fossil server), then |
| 28 | Fossil will use the next available port number. |
| 29 | <li>Starting either command from within an "open" Fossil checkout will start a |
| 30 | server using the repository corresponding to the checkout. |
| 31 | <li>This is an excellent option for quickly sharing with coworkers on a small network. |
| 32 | <li>A huge advantage to this deployment scenario is that no special "root" or "administrator" access is required in order to share the repository. |
| 33 | </ol> |
| 34 | </p> |
| 35 | </blockquote> |
| 36 | |
| 37 | <h2>Fossil as an ''inetd'' service</h2><blockquote> |
| 38 | <p> |
| 39 | Modify your <tt>/etc/inetd.conf</tt> (on Linux, modify as appropriate for your platform) so it contains a line like this: |
| 40 | <blockquote> |
| 41 | <tt> |
| 42 | 12345 stream tcp nowait.1000 root /path-to/fossil /path-to/fossil http /other-path-to/repository |
| 43 | </tt> |
| 44 | </blockquote> |
| 45 | In this example, you are telling "inetd" that when an incoming connection on port "12345" happens, it should launch the binary "/path-to/fossil". Obviously you will need to modify the "path-to" parts as appropriate for your particular setup. |
| 46 | </p> |
| 47 | <p> |
| 48 | This is a more complex setup than the "standalone" server, but it has the advantage of only using system resources when an actual connection is attempted. If no-one ever connects to that port, a Fossil server will not (automatically) run. It has the disadvantage of requiring "root" access and therefore may not normally be available to lower-priced "shared" servers on the internet. |
| 49 | </p> |
| 50 | </blockquote> |
| 51 | |
| 52 | <h2>Fossil as a ''CGI script''</h2><blockquote> |
| 53 | <p> |
| 54 | This is the most flexible and most likely to be widely usable of these deployment scenarios. In order for it to work, you must have the ability to install "CGI scripts" on the server you are interested in using. |
| 55 | </p> |
| 56 | </blockquote> |
| 57 | |
| 58 | <h3>One script per repository</h3><blockquote> |
| 59 | <p> |
| 60 | Create a script (let's call it 'repo') in your CGI directory which has content like this: |
| 61 | <blockquote><tt> |
| 62 | #!/path-to/fossil |
| 63 | repository: /path-to-repo/repository |
| 64 | </tt></blockquote> |
| 65 | </p> |
| 66 | <p> |
| 67 | It may be necessary to set permissions properly, or to modify an ".htaccess" file or other server-specific things like that. Consult with your server provider if you need that sort of assistance. |
| 68 | </p> |
| 69 | <p> |
| 70 | Once the script is set up correctly, and assuming your server is also set correctly, you should be able to access your repository with a URL like: <tt>http://mydomain.org/cgi-bin/repo</tt> (assuming the "repo" script is accessible under "cgi-bin", which would be a typical deployment on Apache for instance). |
| 71 | </p> |
| 72 | </blockquote> |
| 73 | |
| 74 | <h3>Serving multiple repositories with one script</h3><blockquote> |
| 75 | <p> |
| 76 | This scenario is almost identical to the previous one. However, here we will assume you have multiple repositories, in one directory (call it 'fossils'). So as before, create a script (again, 'repo'): |
| 77 | <blockquote><tt> |
| 78 | #!/path-to/fossil |
| 79 | directory: /path-to-repo/fossils |
| 80 | notfound: http://url-to-go-to-if-repo-not-found/ |
| 81 | </tt></blockquote> |
| 82 | </p> |
| 83 | <p> |
| 84 | Once deployed, a URL like: <tt>http://mydomain.org/cgi-bin/repo/XYZ</tt> will serve up the repository "fossils/XYX" (if it exists). This makes serving multiple projects on one server pretty painless. |
| 85 | </p> |
| 86 | </blockquote> |
| 87 | |
| 88 | <h2>Securing a repository with SSL</h2><blockquote> |
| 89 | <p> |
| 90 | Using either of the CGI script approaches, it is trivial to use SSL to secure the server. Simply set up the Fossil CGI scripts etc. as above, but modify the Apache (or IIS, etc.) server to require SSL (that is, a URL with "https://") in order to access the CGI script directory. This may also be accomplished (on Apache, at least) using appropriate ".htaccess" rules. |
| 91 | </p> |
| 92 | <p> |
| 93 | If you are using "inetd" to serve your repository, then you simply need to add "/usr/bin/stunnel" (perhaps on a different path, depending on your setup) before the command line to launch Fossil. |
| 94 | </p> |
| 95 | <p> |
| 96 | At this stage, the standalone server (e.g. "fossil server") does not support SSL. |
| 97 | </p> |
| 98 | </blockquote> |
| 99 | |
| 100 | <h2>Various security concerns with hosted repositories</h2><blockquote> |
| 101 | <p> |
| 102 | There are two main concerns relating to usage of Fossil for sharing sensitive information (source or any other data): |
| 103 | <ul> |
| 104 | <li>Interception of the Fossil synchronization stream, thereby capturing data, and |
| 105 | </ul>Direct access to the Fossil repository on the server |
| 106 | </p> |
| 107 | <p> |
| 108 | Regarding the first, it is adequate to secure the server using SSL, and disallowing any non-SSL access. The data stream will be encrypted by the HTTPS protocol, rendering the data reasonably secure. The truly paranoid may wish to deploy <i>ssh</i> encrypted tunnels, but that is quite a bit more difficult and cumbersome to set up (particularly for a larger number of users). |
| 109 | </p> |
| 110 | <p> |
| 111 | As far as direct access to the repository, the same steps must be taken as for any other internet-facing data-store. Access passwords to any disk-accessing accounts should be strong (and preferably changed from time to time). However, the data in the repository itself are <i>not</i> encrypted (unless you save encrypted data yourself), and so the system administrators of your server will be able to access your data (as with any hosting service setup). The only workaround in this case is to host the server yourself, in which case you will need to allocate resources to deal with administration issues. |
| 112 | </p> |
| 113 | |
| 114 | </blockquote> |
| 115 | |
| 116 | </nowiki> |
| 117 |