European Commission SVN+WebDAV install documentation

Transcription

1 EUROPEAN COMMISSION DIRECTORATE-GENERAL FOR INFORMATICS ISA Integrated Collaborative Platform European Commission SVN+WebDAV install documentation Date: 25/07/2013 Version: Authors: everis Revised by: Approved by: Public: Reference Number:

2 TABLE OF CONTENTS 1.OVERVIEW OF THE SERVER DIRECTORIES AND FILESYSTEMS SCRIPTS SETUP Scripts description Pre-requisistes Files setup Common configuration "pwauth" setup and configuration "svncron" specific configuration APACHE CONFIGURATION Required modules Configuration file MAPPING AND TESTS OVERVIEW OF THE SERVER The server is a standard LAMP machine. It hosts several Apache instances (we will use the one listening on the 8082 TCP port) and a single MySQL instance. 2. DIRECTORIES AND FILESYSTEMS Under the DocumentRoot {yourdocumentroot}, create the following directories: misc: this directory will host the DAV lock database (actually two files called dav_lock.db.{dir,pag}); it can be simply created through FTP as long as it is set groupwritable. scripts: this directory will host the scripts. Their setup is described later in this document. scripts/tmp: this directory will store temporary and/od lock files for the scripts. It must be writable by the webrun user. subversion: this directory is a mountpoint for a 50G filesystem (mounted from a SAN) dedicated to host the Subversion repositories themselves. It must be writable by the webrun user. webdav: this directory is a mountpoint for a 100G filesystem (mounted from a SAN) dedicated to host the WebDAV directories themselves. It must be writable by the webrun user.

3 3. SCRIPTS SETUP 3.1. SCRIPTS DESCRIPTION bin/pwauth is a PHP script that will be called by the Apache daemon to tell whether a given user/password is allowed to access a given Subversion path. Data are passed as environment variables. bin/svncommit will be called through a SVN hook for each new SVN commit in order to register it in the Drupal database. bin/svncron will be run regularly though Cron to create new SVN repositories PRE-REQUISISTES The drupal database of the project should exist and be reachable over MySQL/TCP with a dedicated user, having only the usage privileges (select, insert, update, delete). A local MySQL database should exist and be reachable over a local Unix socket with an "usersvn@localhost" user, having all privileges on the database FILES SETUP The subversion service comes with a bunch of scripts available on the Subversion repository of the project: trunk : <last_version> tag: o Go to: o And then <last_version>/isasvn 1. Export the content of this directory into {yourdocumentroot}/scripts/appsvn. 2. Edit each file in the "bin/" directory and fix their shebang line (e.g. #!/usr/bin/php becomes #!/myapache/bin/php) COMMON CONFIGURATION Most SVN-related scripts read the conf/appsvn-conf.inc.php file: <?php /* */ Common configuration for SVN scripts. // The local server is a MySQL database located on the current machine // It does not contain anything but a cache table used to check whether a given // user/password couple is valid or not. define('local_server', 'localhost'); // connection through Unix socket define('local_db_username', 'usersvn'); define('local_db_password', 'xxxxxxxxxxxxxx'); define('local_db_name', 'svn_local'); // The APPLICATION server is the MySQL database of the Drupal application. define(' APPLICATION _SERVER', 'xxx.xx.xx.xx'); define(' APPLICATION _DB_USERNAME', 'usersvn'); define(' APPLICATION _DB_PASSWORD', 'xxxxxxxxxxxxxx'); define(' APPLICATION _DB_NAME', 'drupal_db');

4 // This directory will host lock files define('lock_dir', '{yourdocumentroot}/scripts/tmp'); // Name of the table storing repositories operations // Note this value must include the Drupal table prefix, if any define('repositories_management_table', 'repositories_management'); // Name of the table storing commit operations // Note this value must include the Drupal table prefix, if any define('commit_management_table', 'commit_management'); // Parent directory for all Subversion repositories // Note the directory must exist and be writable. define('svn_root_dir', '{yourdocumentroot}/subversion'); // Skeleton directory when creating a Subversion repository // Do not define this constant if you do not want repositories to be initialized this way define('svn_skeleton', dirname( FILE ). '/svn-skeleton'); define('svn_skeleton_commit_message', 'Repository initialization'); define('svn_skeleton_commit_author', 'Application Subversion service'); // This prefix will be stripped from the received URI when authenticating a user. // the service is given through the AuthExternalContext Apache directive $service = ($_ENV['CONTEXT'] == 'subversion')? 'svn' : 'webdav'; //Allows to use different permissions define('auth_context', $service); if (preg_match("/^(\/(?:app application)-$service)/", getenv('uri'), $matches)) { $prefix = $matches[1]; define('svn_uri_prefix', $prefix); } 3.5. "PWAUTH" SETUP AND CONFIGURATION For the pwauth script to work, create the structures contained in doc/auth_cache.sql. As soon as you have an existing SVN repository (e.g. "deploytest"), you can test pwauth this way: URI=/application-svn/deploytest USER=user PASS=pass bin/pwauth; echo $? This should output either 0 (access granted) or 1 (access denied). If needed, the following debug statements can be added to the script: $debug = TRUE; $debug_file = '/tmp/debug.txt'; if ($debug) { if (file_exists($debug_file)) 0600); } $fh = fopen($debug_file, 'a'); fwrite($fh, sprintf('[%s] authenticating %s/%s for %s (%s)'. "\n", date('d-m-y H:i:s'), getenv('user'), getenv('pass'), getenv('uri'), $prefix)); fwrite($fh, print_r($_env, TRUE)); fclose($fh); }

5 For security reasons, this debug shall be turned off when the problem is solved. Also, the /tmp/debug.txt file shall be deleted "SVNCRON" SPECIFIC CONFIGURATION The conf/post-commit.tmpl file is copied in each newly created repository (in its "hooks" subdirectory) by svncron. The content of the "conf/svn-skeleton" directory is imported as an initial commit for each newly created repository. 1. Edit conf/post-commit.tmpl and fix the paths it contains (php + svncommit itself). 2. Require the svncron script to be scheduled: */1 * * * * {yourdocumentroot}/scripts/appsvn/bin/svncron > /dev/null 2>&1 4. APACHE CONFIGURATION 4.1. REQUIRED MODULES Ensure the Apache is compiled with the prefork MPM. Indeed, mod_dav_svn does not appear to be thread-safe and thus cannot be used along with the worker MPM. $ /myapache/2.2.14/bin/httpd -l egrep '(prefork worker)' prefork.c Ensure the following modules are enabled: LoadModule authnz_external_module modules/mod_authnz_external.so LoadModule dav_module mod_dav.so LoadModule dav_fs_module modules/mod_dav_fs.so LoadModule dav_lock_module mod_dav_lock.so LoadModule dav_svn_module mod_dav_svn.so Note mod_authnz_external is not a standard Apache module and has to be fetched from its official website CONFIGURATION FILE Integrate the following directives in Apache configuration file: # External authentication configuration # This script allows authenticating WebDAV and Subversion users against a Drupal database AddExternalAuth pwauth {yourdocumentroot}/scripts/appsvn/bin/pwauth # Data are passed to the script as environment variables SetExternalAuthMethod pwauth environment <Directory "{yourdocumentroot}/scripts"> Order Deny,Allow Deny From All

6 # WebDAV configuration <IfModule mod_dav_fs.c> DavLockDB {yourdocumentroot}/misc/dav_lock.db # Prevents direct access to data stored in the DocumentRoot <Directory "{yourdocumentroot}/misc"> Order Deny,Allow Deny From All # WebDAV root directory Alias /app-webdav "{yourdocumentroot}/webdav" Alias /application-webdav "{yourdocumentroot}/webdav" <Directory "{yourdocumentroot}/webdav"> DAV on Options Indexes FollowSymLinks AuthType Basic AuthName "WebDAV service" AuthBasicProvider external AuthExternal pwauth AuthExternalContext webdav Require valid-user # Subversion configuration <IfModule mod_dav_svn.c> # Subversion root directory <Location /app-svn> DAV svn SVNParentPath {yourdocumentroot}/subversion Options Indexes FollowSymLinks <LimitExcept GET OPTIONS PROPFIND REPORT> AuthType Basic AuthName "Subversion service" AuthBasicProvider external AuthExternal pwauth AuthExternalContext subversion Require valid-user </LimitExcept> </Location> <Location /application-svn> DAV svn SVNParentPath {yourdocumentroot}/subversion Options Indexes FollowSymLinks <LimitExcept GET OPTIONS PROPFIND REPORT> AuthType Basic AuthName "Subversion service" AuthBasicProvider external AuthExternal pwauth AuthExternalContext subversion Require valid-user </LimitExcept> </Location>

7 # Prevents direct access to data stored in the DocumentRoot <Directory "{yourdocumentroot}/subversion"> Order Deny,Allow Deny From All Notes: Both services can be reached from /application-<servicename> or /app- <servicename>; this was made because the final "application" name was decided shortly after the request for a SNET mapping involving the "app-" prefix. In the Subversion configuration: it is not possible to fully merge the <Location> directives in a single <LocationMatch> because the SVNParentPath directive has a tricky behaviour when it comes to extract the SVN path from the received request URI. See for details. However, the <LimitExcept> and Options could be moved to a common <LocationMatch>. 5. MAPPING AND TESTS Test the services work when accessed: Subversion: svn co WebDAV: cadaver url-your-application /application-webdav/deploytest Note: for the moment, WebDav directories still have to be created manually (a simple mkdir will do the trick).