Configuring GIT - Bravery Family

First up, I found most of my information on this here:

The one thing that I didn’t realise initially is that you can’t use the gitweb URL to do clones etc.
I spent ages trying to do this, until I found Seth’s page. It explains things in a very structured manner that can be applied to most situations I suspect.

The only other thing I think I should point out is related to rewrites. If you are using them in an Apache configuration section that is higher than site that everything will be accessed from you need to remember to set the following, otherwise they will be ignored:

        RewriteEngine On
        RewriteOptions Inherit

So, in my case, I am accessing git via a VirtualHost that I have. The virtual host needed these lines adding to it otherwise the rewrite configuration in conf.d/gitweb didn’t get picked up.

To enable LDAP, I also had to do this:

        sudo a2enmod authnz_ldap
        sudo a2enmod cgi
        sudo service apache restart

In the end, to have a Git Repository authenticating with LDAP (with Group) authenticating, with GitWeb, some aliases, source IP restrictions and some rewrites to a gitweb file that looks like this:

Alias /<gitweb alias> /usr/share/gitweb
Alias /<shortened gitweb alias> /usr/share/gitweb

RewriteEngine On
RewriteRule ^/<shortened gitweb alias>/([^/]+)$ /g/?p=$1 [R,NE]
RewriteRule ^/<shortened gitweb alias>//([^/]+)/([0-9a-f]+)$ /<shortened gitweb alias>/?p=$1/.git;a=commitdiff;h=$2 [R,NE]
RewriteRule ^/<shortened gitweb alias>/([^/]+)/([0-9a-f]+)$ /<shortened gitweb alias>/?p=$1;a=commitdiff;h=$2 [R,NE]

<Directory /usr/share/gitweb>
  Options FollowSymLinks +ExecCGI
  AllowOverride all
  AddHandler cgi-script .cgi
  Order deny,allow
  Deny from all
  Allow from <restricting IP addresses>
  SSLRequireSSL
  AuthType basic
  AuthName "Private git repository"
  AuthBasicProvider ldap
  AuthLDAPURL "ldap://<ldap server>:<port>/<LDAP User DN>?<LDAP User ID>?sub?(objectClass=*)"
  Require valid-user
  AuthLDAPGroupAttribute memberUid
  AUthLDAPGroupAttributeIsDn off
  Require ldap-group <LDAP Group DN>
</Directory>

ScriptAlias /<shortened git alias>/ /usr/lib/git-core/git-http-backend/
<Directory "/usr/lib/git-core/">
  Options +ExecCGI
  SetEnv GIT_PROJECT_ROOT <path to projects>
  SetEnv GIT_HTTP_EXPORT_ALL
  Order deny,allow
  Deny from all
  Allow from <restricting IP addresses>
  SSLRequireSSL
  AuthType basic
  AuthName "Private git repository"
  AuthBasicProvider ldap
  AuthLDAPURL "ldap://<ldap server>:<port>/<LDAP User DN>?<LDAP User ID>?sub?(objectClass=*)"
  Require valid-user
  AuthLDAPGroupAttribute memberUid
  AUthLDAPGroupAttributeIsDn off
  Require ldap-group <LDAP Group DN>
</Directory>

And we are done (well other than making the virtual host allow the rewrites).

Just to prove it, here is a sample checkout:

~/temp$ git clone https://<server>/<GIT Alias>/test.git
Cloning into 'test'...
Username for 'https://<server>': <good user>
Password for 'https://<good user>@<server>': 
remote: Counting objects: 10, done.
remote: Compressing objects: 100% (6/6), done.
remote: Total 10 (delta 0), reused 4 (delta 0)
Unpacking objects: 100% (10/10), done.
~/temp$ rm -rf test
~/temp$ git clone https://<server>/<GIT Alias>/test.git
Cloning into 'test'...
Username for 'https://<server>': <bad user>
Password for 'https://<bad user>@<server>': 
fatal: Authentication failed