Differences between revisions 115 and 118 (spanning 3 versions)
Revision 115 as of 2011-06-15 10:40:01
Size: 39531
Editor: PaulBoddie
Comment: Added notes about specifying the configuration file and single repository publishing.
Revision 118 as of 2011-08-18 23:40:23
Size: 37273
Comment: Don't mention Apache httpd index.cgi and CGI directory - it just add confusiond and shouldn't be used
Deletions are marked like this. Additions are marked like this.
Line 10: Line 10:
{i} Note that starting with version 1.6 of Mercurial, the `hgwebdir.cgi` script no longer exists, and its functionality has been merged into the `hgweb.cgi` script. If you want to publish multiple repositories with older versions of Mercurial, follow the [[#multiple|appropriate instructions]], substituting `hgwebdir.cgi` for `hgweb.cgi`. {i} Note that starting with version 1.6 of Mercurial, the `hgwebdir.cgi` script no longer exists, and its functionality has been merged into the `hgweb.cgi` script which in most cases can be used with the same configuration.
Line 12: Line 12:
||<#cccccc style="text-align: center;" |7>'''Web-based''' ||[[hgserve|hg serve]] ||HTTP ||off by default ||yes ||built-in ||push has no authentication, so can only be used on trusted internal networks ||
||[[StaticHTTP|static HTTP
]] ||<style="text-align: center;" |5>HTTP/HTTPS ||no ||no ||does not require hg or CGI support on the server ||very slow ||
||[[#single
|hgweb]] {*} ||off by default ||yes ||can use existing web server (CGI, WSGI, mod_python), including authentication, '''supports multiple repositories since Mercurial 1.6<<BR>>''' ||web server config can be hard to debug ||
||[[#multiple|hgwebdir]] {*}
||off by default ||yes ||can use existing web server (CGI, WSGI, [[http://www.aventinesolutions.nl/mediawiki/index.php/Quick_Tip:_Getting_Started_with_Mercurial#hgwebdir.py|mod_python]]), including authentication, '''supports multiple repositories, merged into hgweb since Mercurial 1.6''' ||slightly more work to setup than hgweb ||
||[[HgServeNginx|hg serve behind a proxy (Nginx)]] [[HgServeNginxWindows|(Windows setup)]]||yes ||yes ||multiple repos, permits authentication, no CGI ||requires proxy (Nginx, HAProxy) ||
||[[MercurialHosting|third-party hosting]] ||yes ||yes ||minimal setup ||not locally administered, may have fees ||
||[[RhodeCode|Rhodecode]] ||HTTP/HTTPS ||yes ||yes ||permissions system, full text search, code statistics, easy templating, server side forking and repository creation ||requires more resources, longer setup ||
||<#999999 style="text-align: center;" |3>'''Private/internal''' ||ssh ||SSH ||yes ||no ||no additional setup ||requires Unix server, per-user accounts and repositories ||
||<#cccccc style="text-align:center;  " |6>'''Web-based''' ||[[MercurialHosting|third-party hosting]] ||<style="text-align:center;" |6>HTTP/HTTPS ||yes ||yes ||minimal setup ||not locally administered, may have fees ||
||[[#hg
web|hgweb]] ||off by default ||yes ||can use existing web server (CGI, WSGI, [[http://www.aventinesolutions.nl/mediawiki/index.php/Quick_Tip:_Getting_Started_with_Mercurial#hgwebdir.py|mod_python]]), including authentication ||web server config can be hard to debug ||
||[[hgserve|hg serve]] ||off by default ||yes ||simple and built-in ||push has no authentication
, so can only be used on trusted internal networks ||
||[[HgServeNginx|hg serve behind a proxy (Nginx)]] [[HgServeNginxWindows|(Windows setup)]] ||yes ||yes ||multiple repos, permits authentication, no CGI ||requires proxy (Nginx, HAProxy) ||
||[[RhodeCode|Rhodecode]] ||yes ||yes ||permissions system, full text search, code statistics, easy templating, server side forking and repository creation ||requires more resources, longer setup ||
||[[StaticHTTP|static HTTP]] ||no ||no ||does not require hg or CGI support on the server ||very slow ||
||<#999999 style="text-align:center;  " |3>'''Private/internal''' ||ssh ||SSH ||yes ||no ||no additional setup ||requires Unix server, per-user accounts and repositories ||
Line 26: Line 25:
(!) See also this [[HgWebDirStepByStep|comprehensive guide]] to acquiring Mercurial and configuring hgwebdir.

(!) If using a recent Apache, use [[modwsgi|mod_wsgi]] instead of mod_python or CGI as it has better performance.
Line 32: Line 27:
{*} Recommended solutions for public sharing of repositories are described below.
Line 35: Line 28:
The easiest way to share changes with other people using Mercurial is to publish them on the Web. The recommended method for publishing repositories over HTTP is to use the [[#hgweb|hgweb]] scripts. This is a simple way to quickly [[#single|publish a single repository]] or [[#multiple|publish multiple repositories]] easily. The easiest way to share changes with other people using Mercurial is to publish them on the Web. The recommended method for self-publishing repositories over HTTP is to use the [[#hgweb|hgweb]] scripts.
Line 60: Line 53:
The `hgweb.cgi` (and, in earlier releases, `hgwebdir.cgi`) script is provided in the top-level directory of the source distribution of Mercurial. If you should find yourself without such a script, perhaps because you are using a binary installation of Mercurial, you can do one of the following: (!) Much better performance can be achieved by using WSGI instead of CGI. If using a recent Apache, see [[modwsgi|mod_wsgi]].

The `hgweb.cgi` script is provided in the top-level directory of the source distribution of Mercurial. If you should find yourself without such a script, perhaps because you are using a binary installation of Mercurial, you can do one of the following:
Line 71: Line 66:
{i} Note that in Mercurial 1.5.x and earlier, the `hgwebdir.cgi` script also exists specifically for the publishing of multiple repositories (whilst `hgweb.cgi` is only able to serve single repositories).
Line 77: Line 70:
 1. Rename it to `index.cgi` if you want, then edit its contents. In particular, you will need to edit it so that it is reading the correct config file.  1. Edit its contents. In particular, you will need to edit it so that it is reading the correct config file.
Line 80: Line 73:
If Mercurial is not installed system-wide, uncomment and edit the Python path in `hgweb.cgi` (or `index.cgi`) as indicated: If Mercurial is not installed system-wide, uncomment and edit the Python path in `hgweb.cgi` as indicated:
Line 119: Line 112:
<<Anchor(single)>>

== Publishing a single repository ==

/!\ This section only applies to older versions of Mercurial and the `hgweb.cgi` script bundled with those versions. If you are using a newer version, see the section on publishing [[#multiple|multiple repositories]].

You will need to edit the call to `hgweb.hgweb` as indicated in the following example:

{{{#!python numbers=disable
h = hgweb.hgweb("/home/user/hg/myproject", "My Project")
}}}
While you could use this mechanism to publish multiple repositories, it requires a little work to configure each copy of the script to have slightly different paths.
Line 134: Line 114:
== Publishing multiple repositories ==
To publish multiple repositories with the `hgweb.cgi` script takes some work to initially set up, but once it's working, it lets you publish new repositories easily and cheaply. Its advantage is that to publish a repository, you simply place a clone in a particular directory, then add one line to a config file to tell the CGI script that it is allowed to publish that repository.
== Configuration ==
`hgweb.cgi` must be configured before it can be used. It must either be told which configuration file to use to find the repositories to serve or told which single repository to serve.
Line 138: Line 118:
Line 145: Line 124:
Line 151: Line 129:
Line 200: Line 177:
==== Public and Private Repositories ==== <<Anchor(single)>>

=== Publishing a single repository ===
If you just want to serve a single repository (like `hg serve` does by default) you will need to edit the call to `hgweb()` in `hgweb.cgi` to specify the path to the repository instead of a configuration file. You can also specify a descriptive name for the repository. For example:

{{{#!python numbers=disable
application = hgweb("/home/user/hg/myproject", "My Project")
}}}
=== Public and Private Repositories ===
Line 226: Line 211:
=== Publishing the CGI script directly === === Using httpd.conf ===
Line 237: Line 222:

<<Anchor(directory)>>

=== Using a simple CGI directory ===
''This example requires access to the main configuration files.''

If the directory containing the script is supposed to hold this and other CGI programs, such a CGI directory can be configured as follows:

{{{
ScriptAlias /hg "/home/user/webdir"
}}}
This should permit URLs like `http://www.example.com/hg/hgweb.cgi` to show the repository browser. To hide the `hgweb.cgi` script name in URLs, more work is required (and is mentioned below).

{i} See the [[http://httpd.apache.org/docs/2.2/mod/mod_alias.html#scriptalias|Apache httpd documentation]] for `ScriptAlias`, especially for information about the pitfalls of putting CGI directories inside existing Web-accessible directories.

Publishing Mercurial Repositories

This document focuses on public publication of repositories over the Internet, although private/internal sharing of repositories is mentioned below.

1. Choosing a publishing method

There are a variety of different ways to publish your Mercurial repositories. Some are more powerful than others but may require more effort to set up and administer. See below for some general recommendations.

{i} Note that starting with version 1.6 of Mercurial, the hgwebdir.cgi script no longer exists, and its functionality has been merged into the hgweb.cgi script which in most cases can be used with the same configuration.

Solution

Mechanism

Push?

Browsable

Advantages

Disadvantages

Web-based

third-party hosting

HTTP/HTTPS

yes

yes

minimal setup

not locally administered, may have fees

hgweb

off by default

yes

can use existing web server (CGI, WSGI, mod_python), including authentication

web server config can be hard to debug

hg serve

off by default

yes

simple and built-in

push has no authentication, so can only be used on trusted internal networks

hg serve behind a proxy (Nginx) (Windows setup)

yes

yes

multiple repos, permits authentication, no CGI

requires proxy (Nginx, HAProxy)

Rhodecode

yes

yes

permissions system, full text search, code statistics, easy templating, server side forking and repository creation

requires more resources, longer setup

static HTTP

no

no

does not require hg or CGI support on the server

very slow

Private/internal

ssh

SSH

yes

no

no additional setup

requires Unix server, per-user accounts and repositories

shared SSH

SSH (but with shared accounts)

yes

no

easy key management, fine-grained permissions

requires Unix server, not built in

shared disk

NFS/Samba etc.

yes

no

can use existing setup

generally restricted to intranets, not generally recommended due to general issues with network filesystem reliability

(!) See also various other guides about configuring Mercurial's Web interface using various technologies.

1.1. Quick recommendations

The easiest way to share changes with other people using Mercurial is to publish them on the Web. The recommended method for self-publishing repositories over HTTP is to use the hgweb scripts.

Less desirable are the following:

  • Use the hg serve command. This is Mercurial's built-in Web server. It is not really recommended except for temporary situations where you need to publish a repository for a few minutes, for example to pull changes from a laptop.

  • Make the plain repository available. This uses a much slower 'serverless' protocol called static-http. We won't cover it here, see StaticHTTP instead.

For private or restricted-access repositories, aside from the solutions explicitly marked as "private/internal" in the table above, authentication measures (certificates, logins) can be applied to many of the "public" solutions in order to restrict access.

2. Introduction and prerequisites

In this document we assume that repositories reside in the /home/user/hg directory. For example, a repository called myproject would reside in /home/user/hg/myproject.

To implement the mechanisms described in this document, you will need the following:

  • Some control over the behaviour of the Web server you use.
  • (Optional) control over the DNS domain you use.

With control over DNS, such as that provided with various Web hosting service control panels, you should be able to set up a subdomain; this makes the URL of your repositories a little tidier, so that http://hg.example.com/myproject can be used instead of http://www.example.com/hgweb.cgi/myproject, for example.

Such an approach, known as virtual hosting, is entirely optional. To implement it for the fictional example.com, a CNAME record for hg.example.com would be defined for the same address as that already used by the Web server.

3. Getting the hgweb scripts

(!) Much better performance can be achieved by using WSGI instead of CGI. If using a recent Apache, see mod_wsgi.

The hgweb.cgi script is provided in the top-level directory of the source distribution of Mercurial. If you should find yourself without such a script, perhaps because you are using a binary installation of Mercurial, you can do one of the following:

  • Download a source package corresponding to the version of Mercurial you are using, unpack it, and extract the script. This can be useful if you have other reasons for looking at the source or the templates.

  • Browse or clone a repository containing the Mercurial sources (see the developer information for details), and download or extract the appropriate version of the script directly from that repository.

  • If you're using a recent Mercurial release, just download the latest version of hgweb.cgi from the official repository.

{i} If your Mercurial installation is provided by a package which does not include hgweb.cgi, please consider filing a bug report or feature request with the package maintainer.

4. Setting up the hgweb scripts

To setup the hgweb.cgi script to publish a single repository or multiple repositories, perform the following steps:

  1. Find the hgweb.cgi script in the root of your Mercurial source tree.

  2. Copy it to a directory where your Web server can access it. This will be illustrated below using /home/user/webdir as this directory.

  3. Edit its contents. In particular, you will need to edit it so that it is reading the correct config file.
  4. Make sure the Web server (such as Apache) is configured and can execute the script.

If Mercurial is not installed system-wide, uncomment and edit the Python path in hgweb.cgi as indicated:

# adjust python path if not a system-wide install:
import sys
sys.path.insert(0, "/home/user/lib")

{i} It is recommended to use the hgweb.cgi script that is the same version as the version of Mercurial that is installed on your system. If you are using Debian and installed the Mercurial package, you can find the hgweb.cgi script in /usr/share/doc/mercurial-common/examples/ or /usr/share/doc/mercurial/examples/ (depending on your version).

/!\ If you choose to create a symbolic link to the hgweb.cgi script in your Mercurial source tree instead of copying it, you might run into Python library problems as it might try to use the libraries from the source tree instead of the ones already installed on your system.

4.1. Indicating the locations of the hgrc configuration file

Mercurial will generally look in a number of places when hgweb requests configuration information:

  • A particular repository's .hg/hgrc file

  • The user's .hgrc file, which for hgweb will probably reside in your Web server user's home directory, such as /home/www-data/.hgrc or /var/www/.hgrc (depending on how the user is set up)

  • A system-wide hgrc file like /etc/mercurial/hgrc

It is possible, however, to change the script to look in other places by adding the following before lines which start with from mercurial import. For example:

import os
os.environ["HGRCPATH"] = "/home/user/config"

For the above example to work, it is assumed that an hgrc file resides in /home/user/config.

4.2. Indicating the encoding of served content

/!\ The encoding configuration should not generally be changed unless served content appears incorrectly.

When hgweb serves content, the locale under which hgweb is operating will dictate which encoding shall be specified in (and used by) the generated Web pages. However, it may be the case that repository content - that is, files managed by a repository - and some metadata are encoded differently from this particular locale. For example, a remote system used to serve repositories using hgweb may use a particular locale with a particular encoding (ISO-8859-1, for example), yet the repositories being served may employ a different encoding (UTF-8, for example).

To change the encoding of served content, you can either change the locale under which hgweb operates, or you can add the following to the hgweb.cgi script before lines which start with from mercurial import. For example:

import os
os.environ["HGENCODING"] = "UTF-8"

The above example might be appropriate on systems running hgweb under a non-UTF-8 locale where users working with repositories have used UTF-8 as their character encoding.

5. Configuration

hgweb.cgi must be configured before it can be used. It must either be told which configuration file to use to find the repositories to serve or told which single repository to serve.

5.1. Referencing the configuration file

A configuration file, referred to as hgweb.config in this document (although another name can be chosen), needs to be created and referenced in the hgweb.cgi script. This can be done by changing the script as follows:

# Path to repo or hgweb config to serve (see 'hg help hgweb')
config = "hgweb.config"

Here, a file called hgweb.config will be read from the same directory as the hgweb.cgi script. You may instead choose to place the file in another directory, and to avoid confusion an absolute path is recommended. For example:

config = "/home/user/hgweb.config"

Even if you only want to publish a single repository, but expect the repository name to appear as part of the URL (perhaps because you intend to publish more repositories later and will need to distinguish between them), specifying a configuration file in the script is the most appropriate solution. You may then specify the details of the single repository in the configuration file as described below.

To publish a single repository at the precise location at which the hgweb.cgi script is published, a repository path can be specified instead. This emulates the behaviour of hgweb.cgi in older versions of Mercurial, as described above.

5.2. Setting up the configuration file

In the /home/user/webdir directory, create a file called hgweb.config. Here are the contents of an hgweb.config file:

[paths]
myproject = /home/user/hg/myproject
otherproject = /home/user/hg/otherproject

The paths setting in this file tells the CGI script which repositories it is allowed to publish and how their published locations map to their actual locations in the filesystem.

  • The keys (on the left) are URL paths which can incorporate / characters - these paths appear as part of the URL used to access a repository

  • The values (on the right) are filesystem paths which can be relative to the CGI directory - note that it is typically preferable to keep the repositories outside the CGI directory

{i} If you are publishing a fixed set of repositories, using the paths setting should be sufficient, and you should not need to consider the collections setting described below.

5.2.1. Working with collections

Where many repositories are being served, it can be preferable to refer to each directory holding such collections of repositories instead of listing each and every repository as is done above. The above hgweb.config file could be rewritten as follows:

[collections]
/home/user/hg = /home/user/hg

The collections setting in this file tells the CGI script where to look for repositories.

  • The keys (on the left) and the values (on the right) are both filesystem paths

  • The keys should be prefixes of the values and are "subtracted" from the values in order to generate the URL paths to each repository

Consider two repository collections given in the hgweb.config file:

[collections]
/home/user/private = /home/user/private
/home/user/official = /home/user/official

Where both /home/user/private and /home/user/official contain repositories using the same names (myproject and otherproject), a combined list will then be shown by the Web interface containing two entries for each of someproject and otherproject: one from the private collection and one from the official collection. This may be confusing to the end-user, so we may modify the configuration file as follows:

[collections]
/home/user = /home/user

This will now produce entries for private/someproject, private/otherproject, official/someproject and official/otherproject. Unfortunately, it will also find other repositories outside the private and official directories. It is therefore recommended that repositories are located in suitably organised directory hierarchies if exported in this way.

5.3. Publishing a single repository

If you just want to serve a single repository (like hg serve does by default) you will need to edit the call to hgweb() in hgweb.cgi to specify the path to the repository instead of a configuration file. You can also specify a descriptive name for the repository. For example:

application = hgweb("/home/user/hg/myproject", "My Project")

5.4. Public and Private Repositories

If you want to serve both public and private repositories, you'll need to put them under different web URIs, like http://hg.example.com/hg-public and http://hg.example.com/hg-private. You will also need two different configuration files for hgweb.cgi, which in turn means two different copies of the hgweb.cgi script itself.

The actual public/private distinction will mostly be enforced by your web server configuration. Since the two repositories (or collections of repositories) have different paths, you can require different levels of authentication for each path.

6. Configuring Apache

There are many ways of configuring Apache to run CGI scripts, and a few of the possibilities are provided below. Where the main configuration files are mentioned, you should use the appropriate conventions for your system in defining such files in the conf.d and/or sites-available directories.

{i} To ensure that a script is executable by the Web server, the following command is typically used:

chmod u+x hgweb.cgi

{i} The preferred mechanism for persuading Apache to use updated configuration information can vary from platform to platform and from distribution to distribution. Please consult your distribution's documentation, if appropriate, or the more general Apache documentation (for example, the apachectl documentation) for details.

Note that only the hgweb.cgi script should be "published" by the Web server.

This script is perfectly capable of serving repositories once it knows where these repositories are. You do not need (or even want) the actual repositories to be published by the Web server itself: the CGI script will, when run, read from the repositories and output the necessary content itself.

In short, do not put the actual repositories under some kind of "document root" or "public HTML" directory - this is the static HTTP approach and is completely different from what is being documented here. Here, we are using the hgweb.cgi script to serve up repositories.

6.1. Using httpd.conf

This example requires access to the main configuration files.

The easiest way to serve the hgweb.cgi script is to use a ScriptAlias directive:

ScriptAlias /hg "/home/user/webdir/hgweb.cgi"

This actually exports the repository browser at the URL path /hg (for example, http://www.example.com/hg) and doesn't expose the name of the script at all.

{i} See the Apache httpd documentation for ScriptAlias.

6.2. Using an .htaccess file

This example can be used with pre-configured CGI directories.

If you may not change the main Apache configuration files, you may still be able to use .htaccess file to make URLs nicer, as suggested in the previous section. Here is an .htaccess file which sits in the published webdir directory on the Web server and redirects http://www.example.com/hg/* URLs to the hgweb.cgi script inside that folder. As a result it would no longer be not necessary to mention the CGI script name in URLs: one could use http://www.example.com/hg/myproject instead of http://www.example.com/hg/hgweb.cgi/myproject.

# Taken from http://www.pmwiki.org/wiki/Cookbook/CleanUrls#samedir
# Used at http://ggap.sf.net/hg/
Options +ExecCGI
RewriteEngine On
#write base depending on where the base url lives
RewriteBase /hg
RewriteRule ^$ hgweb.cgi  [L]
# Send requests for files that exist to those files.
RewriteCond %{REQUEST_FILENAME} !-f
# Send requests for directories that exist to those directories.
RewriteCond %{REQUEST_FILENAME} !-d
# Send requests to hgweb.cgi, appending the rest of url.
RewriteRule (.*) hgweb.cgi/$1  [QSA,L]

A corresponding change in hgweb.config can be made to make sure that the nicer urls are used in the HTML produced by the CGI scripts:

[web]
baseurl = /hg

Where the CGI scripts are made to appear at the server root (for example, http://hg.example.com/), leave the baseurl setting blank:

[web]
baseurl =

Generally, the value specified should not end with a / character.

6.3. Adding authentication

The following configurations requires access to the main configuration files. They can be combined with the script or directory declarations to impose authentication and access restrictions on repositories.

To use these configurations with the pre-configured CGI directories, the Location directive start and end tags can be omitted, leaving the bare authentication-related directives.

6.3.1. Restrict to known users

This configuration restricts access to a known set of users as defined in the /home/user/hg/hgusers password file:

<Location /hg>
    AuthType Basic
    AuthName "Mercurial repositories"
    AuthUserFile /home/user/hg/hgusers
    Require valid-user
</Location>

<!> Since the AuthType directive is set to Basic, passwords are communicated as plain text, and it is therefore recommended that this only be used with a server configured for HTTPS. See the Apache SSL documentation for more information.

{i} To set up the password file, use the htpasswd tool as described in the relevant Apache documentation.

This alternative configuration employs digest authentication and thus offers an alternative to basic authentication and HTTPS:

<Location /hg>
    AuthType Digest
    AuthName "Mercurial repositories"
    AuthDigestProvider file
    AuthUserFile /home/user/hg/hgusers
    Require valid-user
</Location>

{i} To set up the password file, use the htdigest tool as described in the relevant Apache documentation.

{i} See the Apache mod_auth_digest documentation for more information on digest authentication and its limitations.

6.3.2. Restrict pushing to known users

To exercise finer control and to provide global read-only access to the repositories, but require authentication for pushing, a LimitExcept directive can be added. Here are the previous examples with such a directive in use. First with basic authentication:

<Location /hg>
    AuthType Basic
    AuthName "Mercurial repositories"
    AuthUserFile /home/user/hg/hgusers
    <LimitExcept GET>
        Require valid-user
    </LimitExcept>
</Location>

And with digest authentication:

<Location /hg>
    AuthType Digest
    AuthName "Mercurial repositories"
    AuthDigestProvider file
    AuthUserFile /home/user/hg/hgusers
    <LimitExcept GET>
        Require valid-user
    </LimitExcept>
</Location>

{i} See the Apache documentation for LimitExcept for more information.

Now consult the instructions on allowing the push operation in Mercurial to complete this configuration task.

6.3.3. Using groups

Apache also provides support for user groups through the AuthGroupFile directive. Here it is in context:

    AuthUserFile /home/user/hg/hgusers
    AuthGroupFile /home/user/hg/hggroups

Instead of a Require directive involving users, the following directive can be used in its place. Here it is in context:

    <LimitExcept GET>
        Require group hobbits
    </LimitExcept>

Here, the hobbits group is defined in the nominated file as described in the relevant Apache documentation for AuthGroupFile, connecting users who will authenticate themselves with groups such as hobbits.

6.3.4. Public and Private Repositories

As was mentioned earlier, public versus private is mostly enforced by the web server configuration. In this case, we will assume that we have made two copies of the hgweb.cgi script under /home/user/webdir. One will be named hgweb-public.cgi and the other hgweb-private.cgi. These scripts will in turn each load a different configuration file. The public configuration will serve our public repositories, and the private configuration will serve our private repositories.

ScriptAlias /hg-public /home/user/webdir/hgweb-public.cgi

<Location /hg-public>
    AuthType Basic
    AuthName "Mercurial repositories"
    AuthUserFile /home/user/hg/hgusers

    <LimitExcept GET>
        Require user valid-user
    </LimitExcept>
</Location>

ScriptAlias /hg-private /home/user/webdir/hgweb-private.cgi

<Location /hg-private>
    AuthType Basic
    AuthName "Mercurial repositories"
    AuthUserFile /home/user/hg/hgusers
    Require valid-user
</Location>

With this configuration, the public repositories are read-only without authentication.

{i} Note that the above configuration is built from details given in previous sections, combining the different activities of publishing, authentication and access control.

6.4. Using virtual hosts

This example requires access to the main configuration files.

Here is an example Apache configuration for publishing repositories at http://hg.example.com/:

<VirtualHost *>
  ServerName hg.example.com

  ServerAdmin webmaster@example.com
  CustomLog logs/access_log.example combined
  ErrorLog logs/error_log.example

  ScriptAlias / "/home/user/webdir/hgweb.cgi"
</VirtualHost>

The ScriptAlias directive is taken from the script example; all other directives support the virtual host hg.example.com.

{i} Note that the CustomLog and ErrorLog directives may need to be changed to refer to files in standard locations such as /var/log/apache2 or /var/log/httpd, depending on how Apache is configured.

Here is a more complicated example using rewrite rules and explicit Directory directives. A description follows the example.

<VirtualHost *:80>
  ServerName hg.example.com

  ServerAdmin webmaster@example.com
  CustomLog logs/access_log.example combined
  ErrorLog logs/error_log.example

  RewriteEngine on
  RewriteRule (.*) /home/user/webdir/hgweb.cgi/$1

  # Or we can use mod_alias for starting CGI script and making URLs "nice":
  # ScriptAliasMatch ^(.*) /home/user/webdir/hgweb.cgi/$1

  <Directory "/home/user/webdir/">
    Order allow,deny
    Allow from all
    AllowOverride All
    Options ExecCGI
    AddHandler cgi-script .cgi
  </Directory>
</VirtualHost>

The directives in the above have the following purposes:

  • The ServerName directive matches the hostname configured for the domain.

  • The next section (ServerAdmin and so on) is just administrative cruft.

  • The rewrite-related directives (RewriteEngine and RewriteRule) tell Apache to turn URIs ending in /myproject into /home/user/webdir/hgweb.cgi/myproject. This causes Apache to fire up the CGI script, giving it the remainder of the URI as an argument.

  • Finally, the Directory section lets Apache know that we have a CGI script to look at.

{i} See the Apache virtual hosts documentation for more information.

7. Allowing push

Make sure that your repository is writeable by the user running the Apache server (such as www-data), and that the repository's .hg/hgrc file (or your Web server user's .hgrc file, such as /home/www-data/.hgrc, or a system-wide hgrc file like /etc/mercurial/hgrc) contains the allowed users:

[web]
allow_push = frodo, sam

This would allow pushing for frodo and sam. You can allow pushing for everyone with the following:

[web]
allow_push = *

By default, pushing is only allowed via HTTPS. To permit HTTP pushing you have to add this to your repository's .hg/hgrc file (or your Web server user's .hgrc file, such as /home/www-data/.hgrc, or a system-wide hgrc file like /etc/mercurial/hgrc):

[web]
push_ssl = false

Now consult the instructions on configuring Apache to restrict pushing in order to set up the authentication/authorisation infrastructure.

7.1. Defining user credentials

To define credentials for the allowed users, use the htpasswd tool. For example:

htpasswd -c /home/user/hg/hgusers frodo

You will need to enter the desired password for the username frodo. Later, you can add more usernames without the -c option:

htpasswd /home/user/hg/hgusers sam

{i} See the relevant Apache documentation for htpasswd.

7.2. Write permissions on repositories

Repositories can only successfully receive pushed changesets if the Web server user has write access to each repository's .hg directory and its contents. See the permissions troubleshooting section below for details of errors and remedies related to permissions.

8. Troubleshooting

Mercurial is executed on the server by Apache and therefore runs as the Apache user and group. If experiencing flaky behavior, it may be because the CGI script is failing because it does not have enough rights. In that case, you should check the log files, but you can also make some common-sense permissions checks.

8.1. Permissions

There are two ways that permissions problems primarily manifest themselves on the server: either you won't see any repositories at all (indicating missing read or execute permissions) or you won't be able to push to the server (indicating missing write permissions), which gives you the error message:

abort: ‘http://foo/bar’ does not appear to be an hg repository!

Another common error often related to permissions:

abort: HTTP Error 500: Internal Server Error

The best way to solve permissions problems is to grant the required permissions to the Apache group (the www-data group on Debian). You should have some familiarity with assigning permissions under Linux/Unix before attempting the following.

Suppose your main user is john, your Web server runs as www-data and your repositories are in /home/john/repositories. Then, execute the following commands to change the group for all files in your repositories on the server and make the files writable to the server process as well as make the home directory readable.

chown -R john:www-data /home/john/repositories
chmod -R g+rw /home/john/repositories
chmod g+x /home/john/repositories

For each repository, you will have to make both the repository folder and the .hg folder executable as well:

chmod g+x /home/john/repositories/rep1
chmod g+x /home/john/repositories/rep1/.hg

If each of your repositories are subdirectories from some main folder which only contains repositories (such as /var/www/html/hg/repos, with underlying repositories /var/www/html/hg/repos/repo1, /var/www/html/hg/repos/repo2, and so on), you may find it easier to remember to script the setting of these permissions. Write the following at the prompt to create a new executable shell script:

cat <<EOM >permission.sh
chown -R john:www-data repos
chmod -R g+rw repos
chmod g+x repos
chmod g+x repos/*
chmod g+x repos/*/.hg
EOM
sudo chown root:root permission.sh
sudo chmod u+x permission.sh

These assume your username is john, the Apache server's user's group is www-data, and the folder containing your repositories is called repos. Now you can update permissions for your entire repository by navigating to this containing directory and issuing a single command:

sudo ./permission.sh

Before you start crawling through logs to find out why your Mercurial server isn't letting you pull, push, or authenticate, run this command and see if it solves your issue.

It is important to note that the entire repository tree must be accessible by the Web server user (www-data in the above examples). For example, the tree /home/john/source/repos/hg/repo1 requires john, source, repos, and hg to be executable by the Web server user.

8.2. HTTP Error 400: Bad Request

A similar problem with pulling through http proxies is discussed here.

This error may occur when you try to push/pull changes to/from the web server. Mercurial will send out a long (~7k bytes) request line that the server refuses to process.

In Apache 2.2, the LimitRequestLine defaults to 8190 (bytes). To circumvent the problem, try increasing the request line limit e.g to 16380.

8.3. Mercurial in verbose mode

This problem (reported as a bug against Mercurial) might potentially be solved in future Mercurial versions.

On certain occasions, observed when attempting to clone a repository via hgweb.cgi, the Web server will produce a 500 (Internal Server Error) status code, aborting the operation. This is due to extra output being sent by Mercurial to the Web server as part of an HTTP response.

If your repository's .hg/hgrc file (or your Web server user's .hgrc file, such as /home/www-data/.hgrc, or a system-wide hgrc file like /etc/mercurial/hgrc) includes the following setting, you should consider removing or disabling it (or moving it to your normal user's .hgrc file, if appropriate):

verbose = true

8.4. Using an unsupported version of Python

When the Web server produces a 500 (Internal Server Error) status code, the error log may contain messages resembling the following:

/var/lib/python-support/python2.6/mercurial/hgweb/common.py:24: DeprecationWarning: BaseException.message has been deprecated as of Python 2.6

Such messages are likely to upset the Web server if issued by CGI scripts. The solution is either to use an appropriate version of Python for the version of Mercurial in use or to suppress deprecation warnings.

In the above example, Python 2.6 is being used to run code which uses deprecated features and has not been reviewed for use with that version of Python. If an earlier version of Python is available, such as Python 2.5, and if Mercurial has been set up for use by that Python version, you can change the first line of hgweb.cgi as follows (assuming a system-wide installation of Python 2.5):

#!/usr/bin/python2.5

To suppress warnings, it may be sufficient to modify hgweb.cgi, adding the following code immediately after any sys.path adjustments:

import warnings
warnings.simplefilter("ignore", DeprecationWarning)

Note that this latter solution is not really recommended as it can hide issues with the code that should ultimately be addressed.

8.5. Problems with trust settings

Trust-related messages of the form Not trusting file... may appear in the Web server logs. Although it is unlikely that such messages would cause a 500 (Internal Server Error) status code, it can be useful to eliminate them in order to troubleshoot other problems.

9. Putting useful information in the index page

If you get everything working properly, pointing a browser at the CGI script directly should give a list of the repositories you've published. This will be a table containing four columns. Let's say you have published a repository named lord/rings. To fill out the first three columns of the index entry for that repository, you will need to edit its .hg/hgrc file, and add a new section:

[web]
contact = Bilbo Baggins
description = My precious!
name = lord/rings

10. Allowing archive downloads

Make sure that your repository's .hg/hgrc file (or your Web server user's .hgrc file, such as /home/www-data/.hgrc, or a system-wide hgrc file like /etc/mercurial/hgrc) contains the allow_archive setting:

[web]
allow_archive = gz, zip, bz2

This example illustrates how gzip, zip and bzip2 archive formats can be supported. As a result, links should appear in the Web interface corresponding to these archive types.

11. What can go wrong?

If the version of hgweb.cgi is newer than the version of Mercurial you have installed, you may experience strange results. This could happen if you use a binary installer for Mercurial, and manually fetch hgweb.cgi from a source repository. Newer versions of Mercurial support older versions of the CGI scripts, so you usually do not have to upgrade all your CGI installations, though it might be useful.

If you are trying to publish repositories, and you haven't configured Apache to force all accesses to go through the hgweb.cgi script, you will not be able to access any of the repositories you have published. You may then be tempted to copy repositories into a directory published by your Web server, perhaps setting up a hgweb.cgi script in each published repository. Do not do this! Only the hgweb.cgi script is meant to be published; when correctly functioning, the script will itself serve up the repository content, not the Web server.

Whatever mechanism you are trying to use, the important thing is to ensure that all accesses go through hgweb.cgi, so that Apache can pass the rest of the path to it using the PATH_INFO environment variable.

12. Theming

The hgweb interface is completely themable. See the Theming page for additional instructions on customizing the look of your site.

13. See also


CategoryWeb CategoryHowTo CategoryTipsAndTricks

PublishingRepositories (last edited 2020-12-06 23:19:24 by PaulBoddie)