diff --git a/.bumpversion.cfg b/.bumpversion.cfg
new file mode 100644
--- /dev/null
+++ b/.bumpversion.cfg
@@ -0,0 +1,5 @@
+[bumpversion]
+current_version = 4.0.0
+message = release: Bump version {current_version} to {new_version}
+
+[bumpversion:file:rhodecode/VERSION]
diff --git a/.coveragerc b/.coveragerc
new file mode 100644
--- /dev/null
+++ b/.coveragerc
@@ -0,0 +1,18 @@
+[run]
+
+branch = True
+
+include =
+ rhodecode/lib/*
+ rhodecode/model/*
+ rhodecode/controllers/*
+
+omit =
+ rhodecode/lib/vcs/remote/*
+ rhodecode/lib/dbmigrate/*
+
+[report]
+
+exclude_lines =
+ raise NotImplementedError
+
diff --git a/.jshintrc b/.jshintrc
new file mode 100644
--- /dev/null
+++ b/.jshintrc
@@ -0,0 +1,38 @@
+{
+ /*
+ * ENVIRONMENTS
+ * =================
+ */
+
+ // Define globals exposed by modern browsers.
+ "browser": true,
+
+ // Define globals exposed by jQuery.
+ "jquery": true,
+
+ /*
+ * ENFORCING OPTIONS
+ * =================
+ */
+
+ // Prohibit use of == and != in favor of === and !==.
+ "eqeqeq": true,
+
+ // Enforce tab width of 2 spaces.
+ "indent": 2,
+
+ // Prohibit use of a variable before it is defined.
+ "latedef": true,
+
+ // Enforce line length to 100 characters
+ "maxlen": 100,
+
+ // Require capitalized names for constructor functions.
+ "newcap": true,
+
+ // Enforce placing 'use strict' at the top function scope
+ "strict": true,
+
+ // Prohibit use of explicitly undeclared variables.
+ "undef": true
+}
diff --git a/.release.cfg b/.release.cfg
new file mode 100644
--- /dev/null
+++ b/.release.cfg
@@ -0,0 +1,31 @@
+[DEFAULT]
+done = false
+
+[task:fixes_on_stable]
+done = true
+
+[task:changelog_updated]
+done = true
+
+[task:nix_dependencies_moved]
+done = true
+
+[task:bump_version]
+done = true
+
+[task:generate_js_routes]
+done = true
+
+[task:generate_api_docs]
+done = true
+
+[release]
+state = prepared
+version = 3.8.3
+
+[task:updated_translation]
+
+[task:updated_trial_license]
+
+[task:generate_oss_licenses]
+
diff --git a/.tx/config b/.tx/config
new file mode 100644
--- /dev/null
+++ b/.tx/config
@@ -0,0 +1,18 @@
+[main]
+host = https://www.transifex.com
+
+[RhodeCode.pot]
+source_file = rhodecode/i18n/rhodecode.pot
+source_lang = en
+type = PO
+
+trans.be = rhodecode/i18n/be/LC_MESSAGES/rhodecode.po
+trans.de = rhodecode/i18n/de/LC_MESSAGES/rhodecode.po
+trans.es = rhodecode/i18n/es/LC_MESSAGES/rhodecode.po
+trans.fr = rhodecode/i18n/fr/LC_MESSAGES/rhodecode.po
+trans.it = rhodecode/i18n/it/LC_MESSAGES/rhodecode.po
+trans.ja = rhodecode/i18n/ja/LC_MESSAGES/rhodecode.po
+trans.pl = rhodecode/i18n/pl/LC_MESSAGES/rhodecode.po
+trans.pt = rhodecode/i18n/pt/LC_MESSAGES/rhodecode.po
+trans.ru = rhodecode/i18n/ru/LC_MESSAGES/rhodecode.po
+trans.zh = rhodecode/i18n/zh/LC_MESSAGES/rhodecode.po
diff --git a/CHANGES.rst b/CHANGES.rst
new file mode 100644
--- /dev/null
+++ b/CHANGES.rst
@@ -0,0 +1,1 @@
+.. include:: docs/release-notes/release-notes.rst
\ No newline at end of file
diff --git a/Gruntfile.js b/Gruntfile.js
new file mode 100644
--- /dev/null
+++ b/Gruntfile.js
@@ -0,0 +1,137 @@
+module.exports = function(grunt) {
+ grunt.initConfig({
+
+ dirs: {
+ css: "rhodecode/public/css",
+ js: {
+ "src": "rhodecode/public/js/src",
+ "dest": "rhodecode/public/js"
+ }
+ },
+
+ concat: {
+ dist: {
+ src: [
+ // Base libraries
+ '<%= dirs.js.src %>/jquery-1.11.1.min.js',
+ '<%= dirs.js.src %>/logging.js',
+ '<%= dirs.js.src %>/bootstrap.js',
+ '<%= dirs.js.src %>/mousetrap.js',
+ '<%= dirs.js.src %>/moment.js',
+ '<%= dirs.js.src %>/appenlight-client-0.4.1.min.js',
+
+ // Plugins
+ '<%= dirs.js.src %>/plugins/jquery.pjax.js',
+ '<%= dirs.js.src %>/plugins/jquery.dataTables.js',
+ '<%= dirs.js.src %>/plugins/flavoured_checkbox.js',
+ '<%= dirs.js.src %>/plugins/jquery.auto-grow-input.js',
+ '<%= dirs.js.src %>/plugins/jquery.autocomplete.js',
+ '<%= dirs.js.src %>/plugins/jquery.debounce.js',
+ '<%= dirs.js.src %>/plugins/jquery.timeago.js',
+ '<%= dirs.js.src %>/plugins/jquery.timeago-extension.js',
+
+ // Select2
+ '<%= dirs.js.src %>/select2/select2.js',
+
+ // Code-mirror
+ '<%= dirs.js.src %>/codemirror/codemirror.js',
+ '<%= dirs.js.src %>/codemirror/codemirror_loadmode.js',
+ '<%= dirs.js.src %>/codemirror/codemirror_hint.js',
+ '<%= dirs.js.src %>/codemirror/codemirror_overlay.js',
+ '<%= dirs.js.src %>/codemirror/codemirror_placeholder.js',
+ // TODO: mikhail: this is an exception. Since the code mirror modes
+ // are loaded "on the fly", we need to keep them in a public folder
+ '<%= dirs.js.dest %>/mode/meta.js',
+ '<%= dirs.js.dest %>/mode/meta_ext.js',
+ '<%= dirs.js.dest %>/rhodecode/i18n/select2/translations.js',
+
+ // Rhodecode utilities
+ '<%= dirs.js.src %>/rhodecode/utils/array.js',
+ '<%= dirs.js.src %>/rhodecode/utils/string.js',
+ '<%= dirs.js.src %>/rhodecode/utils/pyroutes.js',
+ '<%= dirs.js.src %>/rhodecode/utils/ajax.js',
+ '<%= dirs.js.src %>/rhodecode/utils/autocomplete.js',
+ '<%= dirs.js.src %>/rhodecode/utils/colorgenerator.js',
+ '<%= dirs.js.src %>/rhodecode/utils/ie.js',
+ '<%= dirs.js.src %>/rhodecode/utils/os.js',
+
+ // Rhodecode widgets
+ '<%= dirs.js.src %>/rhodecode/widgets/multiselect.js',
+
+ // Rhodecode components
+ '<%= dirs.js.src %>/rhodecode/pyroutes.js',
+ '<%= dirs.js.src %>/rhodecode/codemirror.js',
+ '<%= dirs.js.src %>/rhodecode/comments.js',
+ '<%= dirs.js.src %>/rhodecode/constants.js',
+ '<%= dirs.js.src %>/rhodecode/files.js',
+ '<%= dirs.js.src %>/rhodecode/followers.js',
+ '<%= dirs.js.src %>/rhodecode/menus.js',
+ '<%= dirs.js.src %>/rhodecode/notifications.js',
+ '<%= dirs.js.src %>/rhodecode/permissions.js',
+ '<%= dirs.js.src %>/rhodecode/pjax.js',
+ '<%= dirs.js.src %>/rhodecode/pullrequests.js',
+ '<%= dirs.js.src %>/rhodecode/settings.js',
+ '<%= dirs.js.src %>/rhodecode/select2_widgets.js',
+ '<%= dirs.js.src %>/rhodecode/tooltips.js',
+ '<%= dirs.js.src %>/rhodecode/users.js',
+ '<%= dirs.js.src %>/rhodecode/appenlight.js',
+
+ // Rhodecode main module
+ '<%= dirs.js.src %>/rhodecode.js'
+ ],
+ dest: '<%= dirs.js.dest %>/scripts.js',
+ nonull: true
+ }
+ },
+
+ less: {
+ development: {
+ options: {
+ compress: false,
+ yuicompress: false,
+ optimization: 0
+ },
+ files: {
+ "<%= dirs.css %>/style.css": "<%= dirs.css %>/main.less"
+ }
+ },
+ production: {
+ options: {
+ compress: true,
+ yuicompress: true,
+ optimization: 2
+ },
+ files: {
+ "<%= dirs.css %>/style.css": "<%= dirs.css %>/main.less"
+ }
+ }
+ },
+
+ watch: {
+ less: {
+ files: ["<%= dirs.css %>/*.less"],
+ tasks: ["less:production"]
+ },
+ js: {
+ files: ["<%= dirs.js.src %>/**/*.js"],
+ tasks: ["concat:dist"]
+ }
+ },
+
+ jshint: {
+ rhodecode: {
+ src: '<%= dirs.js.src %>/rhodecode/**/*.js',
+ options: {
+ jshintrc: '.jshintrc'
+ }
+ }
+ }
+ });
+
+ grunt.loadNpmTasks('grunt-contrib-less');
+ grunt.loadNpmTasks('grunt-contrib-concat');
+ grunt.loadNpmTasks('grunt-contrib-watch');
+ grunt.loadNpmTasks('grunt-contrib-jshint');
+
+ grunt.registerTask('default', ['less:production', 'concat:dist']);
+};
diff --git a/LICENSE.txt b/LICENSE.txt
new file mode 100644
--- /dev/null
+++ b/LICENSE.txt
@@ -0,0 +1,690 @@
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License, version 3
+(only), as published by the Free Software Foundation.
+
+
+This program incorporates work covered by the following copyright and
+permission notice:
+
+ Copyright (c) 2014-2016 - packaging
+ file:
+ Copyright (c) 2008-2011 - msgpack-python
+ file:licenses/msgpack_license.txt
+
+Both licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+imitations under the License.
+
+
+Below is the full text of GNU Affero General Public License, version 3
+
+
+ GNU AFFERO GENERAL PUBLIC LICENSE
+ Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc.
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+ Preamble
+
+ The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+ The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+ When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+ Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+ A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate. Many developers of free software are heartened and
+encouraged by the resulting cooperation. However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+ The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community. It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server. Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+ An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals. This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+ The precise terms and conditions for copying, distribution and
+modification follow.
+
+ TERMS AND CONDITIONS
+
+ 0. Definitions.
+
+ "This License" refers to version 3 of the GNU Affero General Public License.
+
+ "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+ "The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+ To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy. The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+ A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+ To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+ To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+ An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+ 1. Source Code.
+
+ The "source code" for a work means the preferred form of the work
+for making modifications to it. "Object code" means any non-source
+form of a work.
+
+ A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+ The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+ The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+ The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+ The Corresponding Source for a work in source code form is that
+same work.
+
+ 2. Basic Permissions.
+
+ All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+ You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force. You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright. Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+ Conveying under any other circumstances is permitted solely under
+the conditions stated below. Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+ 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+ No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+ When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+ 4. Conveying Verbatim Copies.
+
+ You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+ You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+ 5. Conveying Modified Source Versions.
+
+ You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+ a) The work must carry prominent notices stating that you modified
+ it, and giving a relevant date.
+
+ b) The work must carry prominent notices stating that it is
+ released under this License and any conditions added under section
+ 7. This requirement modifies the requirement in section 4 to
+ "keep intact all notices".
+
+ c) You must license the entire work, as a whole, under this
+ License to anyone who comes into possession of a copy. This
+ License will therefore apply, along with any applicable section 7
+ additional terms, to the whole of the work, and all its parts,
+ regardless of how they are packaged. This License gives no
+ permission to license the work in any other way, but it does not
+ invalidate such permission if you have separately received it.
+
+ d) If the work has interactive user interfaces, each must display
+ Appropriate Legal Notices; however, if the Program has interactive
+ interfaces that do not display Appropriate Legal Notices, your
+ work need not make them do so.
+
+ A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+ 6. Conveying Non-Source Forms.
+
+ You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+ a) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by the
+ Corresponding Source fixed on a durable physical medium
+ customarily used for software interchange.
+
+ b) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by a
+ written offer, valid for at least three years and valid for as
+ long as you offer spare parts or customer support for that product
+ model, to give anyone who possesses the object code either (1) a
+ copy of the Corresponding Source for all the software in the
+ product that is covered by this License, on a durable physical
+ medium customarily used for software interchange, for a price no
+ more than your reasonable cost of physically performing this
+ conveying of source, or (2) access to copy the
+ Corresponding Source from a network server at no charge.
+
+ c) Convey individual copies of the object code with a copy of the
+ written offer to provide the Corresponding Source. This
+ alternative is allowed only occasionally and noncommercially, and
+ only if you received the object code with such an offer, in accord
+ with subsection 6b.
+
+ d) Convey the object code by offering access from a designated
+ place (gratis or for a charge), and offer equivalent access to the
+ Corresponding Source in the same way through the same place at no
+ further charge. You need not require recipients to copy the
+ Corresponding Source along with the object code. If the place to
+ copy the object code is a network server, the Corresponding Source
+ may be on a different server (operated by you or a third party)
+ that supports equivalent copying facilities, provided you maintain
+ clear directions next to the object code saying where to find the
+ Corresponding Source. Regardless of what server hosts the
+ Corresponding Source, you remain obligated to ensure that it is
+ available for as long as needed to satisfy these requirements.
+
+ e) Convey the object code using peer-to-peer transmission, provided
+ you inform other peers where the object code and Corresponding
+ Source of the work are being offered to the general public at no
+ charge under subsection 6d.
+
+ A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+ A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling. In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage. For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product. A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+ "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source. The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+ If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+ The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed. Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+ Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+ 7. Additional Terms.
+
+ "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+ When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+ Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+ a) Disclaiming warranty or limiting liability differently from the
+ terms of sections 15 and 16 of this License; or
+
+ b) Requiring preservation of specified reasonable legal notices or
+ author attributions in that material or in the Appropriate Legal
+ Notices displayed by works containing it; or
+
+ c) Prohibiting misrepresentation of the origin of that material, or
+ requiring that modified versions of such material be marked in
+ reasonable ways as different from the original version; or
+
+ d) Limiting the use for publicity purposes of names of licensors or
+ authors of the material; or
+
+ e) Declining to grant rights under trademark law for use of some
+ trade names, trademarks, or service marks; or
+
+ f) Requiring indemnification of licensors and authors of that
+ material by anyone who conveys the material (or modified versions of
+ it) with contractual assumptions of liability to the recipient, for
+ any liability that these contractual assumptions directly impose on
+ those licensors and authors.
+
+ All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+ If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+ Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+ 8. Termination.
+
+ You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+ However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+ Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+ Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+ 9. Acceptance Not Required for Having Copies.
+
+ You are not required to accept this License in order to receive or
+run a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+ 10. Automatic Licensing of Downstream Recipients.
+
+ Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+ An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+ You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+ 11. Patents.
+
+ A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+ A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+ Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+ In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+ If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+ If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+ A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License. You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+ Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+ 12. No Surrender of Others' Freedom.
+
+ If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all. For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+ 13. Remote Network Interaction; Use with the GNU General Public License.
+
+ Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software. This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+ Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+ 14. Revised Versions of this License.
+
+ The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time. Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+ Each version is given a distinguishing version number. If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation. If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+ If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+ Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+ 15. Disclaimer of Warranty.
+
+ THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+ 16. Limitation of Liability.
+
+ IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+ 17. Interpretation of Sections 15 and 16.
+
+ If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Programs
+
+ If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+ To do so, attach the following notices to the program. It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+
+ Copyright (C)
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program. If not, see .
+
+Also add information on how to contact you by electronic and paper mail.
+
+ If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source. For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code. There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+ You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+.
diff --git a/MANIFEST.in b/MANIFEST.in
new file mode 100644
--- /dev/null
+++ b/MANIFEST.in
@@ -0,0 +1,48 @@
+# top level files
+include test.ini
+include MANIFEST.in
+include README.rst
+include rhodecode/VERSION
+
+# docs
+recursive-include docs *
+
+# init.d
+recursive-include init.d *
+
+# translations
+recursive-include rhodecode/i18n *
+
+# bin stuff
+recursive-include rhodecode/bin *
+
+# hook templates
+recursive-include rhodecode/config/hook_templates *
+
+# non-python core stuff
+recursive-include rhodecode *.cfg
+recursive-include rhodecode *.json
+recursive-include rhodecode *.ini_tmpl
+recursive-include rhodecode *.sh
+
+# images, css
+include rhodecode/public/css/*.css
+include rhodecode/public/images/*.*
+
+# sound files
+include rhodecode/public/sounds/*.mp3
+include rhodecode/public/sounds/*.wav
+
+# fonts
+recursive-include rhodecode/public/fonts/ProximaNova *
+recursive-include rhodecode/public/fonts/RCIcons *
+
+# js
+recursive-include rhodecode/public/js *
+
+# templates
+recursive-include rhodecode/templates *
+
+# skip any tests files
+recursive-exclude rhodecode/tests *
+
diff --git a/Makefile b/Makefile
new file mode 100644
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,39 @@
+
+WEBPACK=./node_modules/webpack/bin/webpack.js
+GRUNT=grunt
+NODE_PATH=./node_modules
+FLAKE8=flake8 setup.py pytest_pylons/ rhodecode/ --select=E124 --ignore=E711,E712,E510,E121,E122,E126,E127,E128,E501,F401 --max-line-length=100 --exclude=*rhodecode/lib/dbmigrate/*,*rhodecode/tests/*,*rhodecode/lib/vcs/utils/*
+CI_PREFIX=enterprise
+
+.PHONY: help clean test test-clean test-lint test-only
+
+help:
+ @echo "TODO: describe Makefile"
+
+clean: test-clean
+ find . -type f \( -iname '*.c' -o -iname '*.pyc' -o -iname '*.so' \) -exec rm '{}' ';'
+
+test: test-clean test-lint test-only
+
+test-clean:
+ rm -rf coverage.xml htmlcov junit.xml pylint.log result
+
+test-lint:
+ if [ "$$IN_NIX_SHELL" = "1" ]; then \
+ $(FLAKE8); \
+ else \
+ $(FLAKE8) --format=pylint --exit-zero > pylint.log; \
+ fi
+
+test-only:
+ PYTHONHASHSEED=random py.test -vv -r xw --cov=rhodecode --cov-report=term-missing --cov-report=html rhodecode/tests/
+
+web-build:
+ NODE_PATH=$(NODE_PATH) $(GRUNT)
+
+web-test:
+ @echo "no test for our javascript, yet!"
+
+docs-bootstrap:
+ (cd docs; nix-build default.nix -o result)
+ @echo "Please go to docs folder and run make html"
diff --git a/README.rst b/README.rst
new file mode 100644
--- /dev/null
+++ b/README.rst
@@ -0,0 +1,101 @@
+=========
+RhodeCode
+=========
+
+About
+-----
+
+``RhodeCode`` is a fast and powerful management tool for Mercurial_ and GIT_
+and Subversion_ with a built in push/pull server, full text search,
+pull requests and powerfull code-review system. It works on http/https and
+has a few unique features like:
+ - plugable architecture
+ - advanced permission system with IP restrictions
+ - rich set of authentication plugins including LDAP,
+ ActiveDirectory, Atlassian Crowd, Http-Headers, Pam, Token-Auth.
+ - live code-review chat
+ - full web based file editing
+ - unified multi vcs support
+ - snippets (gist) system
+ - integration with all 3rd party issue trackers
+
+RhodeCode also provides rich API, and multiple event hooks so it's easy
+integrable with existing external systems.
+
+RhodeCode is similar in some respects to gitlab_, github_ or bitbucket_,
+however RhodeCode can be run as standalone hosted application on your own server.
+RhodeCode can be installed on \*nix or Windows systems.
+
+RhodeCode uses `PEP386 versioning `_
+
+Installation
+------------
+Please visit https://docs.rhodecode.com/RhodeCode-Control/tasks/install-cli.html
+for more details
+
+
+Source code
+-----------
+
+The latest sources can be obtained from official RhodeCode instance
+https://code.rhodecode.com
+
+
+RhodeCode Features
+------------------
+
+Check out all features of RhodeCode at https://rhodecode.com/features
+
+License
+-------
+
+``RhodeCode`` is dual-licensed with AGPLv3 and commercial license.
+Please see LICENSE.txt file for details.
+
+
+Getting help
+------------
+
+Listed bellow are various support resources that should help.
+
+.. note::
+
+ Please try to read the documentation before posting any issues, especially
+ the **troubleshooting section**
+
+- Official issue tracker `RhodeCode Issue tracker `_
+
+- Search our community portal `Community portal `_
+
+- Join #rhodecode on FreeNode (irc.freenode.net)
+ or use http://webchat.freenode.net/?channels=rhodecode for web access to irc.
+
+- You can also follow RhodeCode on twitter **@RhodeCode** where we often post
+ news and other interesting stuff about RhodeCode.
+
+
+Online documentation
+--------------------
+
+Online documentation for the current version of RhodeCode is available at
+ - http://rhodecode.com/docs
+
+You may also build the documentation for yourself - go into ``docs/`` and run::
+
+ nix-build default.nix -o result && make clean html
+
+(You need to have sphinx_ installed to build the documentation. If you don't
+have sphinx_ installed you can install it via the command:
+``pip install sphinx``)
+
+.. _virtualenv: http://pypi.python.org/pypi/virtualenv
+.. _python: http://www.python.org/
+.. _sphinx: http://sphinx.pocoo.org/
+.. _mercurial: http://mercurial.selenic.com/
+.. _bitbucket: http://bitbucket.org/
+.. _github: http://github.com/
+.. _gitlab: http://gitlab.com/
+.. _subversion: http://subversion.tigris.org/
+.. _git: http://git-scm.com/
+.. _celery: http://celeryproject.org/
+.. _vcs: http://pypi.python.org/pypi/vcs
diff --git a/acceptance_tests/README.rst b/acceptance_tests/README.rst
new file mode 100644
--- /dev/null
+++ b/acceptance_tests/README.rst
@@ -0,0 +1,47 @@
+README - Quickstart
+===================
+
+This folder contains functional tests and the automation of specification
+examples. Details about testing can be found in
+`/docs-internal/testing/index.rst`.
+
+
+Setting up your Rhodecode Enterprise instance
+---------------------------------------------
+
+The tests will create users and repositories as needed, so you can start with a
+new and empty instance.
+
+Use the following example call for the database setup of Enterprise::
+
+ paster setup-rhodecode \
+ --user=admin \
+ --email=admin@example.com \
+ --password=secret \
+ --api-key=9999999999999999999999999999999999999999 \
+ your-enterprise-config.ini
+
+This way the username, password and auth token of the admin user will match the
+defaults from the test run.
+
+
+Usage
+-----
+
+1. Make sure your Rhodecode Enterprise instance is running at
+ http://localhost:5000.
+
+2. Enter `nix-shell` from the acceptance_tests folder::
+
+ cd acceptance_tests
+ nix-shell -I ~/dev
+
+ Make sure that `rcpkgs` and `rcnixpkgs` are available on the nix path.
+
+3. Run the tests::
+
+ py.test -c example.ini -vs
+
+ The parameter ``-vs`` allows you to see debugging output during the test
+ run. Check ``py.test --help`` and the documentation at http://pytest.org to
+ learn all details about the test runner.
diff --git a/configs/development.ini b/configs/development.ini
new file mode 100644
--- /dev/null
+++ b/configs/development.ini
@@ -0,0 +1,575 @@
+################################################################################
+################################################################################
+# RhodeCode Enterprise - configuration file #
+# Built-in functions and variables #
+# The %(here)s variable will be replaced with the parent directory of this file#
+# #
+################################################################################
+
+[DEFAULT]
+debug = true
+pdebug = false
+################################################################################
+## Uncomment and replace with the email address which should receive ##
+## any error reports after an application crash ##
+## Additionally these settings will be used by the RhodeCode mailing system ##
+################################################################################
+#email_to = admin@localhost
+#error_email_from = paste_error@localhost
+#app_email_from = rhodecode-noreply@localhost
+#error_message =
+#email_prefix = [RhodeCode]
+
+#smtp_server = mail.server.com
+#smtp_username =
+#smtp_password =
+#smtp_port =
+#smtp_use_tls = false
+#smtp_use_ssl = true
+## Specify available auth parameters here (e.g. LOGIN PLAIN CRAM-MD5, etc.)
+#smtp_auth =
+
+[server:main]
+## COMMON ##
+host = 127.0.0.1
+port = 5000
+
+##########################
+## WAITRESS WSGI SERVER ##
+##########################
+use = egg:waitress#main
+## number of worker threads
+threads = 5
+## MAX BODY SIZE 100GB
+max_request_body_size = 107374182400
+## Use poll instead of select, fixes file descriptors limits problems.
+## May not work on old windows systems.
+asyncore_use_poll = true
+
+
+##########################
+## GUNICORN WSGI SERVER ##
+##########################
+## run with gunicorn --log-config --paste
+#use = egg:gunicorn#main
+## Sets the number of process workers. You must set `instance_id = *`
+## when this option is set to more than one worker, recommended
+## value is (2 * NUMBER_OF_CPUS + 1), eg 2CPU = 5 workers
+## The `instance_id = *` must be set in the [app:main] section below
+#workers = 1
+## number of threads for each of the worker, must be set to 1 for gevent
+## generally recommened to be at 1
+#threads = 1
+## process name
+#proc_name = rhodecode
+## type of worker class, one of sync, gevent
+## recommended for bigger setup is using of of other than sync one
+#worker_class = sync
+## max number of requests that worker will handle before being gracefully
+## restarted, could prevent memory leaks
+#max_requests = 1000
+#max_requests_jitter = 30
+## ammount of time a worker can spend with handling a request before it
+## gets killed and restarted. Set to 6hrs
+#timeout = 21600
+
+
+## prefix middleware for RhodeCode, disables force_https flag.
+## allows to set RhodeCode under a prefix in server.
+## eg https://server.com/. Enable `filter-with =` option below as well.
+#[filter:proxy-prefix]
+#use = egg:PasteDeploy#prefix
+#prefix = /
+
+[app:main]
+use = egg:rhodecode-enterprise-ce
+## enable proxy prefix middleware, defined below
+#filter-with = proxy-prefix
+
+# During development the we want to have the debug toolbar enabled
+pyramid.includes =
+ pyramid_debugtoolbar
+ rhodecode.utils.debugtoolbar
+ rhodecode.lib.middleware.request_wrapper
+
+pyramid.reload_templates = true
+
+debugtoolbar.hosts = 0.0.0.0/0
+debugtoolbar.exclude_prefixes =
+ /css
+ /fonts
+ /images
+ /js
+
+## RHODECODE PLUGINS ##
+rhodecode.includes =
+ rhodecode.api
+
+
+# api prefix url
+rhodecode.api.url = /_admin/api
+
+
+## END RHODECODE PLUGINS ##
+
+full_stack = true
+
+## Serve static files via RhodeCode, disable to serve them via HTTP server
+static_files = true
+
+## Optional Languages
+## en(default), be, de, es, fr, it, ja, pl, pt, ru, zh
+lang = en
+
+## perform a full repository scan on each server start, this should be
+## set to false after first startup, to allow faster server restarts.
+startup.import_repos = false
+
+## Uncomment and set this path to use archive download cache.
+## Once enabled, generated archives will be cached at this location
+## and served from the cache during subsequent requests for the same archive of
+## the repository.
+#archive_cache_dir = /tmp/tarballcache
+
+## change this to unique ID for security
+app_instance_uuid = rc-production
+
+## cut off limit for large diffs (size in bytes)
+cut_off_limit_diff = 1024000
+cut_off_limit_file = 256000
+
+## use cache version of scm repo everywhere
+vcs_full_cache = true
+
+## force https in RhodeCode, fixes https redirects, assumes it's always https
+## Normally this is controlled by proper http flags sent from http server
+force_https = false
+
+## use Strict-Transport-Security headers
+use_htsts = false
+
+## number of commits stats will parse on each iteration
+commit_parse_limit = 25
+
+## git rev filter option, --all is the default filter, if you need to
+## hide all refs in changelog switch this to --branches --tags
+git_rev_filter = --branches --tags
+
+# Set to true if your repos are exposed using the dumb protocol
+git_update_server_info = false
+
+## RSS/ATOM feed options
+rss_cut_off_limit = 256000
+rss_items_per_page = 10
+rss_include_diff = false
+
+## gist URL alias, used to create nicer urls for gist. This should be an
+## url that does rewrites to _admin/gists/.
+## example: http://gist.rhodecode.org/{gistid}. Empty means use the internal
+## RhodeCode url, ie. http[s]://rhodecode.server/_admin/gists/
+gist_alias_url =
+
+## List of controllers (using glob pattern syntax) that AUTH TOKENS could be
+## used for access.
+## Adding ?auth_token = to the url authenticates this request as if it
+## came from the the logged in user who own this authentication token.
+##
+## Syntax is :.
+## To enable access to raw_files put `FilesController:raw`.
+## To enable access to patches add `ChangesetController:changeset_patch`.
+## The list should be "," separated and on a single line.
+##
+## Recommended controllers to enable:
+# ChangesetController:changeset_patch,
+# ChangesetController:changeset_raw,
+# FilesController:raw,
+# FilesController:archivefile,
+# GistsController:*,
+api_access_controllers_whitelist =
+
+## default encoding used to convert from and to unicode
+## can be also a comma separated list of encoding in case of mixed encodings
+default_encoding = UTF-8
+
+## instance-id prefix
+## a prefix key for this instance used for cache invalidation when running
+## multiple instances of rhodecode, make sure it's globally unique for
+## all running rhodecode instances. Leave empty if you don't use it
+instance_id =
+
+## alternative return HTTP header for failed authentication. Default HTTP
+## response is 401 HTTPUnauthorized. Currently HG clients have troubles with
+## handling that causing a series of failed authentication calls.
+## Set this variable to 403 to return HTTPForbidden, or any other HTTP code
+## This will be served instead of default 401 on bad authnetication
+auth_ret_code =
+
+## use special detection method when serving auth_ret_code, instead of serving
+## ret_code directly, use 401 initially (Which triggers credentials prompt)
+## and then serve auth_ret_code to clients
+auth_ret_code_detection = false
+
+## locking return code. When repository is locked return this HTTP code. 2XX
+## codes don't break the transactions while 4XX codes do
+lock_ret_code = 423
+
+## allows to change the repository location in settings page
+allow_repo_location_change = true
+
+## allows to setup custom hooks in settings page
+allow_custom_hooks_settings = true
+
+## generated license token, goto license page in RhodeCode settings to obtain
+## new token
+license_token =
+
+## supervisor connection uri, for managing supervisor and logs.
+supervisor.uri =
+## supervisord group name/id we only want this RC instance to handle
+supervisor.group_id = dev
+
+## Display extended labs settings
+labs_settings_active = true
+
+####################################
+### CELERY CONFIG ####
+####################################
+use_celery = false
+broker.host = localhost
+broker.vhost = rabbitmqhost
+broker.port = 5672
+broker.user = rabbitmq
+broker.password = qweqwe
+
+celery.imports = rhodecode.lib.celerylib.tasks
+
+celery.result.backend = amqp
+celery.result.dburi = amqp://
+celery.result.serialier = json
+
+#celery.send.task.error.emails = true
+#celery.amqp.task.result.expires = 18000
+
+celeryd.concurrency = 2
+#celeryd.log.file = celeryd.log
+celeryd.log.level = debug
+celeryd.max.tasks.per.child = 1
+
+## tasks will never be sent to the queue, but executed locally instead.
+celery.always.eager = false
+
+####################################
+### BEAKER CACHE ####
+####################################
+# default cache dir for templates. Putting this into a ramdisk
+## can boost performance, eg. %(here)s/data_ramdisk
+cache_dir = %(here)s/data
+
+## locking and default file storage for Beaker. Putting this into a ramdisk
+## can boost performance, eg. %(here)s/data_ramdisk/cache/beaker_data
+beaker.cache.data_dir = %(here)s/data/cache/beaker_data
+beaker.cache.lock_dir = %(here)s/data/cache/beaker_lock
+
+beaker.cache.regions = super_short_term, short_term, long_term, sql_cache_short, auth_plugins, repo_cache_long
+
+beaker.cache.super_short_term.type = memory
+beaker.cache.super_short_term.expire = 10
+beaker.cache.super_short_term.key_length = 256
+
+beaker.cache.short_term.type = memory
+beaker.cache.short_term.expire = 60
+beaker.cache.short_term.key_length = 256
+
+beaker.cache.long_term.type = memory
+beaker.cache.long_term.expire = 36000
+beaker.cache.long_term.key_length = 256
+
+beaker.cache.sql_cache_short.type = memory
+beaker.cache.sql_cache_short.expire = 10
+beaker.cache.sql_cache_short.key_length = 256
+
+# default is memory cache, configure only if required
+# using multi-node or multi-worker setup
+#beaker.cache.auth_plugins.type = ext:database
+#beaker.cache.auth_plugins.lock_dir = %(here)s/data/cache/auth_plugin_lock
+#beaker.cache.auth_plugins.url = postgresql://postgres:secret@localhost/rhodecode
+#beaker.cache.auth_plugins.url = mysql://root:secret@127.0.0.1/rhodecode
+#beaker.cache.auth_plugins.sa.pool_recycle = 3600
+#beaker.cache.auth_plugins.sa.pool_size = 10
+#beaker.cache.auth_plugins.sa.max_overflow = 0
+
+beaker.cache.repo_cache_long.type = memorylru_base
+beaker.cache.repo_cache_long.max_items = 4096
+beaker.cache.repo_cache_long.expire = 2592000
+
+# default is memorylru_base cache, configure only if required
+# using multi-node or multi-worker setup
+#beaker.cache.repo_cache_long.type = ext:memcached
+#beaker.cache.repo_cache_long.url = localhost:11211
+#beaker.cache.repo_cache_long.expire = 1209600
+#beaker.cache.repo_cache_long.key_length = 256
+
+####################################
+### BEAKER SESSION ####
+####################################
+
+## .session.type is type of storage options for the session, current allowed
+## types are file, ext:memcached, ext:database, and memory(default).
+beaker.session.type = file
+beaker.session.data_dir = %(here)s/data/sessions/data
+
+## db based session, fast, and allows easy management over logged in users ##
+#beaker.session.type = ext:database
+#beaker.session.table_name = db_session
+#beaker.session.sa.url = postgresql://postgres:secret@localhost/rhodecode
+#beaker.session.sa.url = mysql://root:secret@127.0.0.1/rhodecode
+#beaker.session.sa.pool_recycle = 3600
+#beaker.session.sa.echo = false
+
+beaker.session.key = rhodecode
+beaker.session.secret = develop-rc-uytcxaz
+beaker.session.lock_dir = %(here)s/data/sessions/lock
+
+## Secure encrypted cookie. Requires AES and AES python libraries
+## you must disable beaker.session.secret to use this
+#beaker.session.encrypt_key =
+#beaker.session.validate_key =
+
+## sets session as invalid(also logging out user) if it haven not been
+## accessed for given amount of time in seconds
+beaker.session.timeout = 2592000
+beaker.session.httponly = true
+#beaker.session.cookie_path = /
+
+## uncomment for https secure cookie
+beaker.session.secure = false
+
+## auto save the session to not to use .save()
+beaker.session.auto = false
+
+## default cookie expiration time in seconds, set to `true` to set expire
+## at browser close
+#beaker.session.cookie_expires = 3600
+
+###################################
+## SEARCH INDEXING CONFIGURATION ##
+###################################
+
+search.module = rhodecode.lib.index.whoosh
+search.location = %(here)s/data/index
+
+###################################
+## ERROR AND LOG HANDLING SYSTEM ##
+###################################
+
+## Appenlight is tailored to work with RhodeCode, see
+## http://appenlight.com for details how to obtain an account
+
+## appenlight integration enabled
+appenlight = false
+
+appenlight.server_url = https://api.appenlight.com
+appenlight.api_key = YOUR_API_KEY
+;appenlight.transport_config = https://api.appenlight.com?threaded=1&timeout=5
+
+# used for JS client
+appenlight.api_public_key = YOUR_API_PUBLIC_KEY
+
+## TWEAK AMOUNT OF INFO SENT HERE
+
+## enables 404 error logging (default False)
+appenlight.report_404 = false
+
+## time in seconds after request is considered being slow (default 1)
+appenlight.slow_request_time = 1
+
+## record slow requests in application
+## (needs to be enabled for slow datastore recording and time tracking)
+appenlight.slow_requests = true
+
+## enable hooking to application loggers
+appenlight.logging = true
+
+## minimum log level for log capture
+appenlight.logging.level = WARNING
+
+## send logs only from erroneous/slow requests
+## (saves API quota for intensive logging)
+appenlight.logging_on_error = false
+
+## list of additonal keywords that should be grabbed from environ object
+## can be string with comma separated list of words in lowercase
+## (by default client will always send following info:
+## 'REMOTE_USER', 'REMOTE_ADDR', 'SERVER_NAME', 'CONTENT_TYPE' + all keys that
+## start with HTTP* this list be extended with additional keywords here
+appenlight.environ_keys_whitelist =
+
+## list of keywords that should be blanked from request object
+## can be string with comma separated list of words in lowercase
+## (by default client will always blank keys that contain following words
+## 'password', 'passwd', 'pwd', 'auth_tkt', 'secret', 'csrf'
+## this list be extended with additional keywords set here
+appenlight.request_keys_blacklist =
+
+## list of namespaces that should be ignores when gathering log entries
+## can be string with comma separated list of namespaces
+## (by default the client ignores own entries: appenlight_client.client)
+appenlight.log_namespace_blacklist =
+
+
+################################################################################
+## WARNING: *THE LINE BELOW MUST BE UNCOMMENTED ON A PRODUCTION ENVIRONMENT* ##
+## Debug mode will enable the interactive debugging tool, allowing ANYONE to ##
+## execute malicious code after an exception is raised. ##
+################################################################################
+#set debug = false
+
+
+##############
+## STYLING ##
+##############
+debug_style = true
+
+#########################################################
+### DB CONFIGS - EACH DB WILL HAVE IT'S OWN CONFIG ###
+#########################################################
+sqlalchemy.db1.url = sqlite:///%(here)s/rhodecode.db?timeout=30
+#sqlalchemy.db1.url = postgresql://postgres:qweqwe@localhost/rhodecode
+#sqlalchemy.db1.url = mysql://root:qweqwe@localhost/rhodecode
+
+# see sqlalchemy docs for other advanced settings
+
+## print the sql statements to output
+sqlalchemy.db1.echo = false
+## recycle the connections after this ammount of seconds
+sqlalchemy.db1.pool_recycle = 3600
+sqlalchemy.db1.convert_unicode = true
+
+## the number of connections to keep open inside the connection pool.
+## 0 indicates no limit
+#sqlalchemy.db1.pool_size = 5
+
+## the number of connections to allow in connection pool "overflow", that is
+## connections that can be opened above and beyond the pool_size setting,
+## which defaults to five.
+#sqlalchemy.db1.max_overflow = 10
+
+
+##################
+### VCS CONFIG ###
+##################
+vcs.server.enable = true
+vcs.server = localhost:9900
+# Available protocols: pyro4, http
+vcs.server.protocol = pyro4
+
+# available impl:
+# vcsserver.scm_app (EE only, for testing),
+# rhodecode.lib.middleware.utils.scm_app_http
+# pyro4
+#vcs.scm_app_implementation = rhodecode.lib.middleware.utils.scm_app_http
+
+vcs.server.log_level = debug
+vcs.start_server = true
+vcs.backends = hg, git, svn
+vcs.connection_timeout = 3600
+## Compatibility version when creating SVN repositories. Defaults to newest version when commented out.
+## Available options are: pre-1.4-compatible, pre-1.5-compatible, pre-1.6-compatible, pre-1.8-compatible
+#vcs.svn.compatible_version = pre-1.8-compatible
+
+################################
+### LOGGING CONFIGURATION ####
+################################
+[loggers]
+keys = root, routes, rhodecode, sqlalchemy, beaker, pyro4, templates, whoosh_indexer
+
+[handlers]
+keys = console, console_sql
+
+[formatters]
+keys = generic, color_formatter, color_formatter_sql
+
+#############
+## LOGGERS ##
+#############
+[logger_root]
+level = NOTSET
+handlers = console
+
+[logger_routes]
+level = DEBUG
+handlers =
+qualname = routes.middleware
+## "level = DEBUG" logs the route matched and routing variables.
+propagate = 1
+
+[logger_beaker]
+level = DEBUG
+handlers =
+qualname = beaker.container
+propagate = 1
+
+[logger_pyro4]
+level = DEBUG
+handlers =
+qualname = Pyro4
+propagate = 1
+
+[logger_templates]
+level = INFO
+handlers =
+qualname = pylons.templating
+propagate = 1
+
+[logger_rhodecode]
+level = DEBUG
+handlers =
+qualname = rhodecode
+propagate = 1
+
+[logger_sqlalchemy]
+level = INFO
+handlers = console_sql
+qualname = sqlalchemy.engine
+propagate = 0
+
+[logger_whoosh_indexer]
+level = DEBUG
+handlers =
+qualname = whoosh_indexer
+propagate = 1
+
+##############
+## HANDLERS ##
+##############
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = DEBUG
+formatter = color_formatter
+
+[handler_console_sql]
+class = StreamHandler
+args = (sys.stderr,)
+level = DEBUG
+formatter = color_formatter_sql
+
+################
+## FORMATTERS ##
+################
+
+[formatter_generic]
+class = rhodecode.lib.logging_formatter.Pyro4AwareFormatter
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S
+
+[formatter_color_formatter]
+class = rhodecode.lib.logging_formatter.ColorFormatter
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S
+
+[formatter_color_formatter_sql]
+class = rhodecode.lib.logging_formatter.ColorFormatterSql
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S
diff --git a/configs/gunicorn_config.py b/configs/gunicorn_config.py
new file mode 100644
--- /dev/null
+++ b/configs/gunicorn_config.py
@@ -0,0 +1,96 @@
+"""gunicorn config hooks"""
+
+import multiprocessing
+import sys
+import threading
+import traceback
+
+
+# GLOBAL #
+errorlog = '-'
+accesslog = '-'
+loglevel = 'debug'
+
+# SECURITY #
+limit_request_line = 4094
+limit_request_fields = 100
+limit_request_field_size = 8190
+
+# SERVER MECHANICS #
+# None == system temp dir #
+worker_tmp_dir = None
+tmp_upload_dir = None
+#proc_name =
+
+# self adjust workers based on CPU #
+#workers = multiprocessing.cpu_count() * 2 + 1
+
+access_log_format = '[%(p)s] %(h)15s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" request_time:%(L)s'
+
+# For the gevent worker classes #
+# this limits the maximum number of simultaneous clients that #
+# a single process can handle. #
+#worker_connections = 10
+
+# Max requests to handle by each worker before restarting it, #
+# could prevent memory leaks #
+#max_requests = 1000
+#max_requests_jitter = 30
+
+
+# If a worker does not notify the master process in this #
+# number of seconds it is killed and a new worker is spawned #
+# to replace it. #
+#timeout = 3600
+
+access_log_format = (
+ '[%(p)-10s] %(h)s time:%(L)s %(l)s %(u)s '
+ '%(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s"')
+
+
+def post_fork(server, worker):
+ server.log.info("[<%s>] worker spawned", worker.pid)
+
+
+def pre_fork(server, worker):
+ pass
+
+
+def pre_exec(server):
+ server.log.info("Forked child, re-executing.")
+
+
+def when_ready(server):
+ server.log.info("Server is ready. Spawning workers")
+
+
+def worker_int(worker):
+ worker.log.info("[<%-10s>] worker received INT or QUIT signal", worker.pid)
+
+ # get traceback info
+ id2name = dict([(th.ident, th.name) for th in threading.enumerate()])
+ code = []
+ for thread_id, stack in sys._current_frames().items():
+ code.append(
+ "\n# Thread: %s(%d)" % (id2name.get(thread_id, ""), thread_id))
+ for fname, lineno, name, line in traceback.extract_stack(stack):
+ code.append('File: "%s", line %d, in %s' % (fname, lineno, name))
+ if line:
+ code.append(" %s" % (line.strip()))
+ worker.log.debug("\n".join(code))
+
+
+def worker_abort(worker):
+ worker.log.info("[<%-10s>] worker received SIGABRT signal", worker.pid)
+
+
+def pre_request(worker, req):
+ return
+ worker.log.debug("[<%-10s>] PRE WORKER: %s %s",
+ worker.pid, req.method, req.path)
+
+
+def post_request(worker, req, environ, resp):
+ return
+ worker.log.debug("[<%-10s>] POST WORKER: %s %s resp: %s", worker.pid,
+ req.method, req.path, resp.status_code)
\ No newline at end of file
diff --git a/configs/init.d/.readme.txt b/configs/init.d/.readme.txt
new file mode 100644
--- /dev/null
+++ b/configs/init.d/.readme.txt
@@ -0,0 +1,1 @@
+Example init scripts.
\ No newline at end of file
diff --git a/configs/init.d/supervisord.conf b/configs/init.d/supervisord.conf
new file mode 100644
--- /dev/null
+++ b/configs/init.d/supervisord.conf
@@ -0,0 +1,61 @@
+; Sample supervisor RhodeCode config file.
+;
+; For more information on the config file, please see:
+; http://supervisord.org/configuration.html
+;
+; Note: shell expansion ("~" or "$HOME") is not supported. Environment
+; variables can be expanded using this syntax: "%(ENV_HOME)s".
+
+[unix_http_server]
+file=/tmp/supervisor.sock ; (the path to the socket file)
+;chmod=0700 ; socket file mode (default 0700)
+;chown=nobody:nogroup ; socket file uid:gid owner
+;username=user ; (default is no username (open server))
+;password=123 ; (default is no password (open server))
+
+[supervisord]
+logfile=/home/ubuntu/rhodecode/supervisord.log ; (main log file;default $CWD/supervisord.log)
+logfile_maxbytes=50MB ; (max main logfile bytes b4 rotation;default 50MB)
+logfile_backups=10 ; (num of main logfile rotation backups;default 10)
+loglevel=info ; (log level;default info; others: debug,warn,trace)
+pidfile=/home/ubuntu/rhodecode/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
+nodaemon=true ; (start in foreground if true;default false)
+minfds=1024 ; (min. avail startup file descriptors;default 1024)
+minprocs=200 ; (min. avail process descriptors;default 200)
+;umask=022 ; (process file creation umask;default 022)
+user=ubuntu ; (default is current user, required if root)
+;identifier=supervisor ; (supervisord identifier, default is 'supervisor')
+;directory=/tmp ; (default is not to cd during start)
+;nocleanup=true ; (don't clean up tempfiles at start;default false)
+;childlogdir=/tmp ; ('AUTO' child log dir, default $TEMP)
+environment=HOME=/home/ubuntu,LANG=en_US.UTF-8 ; (key value pairs to add to environment)
+;strip_ansi=false ; (strip ansi escape codes in logs; def. false)
+
+; the below section must remain in the config file for RPC
+; (supervisorctl/web interface) to work, additional interfaces may be
+; added by defining them in separate rpcinterface: sections
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+
+[supervisorctl]
+serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL for a unix socket
+;username=chris ; should be same as http_username if set
+;password=123 ; should be same as http_password if set
+
+
+; restart with supervisorctl restart rhodecode:*
+[program:rhodecode]
+numprocs = 1
+numprocs_start = 5000
+directory=/home/ubuntu/rhodecode/source
+command = /home/ubuntu/rhodecode/venv/bin/paster serve /home/ubuntu/rhodecode/source/prod.ini
+process_name = %(program_name)s_%(process_num)04d
+redirect_stderr=true
+stdout_logfile=/home/ubuntu/rhodecode/rhodecode.log
+
+[program:rhodecode_workers]
+numproces = 1
+directory = /home/ubuntu/rhodecode/source
+command = /home/ubuntu/rhodecode/venv/bin/paster celeryd /home/ubuntu/rhodecode/source/prod.ini --autoscale=10,2
+redirect_stderr=true
+stdout_logfile=/%(here)s/rhodecode_workers.log
diff --git a/configs/production.ini b/configs/production.ini
new file mode 100644
--- /dev/null
+++ b/configs/production.ini
@@ -0,0 +1,541 @@
+################################################################################
+################################################################################
+# RhodeCode Enterprise - configuration file #
+# Built-in functions and variables #
+# The %(here)s variable will be replaced with the parent directory of this file#
+# #
+################################################################################
+
+[DEFAULT]
+debug = true
+pdebug = false
+################################################################################
+## Uncomment and replace with the email address which should receive ##
+## any error reports after an application crash ##
+## Additionally these settings will be used by the RhodeCode mailing system ##
+################################################################################
+#email_to = admin@localhost
+#error_email_from = paste_error@localhost
+#app_email_from = rhodecode-noreply@localhost
+#error_message =
+#email_prefix = [RhodeCode]
+
+#smtp_server = mail.server.com
+#smtp_username =
+#smtp_password =
+#smtp_port =
+#smtp_use_tls = false
+#smtp_use_ssl = true
+## Specify available auth parameters here (e.g. LOGIN PLAIN CRAM-MD5, etc.)
+#smtp_auth =
+
+[server:main]
+## COMMON ##
+host = 127.0.0.1
+port = 5000
+
+##########################
+## WAITRESS WSGI SERVER ##
+##########################
+use = egg:waitress#main
+## number of worker threads
+threads = 5
+## MAX BODY SIZE 100GB
+max_request_body_size = 107374182400
+## Use poll instead of select, fixes file descriptors limits problems.
+## May not work on old windows systems.
+asyncore_use_poll = true
+
+
+##########################
+## GUNICORN WSGI SERVER ##
+##########################
+## run with gunicorn --log-config --paste
+#use = egg:gunicorn#main
+## Sets the number of process workers. You must set `instance_id = *`
+## when this option is set to more than one worker, recommended
+## value is (2 * NUMBER_OF_CPUS + 1), eg 2CPU = 5 workers
+## The `instance_id = *` must be set in the [app:main] section below
+#workers = 1
+## number of threads for each of the worker, must be set to 1 for gevent
+## generally recommened to be at 1
+#threads = 1
+## process name
+#proc_name = rhodecode
+## type of worker class, one of sync, gevent
+## recommended for bigger setup is using of of other than sync one
+#worker_class = sync
+## max number of requests that worker will handle before being gracefully
+## restarted, could prevent memory leaks
+#max_requests = 1000
+#max_requests_jitter = 30
+## ammount of time a worker can spend with handling a request before it
+## gets killed and restarted. Set to 6hrs
+#timeout = 21600
+
+
+## prefix middleware for RhodeCode, disables force_https flag.
+## allows to set RhodeCode under a prefix in server.
+## eg https://server.com/. Enable `filter-with =` option below as well.
+#[filter:proxy-prefix]
+#use = egg:PasteDeploy#prefix
+#prefix = /
+
+[app:main]
+use = egg:rhodecode-enterprise-ce
+## enable proxy prefix middleware, defined below
+#filter-with = proxy-prefix
+
+full_stack = true
+
+## Serve static files via RhodeCode, disable to serve them via HTTP server
+static_files = true
+
+## Optional Languages
+## en(default), be, de, es, fr, it, ja, pl, pt, ru, zh
+lang = en
+
+## perform a full repository scan on each server start, this should be
+## set to false after first startup, to allow faster server restarts.
+startup.import_repos = false
+
+## Uncomment and set this path to use archive download cache.
+## Once enabled, generated archives will be cached at this location
+## and served from the cache during subsequent requests for the same archive of
+## the repository.
+#archive_cache_dir = /tmp/tarballcache
+
+## change this to unique ID for security
+app_instance_uuid = rc-production
+
+## cut off limit for large diffs (size in bytes)
+cut_off_limit_diff = 1024000
+cut_off_limit_file = 256000
+
+## use cache version of scm repo everywhere
+vcs_full_cache = true
+
+## force https in RhodeCode, fixes https redirects, assumes it's always https
+## Normally this is controlled by proper http flags sent from http server
+force_https = false
+
+## use Strict-Transport-Security headers
+use_htsts = false
+
+## number of commits stats will parse on each iteration
+commit_parse_limit = 25
+
+## git rev filter option, --all is the default filter, if you need to
+## hide all refs in changelog switch this to --branches --tags
+git_rev_filter = --branches --tags
+
+# Set to true if your repos are exposed using the dumb protocol
+git_update_server_info = false
+
+## RSS/ATOM feed options
+rss_cut_off_limit = 256000
+rss_items_per_page = 10
+rss_include_diff = false
+
+## gist URL alias, used to create nicer urls for gist. This should be an
+## url that does rewrites to _admin/gists/.
+## example: http://gist.rhodecode.org/{gistid}. Empty means use the internal
+## RhodeCode url, ie. http[s]://rhodecode.server/_admin/gists/
+gist_alias_url =
+
+## List of controllers (using glob pattern syntax) that AUTH TOKENS could be
+## used for access.
+## Adding ?auth_token = to the url authenticates this request as if it
+## came from the the logged in user who own this authentication token.
+##
+## Syntax is :.
+## To enable access to raw_files put `FilesController:raw`.
+## To enable access to patches add `ChangesetController:changeset_patch`.
+## The list should be "," separated and on a single line.
+##
+## Recommended controllers to enable:
+# ChangesetController:changeset_patch,
+# ChangesetController:changeset_raw,
+# FilesController:raw,
+# FilesController:archivefile,
+# GistsController:*,
+api_access_controllers_whitelist =
+
+## default encoding used to convert from and to unicode
+## can be also a comma separated list of encoding in case of mixed encodings
+default_encoding = UTF-8
+
+## instance-id prefix
+## a prefix key for this instance used for cache invalidation when running
+## multiple instances of rhodecode, make sure it's globally unique for
+## all running rhodecode instances. Leave empty if you don't use it
+instance_id =
+
+## alternative return HTTP header for failed authentication. Default HTTP
+## response is 401 HTTPUnauthorized. Currently HG clients have troubles with
+## handling that causing a series of failed authentication calls.
+## Set this variable to 403 to return HTTPForbidden, or any other HTTP code
+## This will be served instead of default 401 on bad authnetication
+auth_ret_code =
+
+## use special detection method when serving auth_ret_code, instead of serving
+## ret_code directly, use 401 initially (Which triggers credentials prompt)
+## and then serve auth_ret_code to clients
+auth_ret_code_detection = false
+
+## locking return code. When repository is locked return this HTTP code. 2XX
+## codes don't break the transactions while 4XX codes do
+lock_ret_code = 423
+
+## allows to change the repository location in settings page
+allow_repo_location_change = true
+
+## allows to setup custom hooks in settings page
+allow_custom_hooks_settings = true
+
+## generated license token, goto license page in RhodeCode settings to obtain
+## new token
+license_token =
+
+## supervisor connection uri, for managing supervisor and logs.
+supervisor.uri =
+## supervisord group name/id we only want this RC instance to handle
+supervisor.group_id = prod
+
+## Display extended labs settings
+labs_settings_active = true
+
+####################################
+### CELERY CONFIG ####
+####################################
+use_celery = false
+broker.host = localhost
+broker.vhost = rabbitmqhost
+broker.port = 5672
+broker.user = rabbitmq
+broker.password = qweqwe
+
+celery.imports = rhodecode.lib.celerylib.tasks
+
+celery.result.backend = amqp
+celery.result.dburi = amqp://
+celery.result.serialier = json
+
+#celery.send.task.error.emails = true
+#celery.amqp.task.result.expires = 18000
+
+celeryd.concurrency = 2
+#celeryd.log.file = celeryd.log
+celeryd.log.level = debug
+celeryd.max.tasks.per.child = 1
+
+## tasks will never be sent to the queue, but executed locally instead.
+celery.always.eager = false
+
+####################################
+### BEAKER CACHE ####
+####################################
+# default cache dir for templates. Putting this into a ramdisk
+## can boost performance, eg. %(here)s/data_ramdisk
+cache_dir = %(here)s/data
+
+## locking and default file storage for Beaker. Putting this into a ramdisk
+## can boost performance, eg. %(here)s/data_ramdisk/cache/beaker_data
+beaker.cache.data_dir = %(here)s/data/cache/beaker_data
+beaker.cache.lock_dir = %(here)s/data/cache/beaker_lock
+
+beaker.cache.regions = super_short_term, short_term, long_term, sql_cache_short, auth_plugins, repo_cache_long
+
+beaker.cache.super_short_term.type = memory
+beaker.cache.super_short_term.expire = 10
+beaker.cache.super_short_term.key_length = 256
+
+beaker.cache.short_term.type = memory
+beaker.cache.short_term.expire = 60
+beaker.cache.short_term.key_length = 256
+
+beaker.cache.long_term.type = memory
+beaker.cache.long_term.expire = 36000
+beaker.cache.long_term.key_length = 256
+
+beaker.cache.sql_cache_short.type = memory
+beaker.cache.sql_cache_short.expire = 10
+beaker.cache.sql_cache_short.key_length = 256
+
+# default is memory cache, configure only if required
+# using multi-node or multi-worker setup
+#beaker.cache.auth_plugins.type = ext:database
+#beaker.cache.auth_plugins.lock_dir = %(here)s/data/cache/auth_plugin_lock
+#beaker.cache.auth_plugins.url = postgresql://postgres:secret@localhost/rhodecode
+#beaker.cache.auth_plugins.url = mysql://root:secret@127.0.0.1/rhodecode
+#beaker.cache.auth_plugins.sa.pool_recycle = 3600
+#beaker.cache.auth_plugins.sa.pool_size = 10
+#beaker.cache.auth_plugins.sa.max_overflow = 0
+
+beaker.cache.repo_cache_long.type = memorylru_base
+beaker.cache.repo_cache_long.max_items = 4096
+beaker.cache.repo_cache_long.expire = 2592000
+
+# default is memorylru_base cache, configure only if required
+# using multi-node or multi-worker setup
+#beaker.cache.repo_cache_long.type = ext:memcached
+#beaker.cache.repo_cache_long.url = localhost:11211
+#beaker.cache.repo_cache_long.expire = 1209600
+#beaker.cache.repo_cache_long.key_length = 256
+
+####################################
+### BEAKER SESSION ####
+####################################
+
+## .session.type is type of storage options for the session, current allowed
+## types are file(default), ext:memcached, ext:database, and memory.
+#beaker.session.type = file
+
+## db based session, fast, and allows easy management over logged in users ##
+#beaker.session.type = ext:database
+#beaker.session.lock_dir = %(here)s/data/cache/session_db_lock
+#beaker.session.table_name = db_session
+#beaker.session.sa.url = postgresql://postgres:secret@localhost/rhodecode
+#beaker.session.sa.url = mysql://root:secret@127.0.0.1/rhodecode
+#beaker.session.sa.pool_recycle = 3600
+#beaker.session.sa.echo = false
+
+beaker.session.key = rhodecode
+beaker.session.secret = production-rc-uytcxaz
+
+## Secure encrypted cookie. Requires AES and AES python libraries
+## you must disable beaker.session.secret to use this
+#beaker.session.encrypt_key =
+#beaker.session.validate_key =
+
+## sets session as invalid(also logging out user) if it haven not been
+## accessed for given amount of time in seconds
+beaker.session.timeout = 2592000
+beaker.session.httponly = true
+#beaker.session.cookie_path = /
+
+## uncomment for https secure cookie
+beaker.session.secure = false
+
+## auto save the session to not to use .save()
+beaker.session.auto = false
+
+## default cookie expiration time in seconds, set to `true` to set expire
+## at browser close
+#beaker.session.cookie_expires = 3600
+
+###################################
+## SEARCH INDEXING CONFIGURATION ##
+###################################
+
+search.module = rhodecode.lib.index.whoosh
+search.location = %(here)s/data/index
+
+###################################
+## ERROR AND LOG HANDLING SYSTEM ##
+###################################
+
+## Appenlight is tailored to work with RhodeCode, see
+## http://appenlight.com for details how to obtain an account
+
+## appenlight integration enabled
+appenlight = false
+
+appenlight.server_url = https://api.appenlight.com
+appenlight.api_key = YOUR_API_KEY
+;appenlight.transport_config = https://api.appenlight.com?threaded=1&timeout=5
+
+# used for JS client
+appenlight.api_public_key = YOUR_API_PUBLIC_KEY
+
+## TWEAK AMOUNT OF INFO SENT HERE
+
+## enables 404 error logging (default False)
+appenlight.report_404 = false
+
+## time in seconds after request is considered being slow (default 1)
+appenlight.slow_request_time = 1
+
+## record slow requests in application
+## (needs to be enabled for slow datastore recording and time tracking)
+appenlight.slow_requests = true
+
+## enable hooking to application loggers
+appenlight.logging = true
+
+## minimum log level for log capture
+appenlight.logging.level = WARNING
+
+## send logs only from erroneous/slow requests
+## (saves API quota for intensive logging)
+appenlight.logging_on_error = false
+
+## list of additonal keywords that should be grabbed from environ object
+## can be string with comma separated list of words in lowercase
+## (by default client will always send following info:
+## 'REMOTE_USER', 'REMOTE_ADDR', 'SERVER_NAME', 'CONTENT_TYPE' + all keys that
+## start with HTTP* this list be extended with additional keywords here
+appenlight.environ_keys_whitelist =
+
+## list of keywords that should be blanked from request object
+## can be string with comma separated list of words in lowercase
+## (by default client will always blank keys that contain following words
+## 'password', 'passwd', 'pwd', 'auth_tkt', 'secret', 'csrf'
+## this list be extended with additional keywords set here
+appenlight.request_keys_blacklist =
+
+## list of namespaces that should be ignores when gathering log entries
+## can be string with comma separated list of namespaces
+## (by default the client ignores own entries: appenlight_client.client)
+appenlight.log_namespace_blacklist =
+
+
+################################################################################
+## WARNING: *THE LINE BELOW MUST BE UNCOMMENTED ON A PRODUCTION ENVIRONMENT* ##
+## Debug mode will enable the interactive debugging tool, allowing ANYONE to ##
+## execute malicious code after an exception is raised. ##
+################################################################################
+set debug = false
+
+
+##############
+## STYLING ##
+##############
+debug_style = false
+
+#########################################################
+### DB CONFIGS - EACH DB WILL HAVE IT'S OWN CONFIG ###
+#########################################################
+#sqlalchemy.db1.url = sqlite:///%(here)s/rhodecode.db?timeout=30
+sqlalchemy.db1.url = postgresql://postgres:qweqwe@localhost/rhodecode
+#sqlalchemy.db1.url = mysql://root:qweqwe@localhost/rhodecode
+
+# see sqlalchemy docs for other advanced settings
+
+## print the sql statements to output
+sqlalchemy.db1.echo = false
+## recycle the connections after this ammount of seconds
+sqlalchemy.db1.pool_recycle = 3600
+sqlalchemy.db1.convert_unicode = true
+
+## the number of connections to keep open inside the connection pool.
+## 0 indicates no limit
+#sqlalchemy.db1.pool_size = 5
+
+## the number of connections to allow in connection pool "overflow", that is
+## connections that can be opened above and beyond the pool_size setting,
+## which defaults to five.
+#sqlalchemy.db1.max_overflow = 10
+
+
+##################
+### VCS CONFIG ###
+##################
+vcs.server.enable = true
+vcs.server = localhost:9900
+# Available protocols: pyro4, http
+vcs.server.protocol = pyro4
+vcs.server.log_level = info
+vcs.start_server = false
+vcs.backends = hg, git, svn
+vcs.connection_timeout = 3600
+## Compatibility version when creating SVN repositories. Defaults to newest version when commented out.
+## Available options are: pre-1.4-compatible, pre-1.5-compatible, pre-1.6-compatible, pre-1.8-compatible
+#vcs.svn.compatible_version = pre-1.8-compatible
+
+################################
+### LOGGING CONFIGURATION ####
+################################
+[loggers]
+keys = root, routes, rhodecode, sqlalchemy, beaker, pyro4, templates, whoosh_indexer
+
+[handlers]
+keys = console, console_sql
+
+[formatters]
+keys = generic, color_formatter, color_formatter_sql
+
+#############
+## LOGGERS ##
+#############
+[logger_root]
+level = NOTSET
+handlers = console
+
+[logger_routes]
+level = DEBUG
+handlers =
+qualname = routes.middleware
+## "level = DEBUG" logs the route matched and routing variables.
+propagate = 1
+
+[logger_beaker]
+level = DEBUG
+handlers =
+qualname = beaker.container
+propagate = 1
+
+[logger_pyro4]
+level = DEBUG
+handlers =
+qualname = Pyro4
+propagate = 1
+
+[logger_templates]
+level = INFO
+handlers =
+qualname = pylons.templating
+propagate = 1
+
+[logger_rhodecode]
+level = DEBUG
+handlers =
+qualname = rhodecode
+propagate = 1
+
+[logger_sqlalchemy]
+level = INFO
+handlers = console_sql
+qualname = sqlalchemy.engine
+propagate = 0
+
+[logger_whoosh_indexer]
+level = DEBUG
+handlers =
+qualname = whoosh_indexer
+propagate = 1
+
+##############
+## HANDLERS ##
+##############
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = INFO
+formatter = generic
+
+[handler_console_sql]
+class = StreamHandler
+args = (sys.stderr,)
+level = WARN
+formatter = generic
+
+################
+## FORMATTERS ##
+################
+
+[formatter_generic]
+class = rhodecode.lib.logging_formatter.Pyro4AwareFormatter
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S
+
+[formatter_color_formatter]
+class = rhodecode.lib.logging_formatter.ColorFormatter
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S
+
+[formatter_color_formatter_sql]
+class = rhodecode.lib.logging_formatter.ColorFormatterSql
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S
diff --git a/configs/rcchannelstream.ini b/configs/rcchannelstream.ini
new file mode 100644
--- /dev/null
+++ b/configs/rcchannelstream.ini
@@ -0,0 +1,6 @@
+[channelstream]
+admin_secret = secret
+secret = secret
+port = 9800
+demo = false
+allow_posting_from = 127.0.0.1
diff --git a/default.nix b/default.nix
new file mode 100644
--- /dev/null
+++ b/default.nix
@@ -0,0 +1,215 @@
+# Nix environment for the community edition
+#
+# This shall be as lean as possible, just producing the Enterprise
+# derivation. For advanced tweaks to pimp up the development environment we use
+# "shell.nix" so that it does not have to clutter this file.
+
+{ pkgs ? (import {})
+, pythonPackages ? "python27Packages"
+, pythonExternalOverrides ? self: super: {}
+, doCheck ? true
+}:
+
+let pkgs_ = pkgs; in
+
+let
+ pkgs = pkgs_.overridePackages (self: super: {
+ # Override subversion derivation to
+ # - activate python bindings
+ # - set version to 1.8
+ subversion = super.subversion18.override {
+ httpSupport = true;
+ pythonBindings = true;
+ python = self.python27Packages.python;
+ };
+ });
+
+ inherit (pkgs.lib) fix extends;
+
+ basePythonPackages = with builtins; if isAttrs pythonPackages
+ then pythonPackages
+ else getAttr pythonPackages pkgs;
+
+ elem = builtins.elem;
+ basename = path: with pkgs.lib; last (splitString "/" path);
+ startsWith = prefix: full: let
+ actualPrefix = builtins.substring 0 (builtins.stringLength prefix) full;
+ in actualPrefix == prefix;
+
+ src-filter = path: type: with pkgs.lib;
+ let
+ ext = last (splitString "." path);
+ in
+ !elem (basename path) [
+ ".git" ".hg" "__pycache__" ".eggs" "node_modules"
+ "build" "data" "tmp"] &&
+ !elem ext ["egg-info" "pyc"] &&
+ !startsWith "result" path;
+
+ rhodecode-enterprise-ce-src = builtins.filterSource src-filter ./.;
+
+ # Load the generated node packages
+ nodePackages = pkgs.callPackage "${pkgs.path}/pkgs/top-level/node-packages.nix" rec {
+ self = nodePackages;
+ generated = pkgs.callPackage ./pkgs/node-packages.nix { inherit self; };
+ };
+
+ # TODO: Should be taken automatically out of the generates packages.
+ # apps.nix has one solution for this, although I'd prefer to have the deps
+ # from package.json mapped in here.
+ nodeDependencies = with nodePackages; [
+ grunt
+ grunt-contrib-concat
+ grunt-contrib-jshint
+ grunt-contrib-less
+ grunt-contrib-watch
+ jshint
+ ];
+
+ pythonGeneratedPackages = self: basePythonPackages.override (a: {
+ inherit self;
+ })
+ // (scopedImport {
+ self = self;
+ super = basePythonPackages;
+ inherit pkgs;
+ inherit (pkgs) fetchurl fetchgit;
+ } ./pkgs/python-packages.nix);
+
+ pythonOverrides = import ./pkgs/python-packages-overrides.nix {
+ inherit
+ basePythonPackages
+ pkgs;
+ };
+
+ pythonLocalOverrides = self: super: {
+ rhodecode-enterprise-ce =
+ let
+ version = "${builtins.readFile ./rhodecode/VERSION}";
+ linkNodeModules = ''
+ echo "Link node packages"
+ # TODO: check if this adds stuff as a dependency, closure size
+ rm -fr node_modules
+ mkdir -p node_modules
+ ${pkgs.lib.concatMapStrings (dep: ''
+ ln -sfv ${dep}/lib/node_modules/${dep.pkgName} node_modules/
+ '') nodeDependencies}
+ echo "DONE: Link node packages"
+ '';
+ in super.rhodecode-enterprise-ce.override (attrs: {
+
+ inherit doCheck;
+ name = "rhodecode-enterprise-ce-${version}";
+ version = version;
+ src = rhodecode-enterprise-ce-src;
+
+ buildInputs =
+ attrs.buildInputs ++
+ (with self; [
+ pkgs.nodePackages.grunt-cli
+ pkgs.subversion
+ pytest-catchlog
+ rc_testdata
+ ]);
+
+ propagatedBuildInputs = attrs.propagatedBuildInputs ++ (with self; [
+ rhodecode-tools
+ ]);
+
+ # TODO: johbo: Make a nicer way to expose the parts. Maybe
+ # pkgs/default.nix?
+ passthru = {
+ inherit myPythonPackagesUnfix;
+ pythonPackages = self;
+ };
+
+ LC_ALL = "en_US.UTF-8";
+ LOCALE_ARCHIVE =
+ if pkgs.stdenv ? glibc
+ then "${pkgs.glibcLocales}/lib/locale/locale-archive"
+ else "";
+
+ # Somewhat snappier setup of the development environment
+ # TODO: move into shell.nix
+ # TODO: think of supporting a stable path again, so that multiple shells
+ # can share it.
+ shellHook = ''
+ tmp_path=$(mktemp -d)
+ export PATH="$tmp_path/bin:$PATH"
+ export PYTHONPATH="$tmp_path/${self.python.sitePackages}:$PYTHONPATH"
+ mkdir -p $tmp_path/${self.python.sitePackages}
+ python setup.py develop --prefix $tmp_path --allow-hosts ""
+ '' + linkNodeModules;
+
+ preCheck = ''
+ export PATH="$out/bin:$PATH"
+ '';
+
+ postCheck = ''
+ rm -rf $out/lib/${self.python.libPrefix}/site-packages/pytest_pylons
+ rm -rf $out/lib/${self.python.libPrefix}/site-packages/rhodecode/tests
+ '';
+
+ preBuild = linkNodeModules + ''
+ grunt
+ rm -fr node_modules
+ '';
+
+ postInstall = ''
+ # python based programs need to be wrapped
+ ln -s ${self.supervisor}/bin/supervisor* $out/bin/
+ ln -s ${self.gunicorn}/bin/gunicorn $out/bin/
+ ln -s ${self.PasteScript}/bin/paster $out/bin/
+
+ # rhodecode-tools
+ # TODO: johbo: re-think this. Do the tools import anything from enterprise?
+ ln -s ${self.rhodecode-tools}/bin/rhodecode-* $out/bin/
+
+ # note that condition should be restricted when adding further tools
+ for file in $out/bin/*; do #*/
+ wrapProgram $file \
+ --prefix PYTHONPATH : $PYTHONPATH \
+ --set PYTHONHASHSEED random
+ done
+
+ mkdir $out/etc
+ cp configs/production.ini $out/etc
+
+ echo "Writing meta information for rccontrol to nix-support/rccontrol"
+ mkdir -p $out/nix-support/rccontrol
+ cp -v rhodecode/VERSION $out/nix-support/rccontrol/version
+ echo "DONE: Meta information for rccontrol written"
+
+ # TODO: johbo: Make part of ac-tests
+ if [ ! -f rhodecode/public/js/scripts.js ]; then
+ echo "Missing scripts.js"
+ exit 1
+ fi
+ if [ ! -f rhodecode/public/css/style.css ]; then
+ echo "Missing style.css"
+ exit 1
+ fi
+ '';
+
+ });
+
+ rc_testdata = self.buildPythonPackage rec {
+ name = "rc_testdata-0.7.0";
+ src = pkgs.fetchhg {
+ url = "https://code.rhodecode.com/upstream/rc_testdata";
+ rev = "v0.7.0";
+ sha256 = "0w3z0zn8lagr707v67lgys23sl6pbi4xg7pfvdbw58h3q384h6rx";
+ };
+ };
+
+ };
+
+ # Apply all overrides and fix the final package set
+ myPythonPackagesUnfix =
+ (extends pythonExternalOverrides
+ (extends pythonLocalOverrides
+ (extends pythonOverrides
+ pythonGeneratedPackages)));
+ myPythonPackages = (fix myPythonPackagesUnfix);
+
+in myPythonPackages.rhodecode-enterprise-ce
diff --git a/docs-internal/vcs/http-transition.rst b/docs-internal/vcs/http-transition.rst
new file mode 100644
--- /dev/null
+++ b/docs-internal/vcs/http-transition.rst
@@ -0,0 +1,15 @@
+.. _vcs-http:
+
+========================================
+ Transition to HTTP based communication
+========================================
+
+We are in the process of replacing the Pyro4 based communication with an HTTP
+based implementation. Currently both backends are supported and can be
+activated via various settings in the configuration.
+
+To run the system in full HTTP based mode, use the following settings::
+
+ vcs.hooks.protocol = http
+ vcs.scm_app_implementation = rhodecode.lib.middleware.utils.scm_app_http
+ vcs.server.protocol = http
diff --git a/docs-internal/vcs/index.rst b/docs-internal/vcs/index.rst
new file mode 100644
--- /dev/null
+++ b/docs-internal/vcs/index.rst
@@ -0,0 +1,23 @@
+
+======================================
+ VCS client and VCSServer integration
+======================================
+
+Enterprise uses the VCSServer as a backend to provide version control
+functionalities. This section describes the components in Enterprise which talk
+to the VCSServer.
+
+The client library is implemented in :mod:`rhodecode.lib.vcs`. For HTTP based
+access of the command line clients special middlewares and utilities are
+implemented in :mod:`rhodecode.lib.middleware`.
+
+
+
+
+.. toctree::
+ :maxdepth: 2
+
+ http-transition
+ middleware
+ vcsserver
+ subversion
diff --git a/docs/.howto b/docs/.howto
new file mode 100644
--- /dev/null
+++ b/docs/.howto
@@ -0,0 +1,4 @@
+# building the docs
+cd docs
+nix-build default.nix -o result
+make clean html
\ No newline at end of file
diff --git a/docs/Makefile b/docs/Makefile
new file mode 100644
--- /dev/null
+++ b/docs/Makefile
@@ -0,0 +1,177 @@
+# Makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS =
+SPHINXBUILD = ./result/bin/sphinx-build
+PAPER =
+BUILDDIR = _build
+
+# User-friendly check for sphinx-build
+ifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1)
+$(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/)
+endif
+
+# Internal variables.
+PAPEROPT_a4 = -D latex_paper_size=a4
+PAPEROPT_letter = -D latex_paper_size=letter
+ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+# the i18n builder cannot share the environment and doctrees with the others
+I18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+
+.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext
+
+help:
+ @echo "Please use \`make ' where is one of"
+ @echo " html to make standalone HTML files"
+ @echo " dirhtml to make HTML files named index.html in directories"
+ @echo " singlehtml to make a single large HTML file"
+ @echo " pickle to make pickle files"
+ @echo " json to make JSON files"
+ @echo " htmlhelp to make HTML files and a HTML help project"
+ @echo " qthelp to make HTML files and a qthelp project"
+ @echo " devhelp to make HTML files and a Devhelp project"
+ @echo " epub to make an epub"
+ @echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
+ @echo " latexpdf to make LaTeX files and run them through pdflatex"
+ @echo " latexpdfja to make LaTeX files and run them through platex/dvipdfmx"
+ @echo " text to make text files"
+ @echo " man to make manual pages"
+ @echo " texinfo to make Texinfo files"
+ @echo " info to make Texinfo files and run them through makeinfo"
+ @echo " gettext to make PO message catalogs"
+ @echo " changes to make an overview of all changed/added/deprecated items"
+ @echo " xml to make Docutils-native XML files"
+ @echo " pseudoxml to make pseudoxml-XML files for display purposes"
+ @echo " linkcheck to check all external links for integrity"
+ @echo " doctest to run all doctests embedded in the documentation (if enabled)"
+
+clean:
+ rm -rf $(BUILDDIR)/*
+
+html:
+ $(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
+ @echo
+ @echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
+
+dirhtml:
+ $(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
+ @echo
+ @echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
+
+singlehtml:
+ $(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
+ @echo
+ @echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
+
+pickle:
+ $(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
+ @echo
+ @echo "Build finished; now you can process the pickle files."
+
+json:
+ $(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
+ @echo
+ @echo "Build finished; now you can process the JSON files."
+
+htmlhelp:
+ $(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
+ @echo
+ @echo "Build finished; now you can run HTML Help Workshop with the" \
+ ".hhp project file in $(BUILDDIR)/htmlhelp."
+
+qthelp:
+ $(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
+ @echo
+ @echo "Build finished; now you can run "qcollectiongenerator" with the" \
+ ".qhcp project file in $(BUILDDIR)/qthelp, like this:"
+ @echo "# qcollectiongenerator $(BUILDDIR)/qthelp/RhodeCodeInstaller.qhcp"
+ @echo "To view the help file:"
+ @echo "# assistant -collectionFile $(BUILDDIR)/qthelp/RhodeCodeInstaller.qhc"
+
+devhelp:
+ $(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
+ @echo
+ @echo "Build finished."
+ @echo "To view the help file:"
+ @echo "# mkdir -p $$HOME/.local/share/devhelp/RhodeCodeInstaller"
+ @echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/RhodeCodeInstaller"
+ @echo "# devhelp"
+
+epub:
+ $(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
+ @echo
+ @echo "Build finished. The epub file is in $(BUILDDIR)/epub."
+
+latex:
+ $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+ @echo
+ @echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
+ @echo "Run \`make' in that directory to run these through (pdf)latex" \
+ "(use \`make latexpdf' here to do that automatically)."
+
+latexpdf:
+ $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+ @echo "Running LaTeX files through pdflatex..."
+ $(MAKE) -C $(BUILDDIR)/latex all-pdf
+ @echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
+
+latexpdfja:
+ $(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+ @echo "Running LaTeX files through platex and dvipdfmx..."
+ $(MAKE) -C $(BUILDDIR)/latex all-pdf-ja
+ @echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
+
+text:
+ $(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
+ @echo
+ @echo "Build finished. The text files are in $(BUILDDIR)/text."
+
+man:
+ $(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
+ @echo
+ @echo "Build finished. The manual pages are in $(BUILDDIR)/man."
+
+texinfo:
+ $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+ @echo
+ @echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
+ @echo "Run \`make' in that directory to run these through makeinfo" \
+ "(use \`make info' here to do that automatically)."
+
+info:
+ $(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+ @echo "Running Texinfo files through makeinfo..."
+ make -C $(BUILDDIR)/texinfo info
+ @echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
+
+gettext:
+ $(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
+ @echo
+ @echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
+
+changes:
+ $(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
+ @echo
+ @echo "The overview file is in $(BUILDDIR)/changes."
+
+linkcheck:
+ $(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
+ @echo
+ @echo "Link check complete; look for any errors in the above output " \
+ "or in $(BUILDDIR)/linkcheck/output.txt."
+
+doctest:
+ $(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
+ @echo "Testing of doctests in the sources finished, look at the " \
+ "results in $(BUILDDIR)/doctest/output.txt."
+
+xml:
+ $(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml
+ @echo
+ @echo "Build finished. The XML files are in $(BUILDDIR)/xml."
+
+pseudoxml:
+ $(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml
+ @echo
+ @echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml."
diff --git a/docs/_templates/layout.html b/docs/_templates/layout.html
new file mode 100644
--- /dev/null
+++ b/docs/_templates/layout.html
@@ -0,0 +1,18 @@
+{% extends "!layout.html" %}
+{% set css_files = css_files + ['_static/add.css'] %}
+
+{% block footer %}
+{{ super() }}
+
+
+
+{% endblock %}
diff --git a/docs/admin/adding-anonymous-user.rst b/docs/admin/adding-anonymous-user.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/adding-anonymous-user.rst
@@ -0,0 +1,22 @@
+.. _permissions-info-anon-ref:
+
+Anonymous Users
+---------------
+
+By default, |RCM| provides |repo| access for registered users only. It can be
+configured to be **world-open** in terms of read and write permissions. This
+configuration is called "Anonymous Access" and allows |RCM| to be used as a
+public hub where unregistered users have access to your |repos|.
+
+Anonymous access is useful for open source projects, universities,
+or if running inside a restricted internal corporate network to serve
+documents to all employees. Anonymous users get the default user permission
+settings that are applied across the whole |RCM| system.
+
+To enable anonymous access to your |repos|, use the following steps:
+
+1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`.
+2. On the Application tab, check the :guilabel:`Allow anonymous access` box.
+3. Select :guilabel:`Save`.
+4. To set the anonymous user access permissions, which are based on the
+ default user settings, see :ref:`permissions-default-ref`.
diff --git a/docs/admin/adding-new-user.rst b/docs/admin/adding-new-user.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/adding-new-user.rst
@@ -0,0 +1,20 @@
+.. _permissions-add-user:
+
+Adding Users
+------------
+
+To create a new user, use the following steps.
+
+1. Select :menuselection:`Admin --> Users` in the top menu.
+2. Select the :guilabel:`Add User` button at the top right.
+3. Set the user credentials.
+4. Select :guilabel:`Save`.
+
+Once the user is created you can set which groups they belong to using the
+following steps:
+
+1. From the :menuselection:`Admin --> Users Groups` page select
+ :guilabel:`edit` beside the user group you want to include them in.
+2. On the :guilabel:`Settings` page, move the user from
+ :guilabel:`Available Members` into :guilabel:`Chosen Members` and
+ :guilabel:`Save`.
\ No newline at end of file
diff --git a/docs/admin/admin-tricks.rst b/docs/admin/admin-tricks.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/admin-tricks.rst
@@ -0,0 +1,222 @@
+.. _admin-tricks:
+
+One-time Admin Tasks
+--------------------
+
+* :ref:`web-analytics`
+* :ref:`admin-tricks-license`
+* :ref:`announcements`
+* :ref:`md-rst`
+* :ref:`repo-stats`
+* :ref:`server-side-merge`
+* :ref:`remap-rescan`
+* :ref:`custom-hooks`
+* :ref:`clear-repo-cache`
+* :ref:`set-repo-pub`
+* :ref:`ping`
+
+.. _web-analytics:
+
+Adding Web Analytics
+^^^^^^^^^^^^^^^^^^^^
+
+If you wish to add a Google Analytics, or any other kind of tracker to your
+|RCE| instance you can add the necessary codes to the header or footer
+section of each instance using the following steps:
+
+1. From the |RCE| interface, select
+ :menuselection:`Admin --> Settings --> Global`
+2. To add a tracking code to you instance, enter it in the header or footer
+ section and select **Save**
+
+Use the example templates in the drop-down menu to set up your configuration.
+
+.. _admin-tricks-license:
+
+Licence Key Management
+^^^^^^^^^^^^^^^^^^^^^^
+
+To manage your license key, go to
+:menuselection:`Admin --> Settings --> License`.
+On this page you can see the license key details. If you need a new license,
+or have questions about your current one, contact support@rhodecode.com
+
+.. _announcements:
+
+Server-wide Announcements
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+If you need to make a server-wide announcement to all users,
+you can add a message to be displayed using the following steps:
+
+1. From the |RCE| interface, select
+ :menuselection:`Admin --> Settings --> Global`
+2. To add a message that will be displayed to all users,
+ select :guilabel:`Server Announcement` from the drop-down menu and
+ change the ``var message = "TYPE YOUR MESSAGE HERE";`` example line.
+3. Select :guilabel:`Save`, and you will see the message once your page
+ refreshes.
+
+.. image:: ../images/server-wide-announcement.png
+ :alt: Server Wide Announcement
+
+.. _md-rst:
+
+Markdown or RST Rendering
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+|RCE| can use `Markdown`_ or `reStructured Text`_ in commit message,
+code review messages, and inline comments. To set the default to either,
+select your preference from the drop-down menu on the
+:menuselection:`Admin --> Settings --> Visual` page and select
+:guilabel:`Save settings`.
+
+.. _repo-stats:
+
+Enabling Repository Statistics
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To enable |repo| statistics, use the following steps:
+
+1. From the |RCE| interface, open
+ :menuselection:`Admin --> Repositories` and select
+ :guilabel:`Edit` beside the |repo| for which you wish to enable statistics.
+2. Check the :guilabel:`Enable statistics` box, and select :guilabel:`Save`
+
+.. _server-side-merge:
+
+Enabling Server-side Merging
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To enable server-side merging, use the following steps:
+
+1. From the |RCE| interface, open :menuselection:`Admin --> Settings --> VCS`
+2. Check the :guilabel:`Server-side merge` box, and select
+ :guilabel:`Save Settings`
+
+If you encounter slow performance with server-side merging enabled, check the
+speed at which your server is performing actions. When server-side merging is
+enabled, the following actions occurs on the server.
+
+* A |pr| is created in the database.
+* A shadow |repo| is created as a working environment for the |pr|.
+* On display, |RCE| checks if the |pr| can be merged.
+
+To check how fast the shadow |repo| creation is occurring on your server, use
+the following steps:
+
+1. Log into your server and create a directory in your |repos| folder.
+2. Clone a |repo| that is showing slow performance and time the action.
+
+.. code-block:: bash
+
+ # One option is to use the time command
+ $ time hg clone SOURCE_REPO TARGET
+
+.. _remap-rescan:
+
+Remap and Rescan Repositories
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+You may want to Remap and rescan the |repos| that |RCE| is managing to ensure
+the system is always up-to-date. This is useful after importing, deleting,
+or carrying out general cleaning up operations. To do this use the
+following steps:
+
+1. From the |RCE|, open
+ :menuselection:`Admin --> Settings --> Remap and rescan`
+2. Click :guilabel:`Rescan Repositories`
+
+Check the additional options if needed:
+
+* :guilabel:`Destroy old data`: Useful for purging deleted repository
+ information from the database.
+* :guilabel:`Invalidate cache for all repositories`: Use this to completely
+ remap all |repos|. Useful when importing or migrating |repos| to ensure all
+ new information is picked up.
+
+.. _custom-hooks:
+
+Adding Custom Hooks
+^^^^^^^^^^^^^^^^^^^
+
+To add custom hooks to your instance, use the following steps:
+
+1. Open :menuselection:`Admin --> Settings --> Hooks`
+2. Add your custom hook details, you can use a file path to specify custom
+ hook scripts, for example: ``python:/path/to/custom_hook.py``
+3. Select :guilabel:`Save`
+
+Also, see the |RC| Extensions section of the :ref:`rc-tools` guide. |RC|
+Extensions can be used to add additional hooks to your instance and comes
+with a number of pre-built plugins if you chose to install them.
+
+.. _clear-repo-cache:
+
+Clearing |repo| cache
+^^^^^^^^^^^^^^^^^^^^^
+
+If you need to clear the cache for a particular |repo|, use the following steps:
+
+1. Open :menuselection:`Admin --> Repositories` and select :guilabel:`Edit`
+ beside the |repo| whose cache you wish to clear.
+2. On the |repo| settings page, go to the :guilabel:`Caches` tab and select
+ :guilabel:`Invalidate repository cache`.
+
+.. _set-lang:
+
+Changing Default Language
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To change the default language of a |RCE| instance, change the language code
+in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. To
+do this, use the following steps.
+
+1. Open the :file:`rhodecode.ini` file and set the required language code.
+
+.. code-block:: ini
+
+ ## Optional Languages
+ ## en(default), de, fr, it, ja, pl, pt, ru, zh
+ lang = de
+
+2. Restart the |RCE| instance and check that the language has been updated.
+
+.. code-block:: bash
+
+ $ rccontrol restart enterprise-2
+ Instance "enterprise-2" successfully stopped.
+ Instance "enterprise-2" successfully started.
+
+.. image:: ../images/language.png
+
+.. _set-repo-pub:
+
+Setting Repositories to Publish
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To automatically promote your local |repos| to public after pushing to |RCE|,
+enable the :guilabel:`Set repositories as publishing` option on the
+:menuselection:`Admin --> Settings --> VCS` page.
+
+.. note::
+
+ This option is enabled by default on most |RCE| versions, but if upgrading
+ from a 1.7.x version it could be disabled on upgrade due to inheriting
+ older default settings.
+
+.. _ping:
+
+Pinging the |RCE| Server
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+You can check the IP Address of your |RCE| instance using the
+following URL: ``{instance-URL}/_admin/ping``.
+
+.. code-block:: bash
+
+ $ curl https://your.rhodecode.url/_admin/ping
+ pong[rce-7880] => 203.0.113.23
+
+.. _Markdown: http://daringfireball.net/projects/markdown/
+.. _reStructured Text: http://docutils.sourceforge.net/docs/index.html
diff --git a/docs/admin/apache-conf-examples.rst b/docs/admin/apache-conf-examples.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/apache-conf-examples.rst
@@ -0,0 +1,114 @@
+.. _apache-conf-eg:
+
+Apache Configuration Examples
+-----------------------------
+
+Use the following example to securely configure your Apache HTTP virtual hosts
+file.
+
+.. code-block:: apache
+
+
+ ServerName hg.myserver.com
+ ServerAlias hg.myserver.com
+
+
+ Order allow,deny
+ Allow from all
+
+
+ # important !
+ # Directive to properly generate url (clone url) for pylons
+
+ ProxyPreserveHost On
+
+ #rhodecode instance
+ ProxyPass / http://127.0.0.1:5000/
+ ProxyPassReverse / http://127.0.0.1:5000/
+
+ # Set strict HTTPS
+ Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
+
+ # Set x-frame options
+ Header always append X-Frame-Options SAMEORIGIN
+
+ # To enable https use line below
+ # SetEnvIf X-Url-Scheme https HTTPS=1
+
+ # Secure your Diffie-hellmann deployment
+ SSLProtocol all -SSLv2 -SSLv3
+ SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+ SSLHonorCipherOrder on
+ SSLOpenSSLConfCmd DHParameters "{path to dhparams.pem}"
+
+
+
+Use the following example to configure Apache for a multi-node setup. The
+timeout setting should be increased if you experience timeouts when working
+with large |repos|.
+
+.. code-block:: apache
+
+ #
+ # Timeout: The number of seconds before receives and sends time out.
+ #
+ Timeout 600
+
+
+
+ ProxyRequests off
+
+ #important !
+ #Directive to properly generate url (clone url) for pylons
+ ProxyPreserveHost On
+
+ ServerName your.rce.com
+ ServerAlias your.rce.com
+
+
+ # WebHead1
+ BalancerMember http://10.58.1.171:10002 route=1
+ # WebHead2
+ BalancerMember http://10.58.1.172:10001 route=2
+
+ # Security "technically we aren't blocking
+ # anyone but this the place to make those
+ # chages
+ Order Deny,Allow
+ Deny from none
+ Allow from all
+
+ # Load Balancer Settings
+ # We will be configuring a simple Round
+ # Robin style load balancer. This means
+ # that all webheads take an equal share of
+ # of the load.
+ ProxySet stickysession=ROUTEID
+
+
+
+ # balancer-manager
+ # This tool is built into the mod_proxy_balancer
+ # module and will allow you to do some simple
+ # modifications to the balanced group via a gui
+ # web interface.
+
+ SetHandler balancer-manager
+
+ # recommend locking this one down to your
+ # your office
+ Order deny,allow
+ Allow from all
+
+
+ # Point of Balance
+ # This setting will allow to explicitly name the
+ # the location in the site that we want to be
+ # balanced, in this example we will balance "/"
+ # or everything in the site.
+ ProxyPass /balancer-manager !
+ ProxyPass / balancer://mycluster/
+
+ ProxyPassReverse / balancer://mycluster/
+
+
diff --git a/docs/admin/apache-config.rst b/docs/admin/apache-config.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/apache-config.rst
@@ -0,0 +1,15 @@
+.. _apache-ws-ref:
+
+Apache HTTP Server Configuration
+--------------------------------
+
+To set up your Apache Web Server for optimal performance and security, use
+the information in the following sections.
+
+.. toctree::
+
+ apache-diffie-hellman
+ apache-conf-examples
+ apache-subdirectory
+ apache-reverse-proxy
+ apache-wsgi-coding
diff --git a/docs/admin/apache-diffie-hellman.rst b/docs/admin/apache-diffie-hellman.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/apache-diffie-hellman.rst
@@ -0,0 +1,34 @@
+.. _dh-apache:
+
+Diffie-Hellman Security
+-----------------------
+
+To secure your web server, the `Guide to Deploying Diffie-Hellman for TLS`_
+contains important information worth reading. This link contains some good
+`secure Apache configuration`_ examples.
+
+To secure your deployment of Diffie-Hellman, configure the following:
+
+1. Generate a strong Diffie-hellman group, 2048-bit or stronger.
+
+.. code-block:: bash
+
+ # to generate your dhparam.pem file, run in the terminal
+ openssl dhparam -out /etc/apache/ssl/dhparam.pem 2048
+
+2. Configure your server to only use modern, secure cipher suites in the
+ virtual hosts configuration file.
+
+.. code-block:: apache
+
+ # Set the protocol to only use modern, secure cipher suites.
+ SSLProtocol all -SSLv2 -SSLv3
+ SSLHonorCipherOrder on
+ SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+
+ # Specify your DH params file as follows
+ SSLOpenSSLConfCmd DHParameters "{path to dhparams.pem}"
+
+
+.. _Guide to Deploying Diffie-Hellman for TLS: https://weakdh.org/sysadmin.html
+.. _secure Apache configuration: http://www.apache-ssl.org/httpd.conf.example
diff --git a/docs/admin/apache-reverse-proxy.rst b/docs/admin/apache-reverse-proxy.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/apache-reverse-proxy.rst
@@ -0,0 +1,33 @@
+Apache Reverse Proxy
+^^^^^^^^^^^^^^^^^^^^
+
+Here is a sample configuration file for using Apache as a reverse proxy.
+
+.. code-block:: apache
+
+
+ ServerName hg.myserver.com
+ ServerAlias hg.myserver.com
+
+ ## uncomment root directive if you want to serve static files by nginx
+ ## requires static_files = false in .ini file
+ DocumentRoot /path/to/installation/rhodecode/public
+
+
+ Order allow,deny
+ Allow from all
+
+
+ #important !
+ #Directive to properly generate url (clone url) for pylons
+ ProxyPreserveHost On
+
+ #rhodecode instance
+ ProxyPass / http://127.0.0.1:5000/
+ ProxyPassReverse / http://127.0.0.1:5000/
+
+ #to enable https use line below
+ #SetEnvIf X-Url-Scheme https HTTPS=1
+
+
+
diff --git a/docs/admin/apache-subdirectory.rst b/docs/admin/apache-subdirectory.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/apache-subdirectory.rst
@@ -0,0 +1,32 @@
+.. _apache-sub-ref:
+
+Apache URL Prefix Configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Use the following example to configure Apache to use a URL prefix.
+
+.. code-block:: apache
+
+ > # Change into your chosen prefix
+ ProxyPass http://127.0.0.1:5000/
+ ProxyPassReverse http://127.0.0.1:5000/
+ SetEnvIf X-Url-Scheme https HTTPS=1
+
+
+In addition to the regular Apache setup you will need to add the following
+lines into the ``rhodecode.ini`` file.
+
+* In the the ``[app:main]`` section of your ``rhodecode.ini`` file add the
+ following line.
+
+.. code-block:: ini
+
+ filter-with = proxy-prefix
+
+* At the end of the ``rhodecode.ini`` file add the following section.
+
+.. code-block:: ini
+
+ [filter:proxy-prefix]
+ use = egg:PasteDeploy#prefix
+ prefix = / # Change into your chosen prefix
diff --git a/docs/admin/apache-wsgi-coding.rst b/docs/admin/apache-wsgi-coding.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/apache-wsgi-coding.rst
@@ -0,0 +1,55 @@
+.. _apache-wsgi-ref:
+
+Apache WSGI Configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+|RCM| can also be set up with Apache under ``mod_wsgi``. To configure this
+use the following steps.
+
+1. Install ``mod_wsgi`` using the following command:
+ ``aptitude install libapache2-mod-wsgi``.
+2. Enable ``mod_wsgi`` using the following command: ``a2enmod wsgi``
+3. Create a ``wsgi`` dispatch script, using the following examples.
+
+.. code-block:: bash
+
+ WSGIDaemonProcess pylons \
+ threads=4 \
+ # check the python virtual env location
+ python-path=/home/web/rhodecode/pyenv/lib/python2.6/site-packages
+ # Check the install location
+ WSGIScriptAlias / /home/web/rhodecode/dispatch.wsgi
+ WSGIPassAuthorization On
+ # user=www-data group=www-data # Enable if running Apache as root
+
+.. note::
+
+ Do not set ``processes=num`` in this configuration file. Running |RCE| in
+ multiprocess mode with Apache is not supported.
+
+The following is an example ``wsgi`` dispatch script.
+
+.. code-block:: python
+
+ import os
+ os.environ["HGENCODING"] = "UTF-8"
+ os.environ['PYTHON_EGG_CACHE'] = '/home/web/rhodecode/.egg-cache'
+
+ # Set the current dir
+ os.chdir('/home/web/rhodecode/')
+
+ import site
+ site.addsitedir("/home/web/rhodecode/pyenv/lib/python2.6/site-packages")
+
+ from paste.deploy import loadapp
+ from paste.script.util.logging_config import fileConfig
+
+ fileConfig('/home/web/rhodecode/production.ini')
+ application = loadapp('config:/home/web/rhodecode/production.ini')
+
+.. note::
+
+ When using `mod_wsgi` the same version of |hg| must be running in your
+ system's |PY| environment and on |RCM|. To check the |RCM| version,
+ on the interface go to
+ :menuselection:`Admin --> Settings --> System Info`
diff --git a/docs/admin/backup-restore.rst b/docs/admin/backup-restore.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/backup-restore.rst
@@ -0,0 +1,127 @@
+.. _backup-ref:
+
+Backup and Restore
+==================
+
+*“The condition of any backup is unknown until a restore is attempted.â€*
+`Schrödinger's Backup`_
+
+To snapshot an instance of |RCE|, and save its settings, you need to backup the
+following parts of the system at the same time.
+
+* The |repos| managed by the instance.
+* The |RCE| database.
+* Any configuration files or extensions that you've configured.
+
+.. important::
+
+ Ideally you should script all of these functions so that it creates a
+ backup snapshot of your system at a particular timestamp and then run that
+ script regularly.
+
+Backup Details
+--------------
+
+To backup the relevant parts of |RCE| required to restore your system, use
+the information in this section to identify what is important to you.
+
+Repository Backup
+^^^^^^^^^^^^^^^^^
+
+To back up your |repos|, use the API to get a list of all |repos| managed,
+and then clone them to your backup location.
+
+Use the ``get_repos`` method to list all your managed |repos|,
+and use the ``clone_uri`` information that is returned. See the :ref:`api`
+for more information.
+
+.. important::
+
+ This will not work for |svn| |repos|. Currently the only way to back up
+ your |svn| |repos| is to make a copy of them.
+
+ It is also important to note, that you can only restore the |svn| |repos|
+ using the same version as they were saved with.
+
+Database Backup
+^^^^^^^^^^^^^^^
+
+The instance database contains all the |RCE| permissions settings,
+and user management information. To backup your database,
+export it using the following appropriate example, and then move it to your
+backup location:
+
+.. code-block:: bash
+
+ # For MySQL DBs
+ $ mysqldump -u -p db_name > mysql-db-backup
+
+ # For PostgreSQL DBs
+ $ pg_dump dbname > postgresql-db-backup
+
+ # For SQLlite
+ $ sqlite3 rhodecode.db ‘.dump’ > sqlite-db-backup
+
+
+The default |RCE| SQLite database location is
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.db`
+
+If running MySQL or PostgreSQL databases, you will have configured these
+separately, for more information see :ref:`rhodecode-database-ref`
+
+Configuration File Backup
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Depending on your setup, you could have a number of configuration files that
+should be backed up. You may have some, or all of the configuration files
+listed in the :ref:`config-rce-files` section. Ideally you should back these
+up at the same time as the database and |repos|.
+
+Gist Backup
+^^^^^^^^^^^
+
+To backup the gists on your |RCE| instance you can use the ``get_users`` and
+``get_gists`` API methods to fetch the gists for each user on the instance.
+
+Extension Backups
+^^^^^^^^^^^^^^^^^
+
+You should also backup any extensions added in the
+:file:`home/{user}/.rccontrol/{instance-id}/rcextensions` directory.
+
+Full-text Search Backup
+^^^^^^^^^^^^^^^^^^^^^^^
+
+You may also have full text search set up, but the index can be rebuild from
+re-imported |repos| if necessary. You will most likely want to backup your
+:file:`mapping.ini` file if you've configured that. For more information, see
+the :ref:`indexing-ref` section.
+
+Restoration Steps
+-----------------
+
+To restore an instance of |RCE| from its backed up components, use the
+following steps.
+
+1. Install a new instance of |RCE|.
+2. Once installed, configure the instance to use the backed up
+ :file:`rhodecode.ini` file. Ensure this file points to the backed up
+ database, see the :ref:`config-database` section.
+3. Restart |RCE| and remap and rescan your |repos|, see the
+ :ref:`remap-rescan` section.
+
+Post Restoration Steps
+^^^^^^^^^^^^^^^^^^^^^^
+
+Once you have restored your |RCE| instance to basic functionality, you can
+then work on restoring any specific setup changes you had made.
+
+* To recreate the |RCE| index, use the backed up :file:`mapping.ini` file if
+ you had made changes and rerun the indexer. See the
+ :ref:`indexing-ref` section for details.
+* To reconfigure any extensions, copy the backed up extensions into the
+ :file:`/home/{user}/.rccontrol/{instance-id}/rcextensions` and also specify
+ any custom hooks if necessary. See the :ref:`integrations-ref` section for
+ details.
+
+.. _Schrödinger's Backup: http://novabackup.novastor.com/blog/schrodingers-backup-good-bad-backup/
diff --git a/docs/admin/cleanup-cmds.rst b/docs/admin/cleanup-cmds.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/cleanup-cmds.rst
@@ -0,0 +1,23 @@
+.. _clean-up-cmds:
+
+|RCT| Clean Up Commands
+=======================
+
+|RCT| comes with a number of functions which can be used to administer your
+|RCE| instances. Two of these can be used to automate the cleanup of gists
+and |repos|
+
+rhodecode-cleanup-gists
+-----------------------
+
+Use this command to delete gists within RhodeCode Enterprise. It takes a
+number of options for specifying the kind of gists you want deleted, and it
+is possible to run these commands from a cron job or cleanup script. For more
+information, see the :ref:`tools-cli`
+
+rhodecode-cleanup-repos
+-----------------------
+
+Use this command to delete |repos| from your |RCE| instances. It takes
+a number of options specifying the kind of |repos| you want deleted. For more
+information, see the :ref:`tools-cli`
diff --git a/docs/admin/config-files-overview.rst b/docs/admin/config-files-overview.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/config-files-overview.rst
@@ -0,0 +1,74 @@
+.. _config-files:
+
+Configuration Files Overview
+============================
+
+|RCE| and |RCC| have a number of different configuration files. The following
+is a brief explanation of each, and links to their associated configuration
+sections.
+
+.. rst-class:: dl-horizontal
+
+ \- **rhodecode.ini**
+ Default location:
+ :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
+
+ This is the main |RCE| configuration file and controls much of its
+ default behaviour. It is also used to configure certain customer
+ settings. Here are some of the most common reasons to make changes to
+ this file.
+
+ * :ref:`config-database`
+ * :ref:`set-up-mail`
+ * :ref:`increase-gunicorn`
+ * :ref:`x-frame`
+
+ \- **mapping.ini**
+ Default location:
+ :file:`/home/{user}/.rccontrol/{instance-id}/mapping.ini`
+
+ This file is used to control the |RCE| indexer. It comes configured
+ to index your instance. To change the default configuration, see
+ :ref:`advanced-indexing`.
+
+ \- **vcsserver.ini**
+ Default location:
+ :file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini`
+
+ The VCS Server handles the connection between your |repos| and |RCE|.
+ See the :ref:`vcs-server` section for configuration options and more
+ detailed information.
+
+ \- **supervisord.ini**
+ Default location:
+ :file:`/home/{user}/.rccontrol/supervisor/supervisord.ini`
+
+ |RCC| uses Supervisor to monitor and manage installed instances of
+ |RCE| and the VCS Server. |RCC| will manage this file completely,
+ unless you install |RCE| in self-managed mode. For more information,
+ see the :ref:`Supervisor Setup` section.
+
+ \- **.rccontrol.ini**
+ Default location: :file:`/home/{user}/.rccontrol.ini`
+
+ This file contains the instances that |RCC| starts at boot, which is all
+ by default, but for more information, see
+ the :ref:`Manually Start At Boot ` section.
+
+ \- **.rhoderc**
+ Default location: :file:`/home/{user}/.rhoderc`
+
+ This file is used by the |RCE| API when accessing an instance from a
+ remote machine. The API checks this file for connection and
+ authentication details. For more details, see the :ref:`config-rhoderc`
+ section.
+
+ \- **MANIFEST**
+ Default location: :file:`/home/{user}/.rccontrol/cache/MANIFEST`
+
+ |RCC| uses this file to source the latest available builds from the
+ secure |RC| download channels. The only reason to mess with this file
+ is if you need to do an offline installation,
+ see the :ref:`Offline Installation`
+ instructions, otherwise |RCC| will completely manage this file.
+
diff --git a/docs/admin/default-user-perms.rst b/docs/admin/default-user-perms.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/default-user-perms.rst
@@ -0,0 +1,32 @@
+.. _default-perms:
+
+Default User Permissions
+------------------------
+
+There are two ways in which the default user settings work:
+
+System-wide Level
+^^^^^^^^^^^^^^^^^
+
+On a system-wide level, you can set the default user permissions so that
+all new users are given a certain set of permissions unless individually
+tailored, or added to a user group. For more information about system-wide
+default permissions, see the :ref:`permissions-info-anon-ref` and
+:ref:`permissions-default-ref` sections.
+
+User Group Level
+^^^^^^^^^^^^^^^^
+
+On a user group level, you can set the default user settings for the user
+group, and all users within that group will get those default permissions
+unless individually tailored. For more information about setting default
+permissions for all the different entities, see the
+:ref:`permissions-default-ref` section.
+
+For more detailed information about managing the different permissions
+settings, see the following sections:
+
+* :ref:`permissions-info-anon-ref`
+* :ref:`permissions-add-user`
+* :ref:`permissions-default-ref`
+* :ref:`permissions-info-add-group-ref`
\ No newline at end of file
diff --git a/docs/admin/enable-debug.rst b/docs/admin/enable-debug.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/enable-debug.rst
@@ -0,0 +1,136 @@
+.. _debug-mode:
+
+Enabling Debug Mode
+-------------------
+
+To enable debug mode on a |RCE| instance you need to set the debug property
+in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. To
+do this, use the following steps
+
+1. Open the file and set the ``debug`` line to ``true``
+2. Restart you instance using the ``rccontrol restart`` command,
+ see the following example:
+
+You can also set the log level, the follow are the valid options;
+``debug``, ``info``, ``warning``, or ``fatal``.
+
+.. code-block:: ini
+
+ [DEFAULT]
+ debug = true
+ pdebug = false
+
+.. code-block:: bash
+
+ # Restart your instance
+ $ rccontrol restart enterprise-1
+ Instance "enterprise-1" successfully stopped.
+ Instance "enterprise-1" successfully started.
+
+Debug and Logging Configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Further debugging and logging settings can also be set in the
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+
+In the logging section, the various packages that run with |RCE| can have
+different debug levels set. If you want to increase the logging level change
+``level = DEBUG`` line to one of the valid options.
+
+You also need to change the log level for handlers. See the example
+``##handler`` section below. The ``handler`` level takes the same options as
+the ``debug`` level.
+
+.. code-block:: ini
+
+ ################################
+ ### LOGGING CONFIGURATION ####
+ ################################
+ [loggers]
+ keys = root, routes, rhodecode, sqlalchemy, beaker, pyro4, templates, whoosh_indexer
+
+ [handlers]
+ keys = console, console_sql, file, file_rotating
+
+ [formatters]
+ keys = generic, color_formatter, color_formatter_sql
+
+ #############
+ ## LOGGERS ##
+ #############
+ [logger_root]
+ level = NOTSET
+ handlers = console
+
+ [logger_routes]
+ level = DEBUG
+ handlers =
+ qualname = routes.middleware
+ ## "level = DEBUG" logs the route matched and routing variables.
+ propagate = 1
+
+ [logger_beaker]
+ level = DEBUG
+ handlers =
+ qualname = beaker.container
+ propagate = 1
+
+ [logger_pyro4]
+ level = DEBUG
+ handlers =
+ qualname = Pyro4
+ propagate = 1
+
+ [logger_templates]
+ level = INFO
+ handlers =
+ qualname = pylons.templating
+ propagate = 1
+
+ [logger_rhodecode]
+ level = DEBUG
+ handlers =
+ qualname = rhodecode
+ propagate = 1
+
+ [logger_sqlalchemy]
+ level = INFO
+ handlers = console_sql
+ qualname = sqlalchemy.engine
+ propagate = 0
+
+ [logger_whoosh_indexer]
+ level = DEBUG
+ handlers =
+ qualname = whoosh_indexer
+ propagate = 1
+
+ ##############
+ ## HANDLERS ##
+ ##############
+
+ [handler_console]
+ class = StreamHandler
+ args = (sys.stderr,)
+ level = INFO
+ formatter = generic
+
+ [handler_console_sql]
+ class = StreamHandler
+ args = (sys.stderr,)
+ level = WARN
+ formatter = generic
+
+ [handler_file]
+ class = FileHandler
+ args = ('rhodecode.log', 'a',)
+ level = INFO
+ formatter = generic
+
+ [handler_file_rotating]
+ class = logging.handlers.TimedRotatingFileHandler
+ # 'D', 5 - rotate every 5days
+ # you can set 'h', 'midnight'
+ args = ('rhodecode.log', 'D', 5, 10,)
+ level = INFO
+ formatter = generic
diff --git a/docs/admin/glossary.rst b/docs/admin/glossary.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/glossary.rst
@@ -0,0 +1,50 @@
+.. _glossary:
+
+Glossary
+========
+
+.. glossary::
+
+ DVCS
+ Distributed Version Control System, usually referring to |git| or |hg|.
+
+ Extension
+ An extension extends the capabilities of, or the data available to,
+ an existing software application.
+
+ Full-text Search
+ Indexing all files and |repos| managed by |RCE| and
+ making this data searchable from the interface.
+
+ Gist
+ A note that can only be edited by the author and shared using its
+ link within others. The sharing permissions can be set during
+ its creation.
+
+ Gunicorn
+ A Python WSGI HTTP Server used by |RCE|.
+
+ Hook
+ A hook intercepts function calls, messages, or events passed between
+ software components and can be used to trigger plugins, or their
+ extensions.
+
+ Horizontal scaling
+ Adding more machines or workers into your pool of resources.
+
+ Instance
+ A single installed version of one of the |RC| products. It could
+ refer to |RCE| or the VCS server depending on the context.
+
+ Plugin
+ A Plugin is software that adds a specific feature to an existing
+ software application.
+
+ tmpfs
+ Temporary file storage kept in volatile memory instead of persistent
+ storage.
+
+ VCS Server
+ The VCS Server handles the abstraction layer between the
+ supported version control systems and RhodeCode Enterprise.
+
diff --git a/docs/admin/indexing.rst b/docs/admin/indexing.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/indexing.rst
@@ -0,0 +1,235 @@
+.. _indexing-ref:
+
+Full-text Search
+----------------
+
+By default |RCM| uses `Whoosh`_ to index |repos| and provide full-text search.
+To run the indexer you need to use an |authtoken| with admin rights to all
+|repos|.
+
+To index new content added, you have the option to set the indexer up in a
+number of ways, for example:
+
+* Call the indexer via a cron job. We recommend running this nightly,
+ unless you need everything indexed immediately.
+* Set the indexer to infinitely loop and reindex as soon as it has run its
+ cycle.
+* Hook the indexer up with your CI server to reindex after each push.
+
+The indexer works by indexing new commits added since the last run. If you
+wish to build a brand new index from scratch each time,
+use the ``force`` option in the configuration file.
+
+.. important::
+
+ You need to have |RCT| installed, see :ref:`install-tools`. Since |RCE|
+ 3.5.0 they are installed by default.
+
+To set up indexing, use the following steps:
+
+1. :ref:`config-rhoderc`, if running tools remotely.
+2. :ref:`run-index`
+3. :ref:`set-index`
+4. :ref:`advanced-indexing`
+
+.. _config-rhoderc:
+
+Configure the ``.rhoderc`` File
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+|RCT| uses the :file:`/home/{user}/.rhoderc` file for connection details
+to |RCM| instances. If this file is not automatically created,
+you can configure it using the following example. You need to configure the
+details for each instance you want to index.
+
+.. code-block:: bash
+
+ # Check the instance details
+ # of the instance you want to index
+ $ rccontrol status
+
+ - NAME: enterprise-1
+ - STATUS: RUNNING
+ - TYPE: Momentum
+ - VERSION: 1.5.0
+ - URL: http://127.0.0.1:10000
+
+To get your API Token, on the |RCM| interface go to
+:menuselection:`username --> My Account --> Auth tokens`
+
+.. code-block:: ini
+
+ # Configure .rhoderc with matching details
+ # This allows the indexer to connect to the instance
+ [instance:enterprise-1]
+ api_host = http://127.0.0.1:10000
+ api_key =
+ repo_dir = /home//repos
+
+.. _run-index:
+
+Run the Indexer
+^^^^^^^^^^^^^^^
+
+Run the indexer using the following command, and specify the instance you
+want to index:
+
+.. code-block:: bash
+
+ # From inside a virtualevv
+ (venv)$ rhodecode-index --instance-name=enterprise-1
+
+ # Using default installation
+ $ /home/user/.rccontrol/enterprise-4/profile/bin/rhodecode-index \
+ --instance-name=enterprise-4
+
+ # Using a custom mapping file
+ $ /home/user/.rccontrol/enterprise-4/profile/bin/rhodecode-index \
+ --instance-name=enterprise-4 \
+ --mapping=/home/user/.rccontrol/enterprise-4/mapping.ini
+
+.. note::
+
+ |RCT| require |PY| 2.7 to run.
+
+.. _set-index:
+
+Schedule the Indexer
+^^^^^^^^^^^^^^^^^^^^
+
+To schedule the indexer, configure the crontab file to run the indexer inside
+your |RCT| virtualenv using the following steps.
+
+1. Open the crontab file, using ``crontab -e``.
+2. Add the indexer to the crontab, and schedule it to run as regularly as you
+ wish.
+3. Save the file.
+
+.. code-block:: bash
+
+ $ crontab -e
+
+ # The virtualenv can be called using its full path, so for example you can
+ # put this example into the crontab
+
+ # Run the indexer daily at 4am using the default mapping settings
+ * 4 * * * /home/ubuntu/.virtualenv/rhodecode-venv/bin/rhodecode-index \
+ --instance-name=enterprise-1
+
+ # Run the indexer every Sunday at 3am using default mapping
+ * 3 * * 0 /home/ubuntu/.virtualenv/rhodecode-venv/bin/rhodecode-index \
+ --instance-name=enterprise-1
+
+ # Run the indexer every 15 minutes
+ # using a specially configured mapping file
+ */15 * * * * ~/.rccontrol/enterprise-4/profile/bin/rhodecode-index \
+ --instance-name=enterprise-4 \
+ --mapping=/home/user/.rccontrol/enterprise-4/mapping.ini
+
+.. _advanced-indexing:
+
+Advanced Indexing
+^^^^^^^^^^^^^^^^^
+
+|RCT| indexes based on the :file:`mapping.ini` file. To configure your index,
+you can specify different options in this file. The default location is:
+
+* :file:`/home/{user}/.rccontrol/{instance-id}/mapping.ini`, using default
+ |RCT|.
+* :file:`~/venv/lib/python2.7/site-packages/rhodecode_tools/templates/mapping.ini`,
+ when using ``virtualenv``.
+
+.. note::
+
+ If you need to create the :file:`mapping.ini` file, use the |RCT|
+ ``rhodecode-index --create-mapping path/to/file`` API call. For details,
+ see the :ref:`tools-cli` section.
+
+The indexer runs in a random order to prevent a failing |repo| from stopping
+a build. To configure different indexing scenarios, set the following options
+inside the :file:`mapping.ini` and specify the altered file using the
+``--mapping`` option.
+
+* ``index_files`` : Index the specified file types.
+* ``skip_files`` : Do not index the specified file types.
+* ``index_files_content`` : Index the content of the specified file types.
+* ``skip_files_content`` : Do not index the content of the specified files.
+* ``force`` : Create a fresh index on each run.
+* ``max_filesize`` : Files larger than the set size will not be indexed.
+* ``commit_parse_limit`` : Set the batch size when indexing commit messages.
+ Set to a lower number to lessen memory load.
+* ``repo_limit`` : Set the maximum number or |repos| indexed per run.
+* ``[INCLUDE]`` : Set |repos| you want indexed. This takes precedent over
+ ``[EXCLUDE]``.
+* ``[EXCLUDE]`` : Set |repos| you do not want indexed. Exclude can be used to
+ not index branches, forks, or log |repos|.
+
+At the end of the file you can specify conditions for specific |repos| that
+will override the default values. To configure your indexer,
+use the following example :file:`mapping.ini` file.
+
+.. code-block:: ini
+
+ [__DEFAULT__]
+ # default patterns for indexing files and content of files.
+ # Binary files are skipped by default.
+
+ # Index python and markdown files
+ index_files = *.py, *.md
+
+ # Do not index these file types
+ skip_files = *.svg, *.log, *.dump, *.txt
+
+ # Index both file types and their content
+ index_files_content = *.cpp, *.ini, *.py
+
+ # Index file names, but not file content
+ skip_files_content = *.svg,
+
+ # Force rebuilding an index from scratch. Each repository will be rebuild
+ # from scratch with a global flag. Use local flag to rebuild single repos
+ force = false
+
+ # Do not index files larger than 385KB
+ max_filesize = 385KB
+
+ # Limit commit indexing to 500 per batch
+ commit_parse_limit = 500
+
+ # Limit each index run to 25 repos
+ repo_limit = 25
+
+ # __INCLUDE__ is more important that __EXCLUDE__.
+
+ [__INCLUDE__]
+ # Include all repos with these names
+
+ docs/* = 1
+ lib/* = 1
+
+ [__EXCLUDE__]
+ # Do not include the following repo in index
+
+ dev-docs/* = 1
+ legacy-repos/* = 1
+ *-dev/* = 1
+
+ # Each repo that needs special indexing is a separate section below.
+ # In each section set the options to override the global configuration
+ # parameters above.
+ # If special settings are not configured, the global configuration values
+ # above are inherited. If no special repositories are
+ # defined here RhodeCode will use the API to ask for all repositories
+
+ # For this repo use different settings
+ [special-repo]
+ commit_parse_limit = 20,
+ skip_files = *.idea, *.xml,
+
+ # For another repo use different settings
+ [another-special-repo]
+ index_files = *,
+ max_filesize = 800MB
+ commit_parse_limit = 20000
+
+.. _Whoosh: https://pypi.python.org/pypi/Whoosh/
diff --git a/docs/admin/lab-settings.rst b/docs/admin/lab-settings.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/lab-settings.rst
@@ -0,0 +1,41 @@
+.. _lab-settings:
+
+Lab Settings
+============
+
+|RCE| Lab Settings is for delivering features which may require an additional
+level of support to optimize for production scenarios. To enable lab settings,
+use the following instructions:
+
+1. Open the |RCE| configuration file,
+ :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
+
+2. Add the following configuration option in the ``[app:main]`` section.
+
+.. code-block:: bash
+
+ [app:main]
+
+ ## Display extended labs settings
+ labs_settings_active = true
+
+3. Restart your |RCE| instance
+
+.. code-block:: bash
+
+ $ rccontrol restart enterprise-1
+
+4. You will see the labs setting on the
+ :menuselection:`Admin --> Settings --> labs` page.
+
+.. image:: ../images/lab-setting.png
+
+Available Lab Extras
+--------------------
+
+Once lab settings are enabled, the following features are available.
+
+.. toctree::
+ :maxdepth: 1
+
+ svn-http
diff --git a/docs/admin/nginx-config-example.rst b/docs/admin/nginx-config-example.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/nginx-config-example.rst
@@ -0,0 +1,71 @@
+Nginx Configuration Example
+---------------------------
+
+Use the following example to configure Nginx as a your web server.
+
+.. code-block:: nginx
+
+ upstream rc {
+
+ server 127.0.0.1:5000;
+
+ # add more instances for load balancing
+ # server 127.0.0.1:5001;
+ # server 127.0.0.1:5002;
+ }
+
+ ## gist alias
+
+ server {
+ listen 443;
+ server_name gist.myserver.com;
+ access_log /var/log/nginx/gist.access.log;
+ error_log /var/log/nginx/gist.error.log;
+
+ ssl on;
+ ssl_certificate gist.rhodecode.myserver.com.crt;
+ ssl_certificate_key gist.rhodecode.myserver.com.key;
+
+ ssl_session_timeout 5m;
+
+ ssl_protocols SSLv3 TLSv1;
+ ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5;
+ ssl_prefer_server_ciphers on;
+ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
+
+ # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+ ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+
+ rewrite ^/(.+)$ https://rhodecode.myserver.com/_admin/gists/$1;
+ rewrite (.*) https://rhodecode.myserver.com/_admin/gists;
+ }
+
+ server {
+ listen 443;
+ server_name rhodecode.myserver.com;
+ access_log /var/log/nginx/rhodecode.access.log;
+ error_log /var/log/nginx/rhodecode.error.log;
+
+ ssl on;
+ ssl_certificate rhodecode.myserver.com.crt;
+ ssl_certificate_key rhodecode.myserver.com.key;
+
+ ssl_session_timeout 5m;
+
+ ssl_protocols SSLv3 TLSv1;
+ ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5;
+ ssl_prefer_server_ciphers on;
+
+ ## uncomment root directive if you want to serve static files by nginx
+ ## requires static_files = false in .ini file
+ # root /path/to/installation/rhodecode/public;
+
+ include /etc/nginx/proxy.conf;
+ location / {
+ try_files $uri @rhode;
+ }
+
+ location @rhode {
+ proxy_pass http://rc;
+ }
+ }
diff --git a/docs/admin/nginx-config.rst b/docs/admin/nginx-config.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/nginx-config.rst
@@ -0,0 +1,14 @@
+.. _nginx-ws-ref:
+
+Nginx Configuration
+===================
+
+To set up your Nginx Web Server for optimal performance and security, use
+the information in the following sections.
+
+.. toctree::
+
+ nginx-diffie-hellman
+ nginx-config-example
+ nginx-tuning
+ nginx-url-prefix
diff --git a/docs/admin/nginx-diffie-hellman.rst b/docs/admin/nginx-diffie-hellman.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/nginx-diffie-hellman.rst
@@ -0,0 +1,34 @@
+.. _dh-nginx:
+
+Diffie-Hellman Security
+-----------------------
+
+To secure your web server, the `Guide to Deploying Diffie-Hellman for TLS`_
+contains important information worth reading. This link contains a good
+`nginx secure configuration`_ example. The documentation below also contains
+good security settings with some additional |RCE| specific examples.
+
+To secure your deployment of Diffie-Hellman, configure the following:
+
+* Generate a strong Diffie-hellman group, 2048-bit or stronger.
+
+.. code-block:: bash
+
+ # to generate your dhparam.pem file, run in the terminal
+ openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
+
+* Configure your server to only use modern, secure cipher suites in the
+ virtual hosts configuration file.
+
+.. code-block:: nginx
+
+ # Set the TLS protocols and to only use modern, secure cipher suites.
+ ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
+ ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+ ssl_prefer_server_ciphers on;
+
+ # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+ ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+
+.. _Guide to Deploying Diffie-Hellman for TLS: https://weakdh.org/sysadmin.html
+.. _nginx secure configuration: https://gist.github.com/plentz/6737338
diff --git a/docs/admin/nginx-tuning.rst b/docs/admin/nginx-tuning.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/nginx-tuning.rst
@@ -0,0 +1,33 @@
+.. _nginx-tuning:
+
+Nginx Tuning
+------------
+
+Set the following properties in your ``/etc/nginx/proxy.conf`` so it does not
+timeout during large pushes.
+
+.. code-block:: nginx
+
+ proxy_redirect off;
+ proxy_set_header Host $host;
+
+ ## needed for container auth
+ # proxy_set_header REMOTE_USER $remote_user;
+ # proxy_set_header X-Forwarded-User $remote_user;
+
+ proxy_set_header X-Url-Scheme $scheme;
+ proxy_set_header X-Host $http_host;
+ proxy_set_header X-Real-IP $remote_addr;
+ proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+ proxy_set_header Proxy-host $proxy_host;
+ proxy_buffering off;
+ proxy_connect_timeout 7200;
+ proxy_send_timeout 7200;
+ proxy_read_timeout 7200;
+ proxy_buffers 8 32k;
+ # Set this to a larger number if you experience timeouts
+ client_max_body_size 1024m;
+ client_body_buffer_size 128k;
+ large_client_header_buffers 8 64k;
+ add_header X-Frame-Options SAMEORIGIN;
+ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
diff --git a/docs/admin/nginx-url-prefix.rst b/docs/admin/nginx-url-prefix.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/nginx-url-prefix.rst
@@ -0,0 +1,33 @@
+.. _nginx_url-pre:
+
+Nginx URL Prefix Configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Use the following example to configure Nginx to use a URL prefix.
+
+.. code-block:: nginx
+
+ location /foo {
+ rewrite /foo(.*) /$1 break;
+ proxy_pass http://localhost:3200;
+ proxy_redirect off;
+ proxy_set_header Host $host;
+ }
+
+In addition to the Nginx configuration you will need to add the following
+lines into the ``rhodecode.ini`` file.
+
+* In the the ``[app:main]`` section of your ``rhodecode.ini`` file add the
+ following line.
+
+.. code-block:: ini
+
+ filter-with = proxy-prefix
+
+* At the end of the ``rhodecode.ini`` file add the following section.
+
+.. code-block:: ini
+
+ [filter:proxy-prefix]
+ use = egg:PasteDeploy#prefix
+ prefix = / # Change into your chosen prefix
diff --git a/docs/admin/public-access.rst b/docs/admin/public-access.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/public-access.rst
@@ -0,0 +1,12 @@
+.. _public-access:
+
+Public Access
+-------------
+
+By default |RCM| allows users to read all **public** |repos|. User
+permissions and |repo| access can be configured explicitly,
+and those permissions will override any default settings. The default
+settings can be found under the following section:
+
+* :menuselection:`Admin --> Permissions --> Object`
+* :menuselection:`Admin --> Permissions --> Global`
diff --git a/docs/admin/repo-extra-fields.rst b/docs/admin/repo-extra-fields.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/repo-extra-fields.rst
@@ -0,0 +1,68 @@
+.. _repo-xtra:
+
+Repository Extra Fields
+=======================
+
+Extra fields attached to a |repo| allow you to configure additional actions for
+|RCX|. To install and read more about |RCX|, see the :ref:`install-rcx` section.
+
+Enabling Extra Fields
+---------------------
+
+To enable extra fields on |repos|, use the following steps:
+
+1. Go to the :menuselection:`Admin --> Settings --> Visual` page.
+2. Check the :guilabel:`Use repository extra fields` box.
+3. Save your changes.
+
+
+Configuring Extra Fields
+------------------------
+
+To configure extra fields per repository, use the following steps:
+
+1. Go to :menuselection:`Admin --> Repositories` and select :guilabel:`Edit`
+ beside the |repo| to which you wish to add extra fields.
+2. On the |repo| settings page, select the :guilabel:`Extra fields` tab.
+
+.. image:: ../images/extra-repo-fields.png
+
+
+Example Usage
+-------------
+
+To use the extra fields in an extension, see the example below. For more
+information and examples, see the :ref:`integrations-ref` section.
+
+.. code-block:: python
+
+ call = load_extension('http_notify.py')
+ if call:
+ url = 'http://default.url' #
+
+ # possibly extract the URL from extra fields
+ call = load_extension('extra_fields.py')
+ if call:
+ repo_extra_fields = call(**kwargs)
+ # now update if we have extra fields, they have precedence
+ # this way users can store any configuration inside the database per
+ # repo
+ for key, data in repo_extra_fields.items():
+ kwargs[key] = data['field_value']
+
+ # an endpoint url data will be sent to, fetched from extra fields
+ # if exists, or fallback to default
+ kwargs['URL'] = kwargs.pop('webhook_url', None) or url
+
+ # fetch pushed commits, from commit_ids list
+ call = load_extension('extract_commits.py')
+ extracted_commits = {}
+ if call:
+ extracted_commits = call(**kwargs)
+ # store the commits for the next call chain
+ kwargs['COMMITS'] = extracted_commits
+
+ # set additional keys and values to be sent via POST to given URL
+ kwargs['caller_type'] = 'rhodecode'
+ kwargs['date'] = time.time() # import time before
+ call(**kwargs)
diff --git a/docs/admin/repo-hooks.rst b/docs/admin/repo-hooks.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/repo-hooks.rst
@@ -0,0 +1,56 @@
+.. _repo-hooks:
+
+|RCE| Repository Hooks
+======================
+
+|RCE| installs hooks inside each of the |repos| that it manages. These
+hooks enable users to execute custom actions based on certain events.
+This is the complete list of |repos| hooks and the events which trigger them:
+
+.. rst-class:: dl-horizontal
+
+ \--CREATE_REPO_HOOK
+ Any time a |repo| is created.
+
+ \--CREATE_REPO_GROUP_HOOK
+ Any time a |repo| group is created.
+
+ \--CREATE_USER_HOOK
+ Any time a user is created.
+
+ \--DELETE_REPO_HOOK
+ Any time a |repo| is created.
+
+ \--DELETE_USER_HOOK
+ Any time a user is deleted.
+
+ \--PRE_CREATE_USER_HOOK
+ Any time a user is created but before the action is executed by |RCE|.
+
+ \--PRE_PULL
+ Any pull from a |repo| but before the action is executed by |RCE|.
+
+ \--PRE_PUSH
+ Any push to a |repo| but before the action is executed by |RCE|.
+
+ \--POST_PUSH
+ After any push to a |repo|.
+
+ \--PUSH_HOOK
+ Any push to a |repo|, including editing tags or branches.
+ Commits via API actions that update references are also counted.
+
+ \--PULL_HOOK
+ Any pull from a Repository.
+
+Using Repository Hooks
+----------------------
+
+To use these hooks you need to install |RCX|. For more information, see the
+:ref:`install-rcx` section.
+
+Creating Extensions
+-------------------
+
+To create your own extensions using these hooks, see the :ref:`dev-plug`
+section.
diff --git a/docs/admin/repo-issue-tracker.rst b/docs/admin/repo-issue-tracker.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/repo-issue-tracker.rst
@@ -0,0 +1,30 @@
+.. _repo-it:
+
+Repository Issue Tracker
+========================
+
+You can set an issue tracker connection in two ways with |RCE|.
+
+* At instance level, for more information see the
+ :ref:`rhodecode-issue-trackers-ref` section.
+* At |repo| level. This allows you to configure a |repo| to use a different
+ issue tracker to the default one.
+
+Set an Issue Tracker per Repository
+-----------------------------------
+
+To configure a |repo| to work with a different issue tracker to the default one,
+use the following steps:
+
+1. Open :menuselection:`Admin --> Repositories --> repo name --> Edit --> Issue Tracker`
+2. Uncheck the :guilabel:`Inherit from default settings` box.
+3. Click :guilabel:`Add New`.
+4. Fill in the following settings:
+
+ * :guilabel:`Description`: A name for this set of rules.
+ * :guilabel:`Pattern`: The regular expression that will match issues
+ tagged in commit messages, or more see :ref:`issue-tr-eg-ref`.
+ * :guilabel:`URL`: The URL to your issue tracker.
+ * :guilabel:`Prefix`: The prefix with which you want to mark issues.
+
+5. Click :guilabel:`Save`.
diff --git a/docs/admin/repo-perm-steps.rst b/docs/admin/repo-perm-steps.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/repo-perm-steps.rst
@@ -0,0 +1,45 @@
+.. _set-repo-perms:
+
+Setting Repository Permissions
+------------------------------
+
+To set the permissions on an individual |repo|, use the following steps:
+
+1. Open :menuselection:`Admin --> Repositories` and select
+ :guilabel:`edit` beside the |repo| you wish to configure.
+2. On the |repo| settings page you will see a number of tabs. Exploring these
+ you will find the following main configuration options for a |repo|.
+3. Once you make changes, select :guilabel:`Save`
+
+* :guilabel:`Repository group`: Lets you to add a |repo| to a |repo| group.
+* :guilabel:`Owner`: Lets you change the |repo| owner. Useful when users are
+ moving roles within an organisation.
+* :guilabel:`Enable automatic locking`: For more information,
+ see :ref:`repo-locking`
+* :guilabel:`User Access`: On the permissions tab you can add users,
+ or user groups, and set the permissions each has for that |repo|.
+* :guilabel:`Invalidate repository cache`: On the Caches tab you can delete
+ the |repo| cache, sometimes needed when mirroring.
+
+.. _set-repo-group-perms:
+
+Setting Repository Group Permissions
+------------------------------------
+
+To set the permissions on a Repository Group, use the following steps:
+
+1. Open :menuselection:`Admin --> Repository groups` and select
+ :guilabel:`edit` beside the |repo| you wish to configure.
+2. On the |repo| group settings page you will see a number of tabs. Exploring
+ these you will find the following main configuration options:
+
+* :guilabel:`Owner`: Lets you change the group owner. Useful when users are
+ moving roles within an organisation.
+* :guilabel:`Group parent`: Lets you add the |repo| group as a sub-group
+ of a larger group, i.e. :guilabel:`QA-Repos >> QA-Repos-Berlin`
+* :guilabel:`Enable automatic locking`: For more information,
+ see :ref:`repo-locking`
+* :guilabel:`User Access`: On the permissions tab you can add users,
+ or user groups, and set the permissions each has for that |repo| group.
+* :guilabel:`Add Child Group`: Allows you to add sub-repository-groups
+ that will all share the same permissions.
diff --git a/docs/admin/repo-vcs.rst b/docs/admin/repo-vcs.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/repo-vcs.rst
@@ -0,0 +1,48 @@
+.. _per-repo-vcs:
+
+Repository VCS Settings
+=======================
+
+You can configure |repo| VCS (Version Control System) settings at a global
+level, and individually per |repo|. Global settings are applied by default.
+If you configure individual settings per |repo|, these will remain unaffected
+by any subsequent global changes.
+
+Set Global Repository Settings
+------------------------------
+
+To configure |repo| settings across your |RCE| instance use the following steps:
+
+1. Go to to the :menuselection:`Admin --> Settings --> VCS` page.
+2. Configure the following |repo| options:
+
+ * :guilabel:`Web`: Require SSL if necessary.
+ * :guilabel:`Hooks`: Enable built in hooks.
+ * :guilabel:`Mercurial Settings`: Configure |hg| specific settings.
+ * :guilabel:`Repositories Location`: Set the file system |repos| location.
+ * :guilabel:`Subversion Settings`: Configure |svn| specific settings.
+ * :guilabel:`Pull Request Settings`: Enable the listed additional |pr|
+ features.
+
+3. Click :guilabel:`Save`.
+
+
+Set Individual Repository Settings
+----------------------------------
+
+To configure specific VCS settings for an individual |repo|, use the following
+steps:
+
+1. Go to to the :menuselection:`Admin --> Repositories --> Edit --> VCS` page.
+2. Uncheck the :guilabel:`Inherit from global settings` box.
+3. Configure the following |repo| options:
+
+ * :guilabel:`Hooks`: Enable built in hooks.
+ * :guilabel:`Mercurial Settings` (|hg| Only): Configure |hg| specific
+ settings.
+ * :guilabel:`Subversion Settings` (|svn| Only): Configure |svn| specific
+ settings.
+ * :guilabel:`Pull Request Settings` (|git| and |hg| Only): Enable the
+ listed additional |pr| features.
+
+3. Click :guilabel:`Save`.
diff --git a/docs/admin/reset-information.rst b/docs/admin/reset-information.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/reset-information.rst
@@ -0,0 +1,95 @@
+.. _rhodecode-reset-ref:
+
+Settings Management
+-------------------
+
+All |RCE| settings can be set from the user interface, but in the event that
+it somehow becomes unavailable you can use ``ishell`` inside your |RCE|
+``virtualenv`` to carry out emergency measures.
+
+.. warning::
+
+ Logging into the |RCE| database with ``iShell`` should only be done by an
+ experienced and knowledgeable database administrator.
+
+Reset Admin Account Privileges
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+If you accidentally remove your admin privileges from the admin account you
+can restore them using ``ishell``. Use the following example to reset your
+account permissions.
+
+.. code-block:: bash
+
+ # Open iShell from the terminal
+ $ .rccontrol/enterprise-5/profile/bin/paster \
+ ishell .rccontrol/enterprise-5/rhodecode.ini
+
+.. code-block:: mysql
+
+ # Use this example to change user permissions
+ In [1]: adminuser = User.get_by_username('username')
+ In [2]: adminuser.admin = True
+ In [3]: Session.add(adminuser);Session().commit()
+ In [4]: exit()
+
+Set to read global ``.hgrc`` file
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+By default, |RCE| does not read global ``hgrc`` files in
+``/etc/mercurial/hgrc`` or ``/etc/mercurial/hgrc.d`` because it
+can lead to issues. This is set in the ``rhodecode_ui`` table for which
+there is no UI. If you need to edit this you can
+manually change the settings using SQL statements with ``ishell``. Use the
+following example to make changes to this table.
+
+.. code-block:: bash
+
+ # Open iShell from the terminal
+ $ .rccontrol/enterprise-5/profile/bin/paster \
+ ishell.rccontrol/enterprise-5/rhodecode.ini
+
+.. code-block:: mysql
+
+ # Use this example to enable global .hgrc access
+ In [4]: new_option = RhodeCodeUi()
+ In [5]: new_option.ui_section='web'
+ In [6]: new_option.ui_key='allow_push'
+ In [7]: new_option.ui_value='*'
+ In [8]: Session().add(new_option);Session().commit()
+
+Manually Reset Password
+^^^^^^^^^^^^^^^^^^^^^^^
+
+If you need to manually reset a user password, use the following steps.
+
+1. Navigate to your |RCE| install location.
+2. Run the interactive ``ishell`` prompt.
+3. Set a new password.
+
+Use the following code example to carry out these steps.
+
+.. code-block:: bash
+
+ # starts the ishell interactive prompt
+ $ .rccontrol/enterprise-5/profile/bin/paster \
+ ishell .rccontrol/enterprise-5/rhodecode.ini
+
+.. code-block:: mysql
+
+ from rhodecode.lib.auth import generate_auth_token
+ from rhodecode.lib.auth import get_crypt_password
+
+ # Enter the user name whose password you wish to change
+ my_user = 'USERNAME'
+ u = User.get_by_username(my_user)
+
+ # If this fails then the user does not exist
+ u.auth_token = generate_auth_token(my_user)
+
+ # Set the new password
+ u.password = get_crypt_password('PASSWORD')
+
+ Session().add(u)
+ Session().commit()
+ exit
diff --git a/docs/admin/rhodecode-backup.rst b/docs/admin/rhodecode-backup.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/rhodecode-backup.rst
@@ -0,0 +1,26 @@
+.. _backup:
+
+====================
+Backing up RhodeCode
+====================
+
+
+Settings
+--------
+
+Just copy your .ini file, it contains all RhodeCode settings.
+
+Whoosh index
+------------
+
+Whoosh index is located in **/data/index** directory where you installed
+RhodeCode ie. the same place where the ini file is located
+
+
+Database
+--------
+
+When using sqlite just copy rhodecode.db.
+Any other database engine requires a manual backup operation.
+
+Database backup will contain all gathered statistics
\ No newline at end of file
diff --git a/docs/admin/sec-instance-basics.rst b/docs/admin/sec-instance-basics.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/sec-instance-basics.rst
@@ -0,0 +1,31 @@
+.. _instance-basics:
+
+3 Basic User Security Steps
+===========================
+
+By implementing the following user configuration tasks, you will help to
+secure your |RCE| instances.
+
+
+Define the Instance Wide Default User
+-------------------------------------
+
+The default user settings are applied across the whole instance. You should
+define the default user so that newly created users immediately have
+permission settings attached to their profile. For more information about
+defining the default user settings, see the :ref:`default-perms` section.
+
+Configure Specific User Groups
+------------------------------
+
+By defining user groups, it allows you to put users into them and
+have the group permissions applied to their profile. For more information about
+defining the default user settings, see the :ref:`user-admin-set` section.
+
+Define the Default User in Each Group
+-------------------------------------
+
+Apart from the system wide user permissions, each user group can apply its
+settings to the default user permissions within the scope of the group. To
+set the default user's permissions inside a user group, see the
+:ref:`permissions-info-repo-group-access` section.
diff --git a/docs/admin/sec-ip-white.rst b/docs/admin/sec-ip-white.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/sec-ip-white.rst
@@ -0,0 +1,19 @@
+.. _settip-ip-white:
+
+Setting IP Restrictions
+=======================
+
+To restrict access to your |RCE| instance you can set an IP Whitelist that
+will only allow access from specific IP Addresses. This is useful for
+ensuring only users on the company VPN can access the instance.
+
+To set this, go to
+:menuselection:`Username --> Permissions --> IP Whitelist`, and add the safe
+range of IP Addresses to the list.
+
+.. important::
+
+ Add the IP Address that you are currently using first,
+ otherwise you'll lock yourself out of the instance.
+
+.. image:: ../images/ip-whitey.png
diff --git a/docs/admin/sec-x-frame.rst b/docs/admin/sec-x-frame.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/sec-x-frame.rst
@@ -0,0 +1,57 @@
+.. _x-frame:
+
+Securing HTTPS Connections
+--------------------------
+
+* To secure your |RCE| instance against `Cross Frame Scripting`_ exploits, you
+ should configure your webserver ``x-frame-options`` setting.
+
+* To configure your instance for `HTTP Strict Transport Security`_, you need to
+ configure the ``Strict-Transport-Security`` setting.
+
+Nginx
+^^^^^
+
+In your nginx configuration, add the following lines in the correct files. For
+more detailed information see the :ref:`nginx-ws-ref` section.
+
+.. code-block:: nginx
+
+ # Add this line to the nginx.conf file
+ add_header X-Frame-Options SAMEORIGIN;
+
+ # This line needs to be added inside your virtual hosts block/file
+ add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
+
+Apache
+^^^^^^
+
+In your :file:`apache2.conf` file, add the following line. For more detailed
+information see the :ref:`apache-ws-ref` section.
+
+.. code-block:: apache
+
+ # Add this to your virtual hosts file
+ Header always append X-Frame-Options SAMEORIGIN
+
+ # Add this line in your virtual hosts file
+ Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
+
+|RCE| Configuration
+^^^^^^^^^^^^^^^^^^^
+
+|RCE| can also be configured to force strict *https* connections and Strict
+Transport Security. To set this, configure the following options to ``true``
+in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+
+.. code-block:: ini
+
+ ## force https in RhodeCode, fixes https redirects, assumes it's always https
+ force_https = false
+
+ ## use Strict-Transport-Security headers
+ use_htsts = false
+
+
+.. _Cross Frame Scripting: https://www.owasp.org/index.php/Cross_Frame_Scripting
+.. _HTTP Strict Transport Security: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security
\ No newline at end of file
diff --git a/docs/admin/sec-your-server.rst b/docs/admin/sec-your-server.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/sec-your-server.rst
@@ -0,0 +1,179 @@
+.. _sec-your-server:
+
+Securing Your Server
+--------------------
+
+|RCE| runs on your hardware, and while it is developed with security in mind
+it is also important that you ensure your servers are well secured. In this
+section we will cover some basic security practices that are best to
+configure when setting up your |RCE| instances.
+
+SSH Keys
+^^^^^^^^
+
+Using SSH keys to access your server provides more security than using the
+standard username and password combination. To set up your SSH Keys, use the
+following steps:
+
+1. On your local machine create the public/private key combination. The
+ private key you will keep, and the matching public key is copied to the
+ server. Setting a passphrase here is optional, if you set one you will
+ always be prompted for it when logging in.
+
+.. code-block:: bash
+
+ # Generate SSH Keys
+ user@ubuntu:~$ ssh-keygen -t rsa
+
+.. code-block:: bash
+
+ Generating public/private rsa key pair.
+ Enter file in which to save the key (/home/user/.ssh/id_rsa):
+ Created directory '/home/user/.ssh'.
+ Enter passphrase (empty for no passphrase):
+ Enter same passphrase again:
+ Your identification has been saved in /home/user/.ssh/id_rsa.
+ Your public key has been saved in /home/user/.ssh/id_rsa.pub.
+ The key fingerprint is:
+ 02:82:38:95:e5:30:d2:ad:17:60:15:7f:94:17:9f:30 user@ubuntu
+ The key's randomart image is:
+ +--[ RSA 2048]----+
+
+2. SFTP to your server, and copy the public key to the ``~/.ssh`` folder.
+
+.. code-block:: bash
+
+ # SFTP to your server
+ $ sftp user@hostname
+
+ # copy your public key
+ sftp> mput /home/user/.ssh/id_rsa.pub /home/user/.ssh
+ Uploading /home/user/.ssh/id_rsa.pub to /home/user/.ssh/id_rsa.pub
+ /home/user/.ssh/id_rsa.pub 100% 394 0.4KB/s 00:00
+
+3. On your server, add the public key to the :file:`~/.ssh/authorized_keys`
+ file.
+
+.. code-block:: bash
+
+ $ cat /home/user/.ssh/id_rsa.pub > /home/user/.ssh/authorized_keys
+
+You should now be able to log into your server using your SSH
+Keys. If you've added a passphrase you'll be asked for it. For more
+information about using SSH keys with |RCE| |repos|, see the
+:ref:`ssh-connection` section.
+
+VPN Whitelist
+^^^^^^^^^^^^^
+
+Most company networks will have a VPN. If you need to set one up, there are
+many tutorials online for how to do that. Getting it right requires good
+knowledge and attention to detail. Once set up, you can configure your
+|RCE| instances to only allow user access from the VPN, to do this see the
+:ref:`settip-ip-white` section.
+
+Public Key Infrastructure and SSL/TLS Encryption
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Public key infrastructure (PKI) is a system that creates, manages, and
+validates certificates for identifying nodes on a network and encrypting
+communication between them. SSL or TLS certificates can be used to
+authenticate different entities with one another. To read more about PKIs,
+see the `OpenSSL PKI tutorial`_ site, or this `Cloudflare PKI post`_.
+
+If the network you are running is SSL/TLS encrypted, you can configure |RCE|
+to always use secure connections using the ``force_https`` and ``use_htsts``
+options in the :file:`/home/user/.rccontrol/instance-id/rhodecode.ini` file.
+For more details, see the :ref:`x-frame` section.
+
+FireWalls and Ports
+^^^^^^^^^^^^^^^^^^^
+
+Setting up a network firewall for your internal traffic is a good way
+of keeping it secure by blocking off any ports that should not be used.
+Additionally, you can set non-default ports for certain functions which adds
+an extra layer of security to your setup.
+
+A well configured firewall will restrict access to everything except the
+services you need to remain open. By exposing fewer services you reduce the
+number of potential vulnerabilities.
+
+There are a number of different firewall solutions, but for most Linux systems
+using the built in `IpTables`_ firewall should suffice. On BSD systems you
+can use `IPFILTER`_ or `IPFW`_. Use the following examples, and the IpTables
+documentation to configure your IP Tables on Ubuntu.
+
+Changing the default SSH port.
+
+.. code-block:: bash
+
+ # Open SSH config file and change to port 10022
+ vi /etc/ssh/sshd_config
+
+ # What ports, IPs and protocols we listen for
+ Port 10022
+
+Setting IP Table rules for SSH traffic. It is important to note that the
+default policy of your IpTables can differ and it is worth checking how each
+is configured. The options are *ACCEPT*, *REJECT*, *DROP*, or *LOG*. The
+usual practice is to block access on all ports and then enable access only on
+the ports you with to expose.
+
+.. code-block:: bash
+
+ # Check iptables policy
+ $ sudo iptables -L
+
+ Chain INPUT (policy ACCEPT)
+ target prot opt source destination
+
+ Chain FORWARD (policy ACCEPT)
+ target prot opt source destination
+
+ Chain OUTPUT (policy ACCEPT)
+ target prot opt source destination
+
+ # Close all ports by default
+ $ sudo iptables -P INPUT DROP
+
+ $ sudo iptables -L
+ Chain INPUT (policy DROP)
+ target prot opt source destination
+ DROP all -- anywhere anywhere
+
+ Chain FORWARD (policy ACCEPT)
+ target prot opt source destination
+
+ Chain OUTPUT (policy ACCEPT)
+ target prot opt source destination
+
+.. code-block:: bash
+
+ # Deny outbound SSH traffic
+ sudo iptables -A OUTPUT -p tcp --dport 10022 -j DROP
+
+ # Allow incoming SSH traffic on port 10022
+ sudo iptables -A INPUT -p tcp --dport 10022 -j ACCEPT
+
+ # Allow incoming HTML traffic on port 80 and 443
+ iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
+ iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
+
+Saving your IP Table rules, and restoring them from file.
+
+.. code-block:: bash
+
+ # Save you IP Table Rules
+ iptables-save
+
+ # Save your IP Table Rules to a file
+ sudo sh -c "iptables-save > /etc/iptables.rules"
+
+ # Restore your IP Table rules from file
+ iptables-restore < /etc/iptables.rules
+
+.. _OpenSSL PKI tutorial: https://pki-tutorial.readthedocs.org/en/latest/#
+.. _Cloudflare PKI post: https://blog.cloudflare.com/how-to-build-your-own-public-key-infrastructure/
+.. _IpTables: https://help.ubuntu.com/community/IptablesHowTo
+.. _IPFW: https://www.freebsd.org/doc/handbook/firewalls-ipfw.html
+.. _IPFILTER: https://www.freebsd.org/doc/handbook/firewalls-ipf.html
diff --git a/docs/admin/security-tips.rst b/docs/admin/security-tips.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/security-tips.rst
@@ -0,0 +1,15 @@
+.. _sec-tips:
+
+=============
+Security Tips
+=============
+
+The following section contains security tips for ensuring your |RCE|
+instances are configured in as secure a manner as possible.
+
+.. toctree::
+
+ sec-your-server
+ sec-x-frame
+ sec-instance-basics
+ sec-ip-white
diff --git a/docs/admin/setting-default-permissions.rst b/docs/admin/setting-default-permissions.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/setting-default-permissions.rst
@@ -0,0 +1,69 @@
+.. _permissions-default-ref:
+
+Setting Default Permissions
+---------------------------
+
+Default permissions allow you to configure |RCM| so that when a new |repo|, user group,
+or user is created their permissions are already defined. To set default permissions you need administrator
+privileges. See the following sections for setting up your permissions system:
+
+* :ref:`user-default-ref`
+* :ref:`user-group-default-ref`
+* :ref:`repo-default-ref`
+* :ref:`repo-group-default-ref`
+
+.. _user-default-ref:
+
+Setting User defaults
+^^^^^^^^^^^^^^^^^^^^^
+
+To set default user permissions, use the following steps.
+
+1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`
+2. Select the :guilabel:`Global` tab from the left-hand menu. The permissions
+ set on this screen apply to users and user-groups across the whole instance.
+3. Save your changes
+
+.. _user-group-default-ref:
+
+Setting User Group defaults
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To set default user group permissions, use the following steps.
+
+1. From the |RCM| interface, select :menuselection:`Admin --> User groups`
+2. Select :guilabel:`Permissions`, and configure the default user
+ permissions. All users will get these permissions unless
+ individually set.
+3. Select :guilabel:`Global permissions`, and if you wish to configure
+ non-standard behaviour, uncheck the
+ :guilabel:`inherit from default settings` box and configure the desired
+ permissions
+4. Save your changes
+
+.. _repo-default-ref:
+
+Setting Repository defaults
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To set default |repo| permissions, use the following steps.
+
+1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`
+2. Select the :guilabel:`Object` tab from the left-hand menu and set the
+ |perm| permissions
+3. Save your changes
+
+.. _repo-group-default-ref:
+
+Setting Repository Group defaults
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To set default Repository Group permissions, use the following steps.
+
+1. From the |RCM| interface, select :menuselection:`Admin --> Repository Groups`
+2. Select :guilabel:`Edit` beside the |repo| group you wish to configure
+3. On the left-hand pane select :guilabel:`Permissions`
+4. Set the default permissions for all |repos| created in this group
+5. Save your changes
+
+.. |perm| replace:: :guilabel:`None, Read, Write, or Admin`
diff --git a/docs/admin/setting-repo-perms.rst b/docs/admin/setting-repo-perms.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/setting-repo-perms.rst
@@ -0,0 +1,26 @@
+.. _permissions-info-add-group-ref:
+
+Repository Administration
+=========================
+
+Repository permissions in |RCM| can be managed in a number of different ways.
+This overview should give you an insight into how you could adopt particular
+settings for your needs:
+
+* Global |repo| permissions: This allows you to set the default permissions
+ for each new |repo| created within |RCM|, see :ref:`repo-default-ref`. All
+ |repos| created will inherit these permissions unless explicitly configured.
+* Individual |repo| permissions: To set individual |repo| permissions,
+ see :ref:`set-repo-perms`.
+* Repository Group permissions: This allows you to define the permissions for
+ a group, and all |repos| created within that group will inherit the same
+ permissions.
+
+.. toctree::
+
+ repo-perm-steps
+ repo-extra-fields
+ repo-hooks
+ repo-issue-tracker
+ repo-vcs
+
diff --git a/docs/admin/setting-usergroup-permissions.rst b/docs/admin/setting-usergroup-permissions.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/setting-usergroup-permissions.rst
@@ -0,0 +1,25 @@
+.. _permissions-info-repo-group-access:
+
+Setting User Group Permissions
+------------------------------
+
+To set User Group |repo| permissions, use follow these steps:
+
+1. From the |RCE| interface, select
+ :menuselection:`Admin --> User Group --> Add User Group`
+2. Enter a group name and description, and select :guilabel:`Save`
+3. Select :guilabel:`edit` beside the new User Group. On the following
+ screen you will see a number of tabs. Exploring these
+ you will find the following most used options:
+
+* :guilabel:`Owner`: This allows you to change the User Group owner. As
+ super-admin you will still have access to this, but changing the owner lets
+ you delegate the user group management to another manager.
+* :guilabel:`Members`: This allows you to added or remove users from the
+ group.
+* :guilabel:`User Permissions`: On the permissions tab you can set the
+ permissions for each member. If not individually set, the members will
+ inherit the default user permissions.
+* :guilabel:`Inherit from default settings`: On the Global Permissions tab
+ you can uncheck this option and explicitly configure the permissions for
+ the group.
diff --git a/docs/admin/svn-http.rst b/docs/admin/svn-http.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/svn-http.rst
@@ -0,0 +1,84 @@
+.. _svn-http:
+
+|svn| With Write Over HTTP
+--------------------------
+
+To use |svn| with write access, the currently supported method is over HTTP.
+This requires you to configure your local machine so that it can access your
+|RCE| instance.
+
+Prerequisites
+^^^^^^^^^^^^^
+
+- Enable lab setting on your |RCE| instance, see :ref:`lab-settings`.
+- You need to install the following tools on your local machine: ``Apache`` and
+ ``mod_dav_svn``. Use the following Ubuntu as an example.
+
+.. code-block:: bash
+
+ $ sudo apt-get install apache2 libapache2-mod-svn
+
+Once installed you need to enable ``dav_svn``:
+
+.. code-block:: bash
+
+ $ sudo a2enmod dav_svn
+
+Configuring Apache Setup
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. tip::
+
+ It is recommended to run Apache on a port other than 80, due to possible
+ conflicts with other HTTP servers like nginx. To do this, set the
+ ``Listen`` parameter in the ``/etc/apache2/ports.conf`` file, for example
+ ``Listen 8090``
+
+ It is also recommended to run apache as the same user as |RCE|, otherwise
+ permission issues could occur. To do this edit the ``/etc/apache2/envvars``
+
+ .. code-block:: apache
+
+ export APACHE_RUN_USER=ubuntu
+ export APACHE_RUN_GROUP=ubuntu
+
+1. To configure Apache, create and edit a virtual hosts file, for example
+ :file:`/etc/apache2/sites-available/default.conf`, or create another
+ virtual hosts file and add a location section inside the
+ ```` section.
+
+.. code-block:: apache
+
+
+ DAV svn
+ # Must be explicit path, relative not supported
+ SVNParentPath /PATH/TO/REPOSITORIES
+ SVNListParentPath On
+ Allow from all
+ Order allow,deny
+
+
+.. note::
+
+ Once configured, check that you can see the list of repositories on your
+ |RCE| instance.
+
+2. Go to the :menuselection:`Admin --> Settings --> Labs` page, and
+ enable :guilabel:`Proxy Subversion HTTP requests`, and specify the
+ :guilabel:`Subversion HTTP Server URL`.
+
+Using |svn|
+^^^^^^^^^^^
+
+Once |svn| has been enabled on your instance, you can use it using the
+following examples. For more |svn| information, see the `Subversion Red Book`_
+
+.. code-block:: bash
+
+ # To clone a repository
+ svn clone http://my-svn-server.example.com/my-svn-repo
+
+ # svn commit
+ svn commit
+
+.. _Subversion Red Book: http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.ref.svn
diff --git a/docs/admin/system-admin.rst b/docs/admin/system-admin.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/system-admin.rst
@@ -0,0 +1,29 @@
+.. _rhodecode-admin-ref:
+
+System Administration
+=====================
+
+The following are the most common system administration tasks.
+
+.. only:: latex
+
+ * :ref:`vcs-server`
+ * :ref:`apache-ws-ref`
+ * :ref:`nginx-ws-ref`
+ * :ref:`rhodecode-tuning-ref`
+ * :ref:`indexing-ref`
+ * :ref:`rhodecode-reset-ref`
+
+.. toctree::
+
+ config-files-overview
+ vcs-server
+ apache-config
+ nginx-config
+ backup-restore
+ tuning-rhodecode
+ indexing
+ reset-information
+ enable-debug
+ admin-tricks
+ cleanup-cmds
diff --git a/docs/admin/system-overview.rst b/docs/admin/system-overview.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/system-overview.rst
@@ -0,0 +1,163 @@
+.. _system-overview-ref:
+
+System Overview
+===============
+
+Latest Version
+--------------
+
+* |release| on Unix and Windows systems.
+
+System Architecture
+-------------------
+
+The following diagram shows a typical production architecture.
+
+.. image:: ../images/architecture-diagram.png
+ :align: center
+
+Supported Operating Systems
+---------------------------
+
+Linux
+^^^^^
+
+* Ubuntu 14.04
+* CentOS 6.2 and 7
+* Debian 7.8
+* RedHat Fedora
+* Arch Linux
+* SUSE Linux
+
+Windows
+^^^^^^^
+
+* Windows Vista Ultimate 64bit
+* Windows 7 Ultimate 64bit
+* Windows 8 Professional 64bit
+* Windows 8.1 Enterprise 64bit
+* Windows Server 2008 64bit
+* Windows Server 2008-R2 64bit
+* Windows Server 2012 64bit
+
+Supported Databases
+-------------------
+
+* SQLite
+* MySQL
+* MariaDB
+* PostgreSQL
+
+Supported Browsers
+------------------
+
+* Chrome
+* Safari
+* Firefox
+* Internet Explorer 10 & 11
+
+System Requirements
+-------------------
+
+|RCM| performs best on machines with ultra-fast hard disks. Generally disk
+performance is more important than CPU performance. In a corporate production
+environment handling 1000s of users and |repos| you should deploy on a 12+
+core 64GB RAM server. In short, the more RAM the better.
+
+.. _config-rce-files:
+
+Configuration Files
+-------------------
+
+* :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
+* :file:`/home/{user}/.rccontrol/{instance-id}/mapping.ini`
+* :file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini`
+* :file:`/home/{user}/.rccontrol/supervisor/supervisord.ini`
+* :file:`/home/{user}/.rccontrol.ini`
+* :file:`/home/{user}/.rhoderc`
+* :file:`/home/{user}/.rccontrol/cache/MANIFEST`
+
+For more information, see the :ref:`config-files` section.
+
+Log Files
+---------
+
+* :file:`/home/{user}/.rccontrol/{instance-id}/enterprise.log`
+* :file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.log`
+* :file:`/home/{user}/.rccontrol/supervisor/supervisord.log`
+* :file:`/tmp/rccontrol.log`
+* :file:`/tmp/rhodecode_tools.log`
+
+Storage Files
+-------------
+
+* :file:`/home/{user}/.rccontrol/{instance-id}/data/index/{index-file.toc}`
+* :file:`/home/{user}/repos/.rc_gist_store`
+* :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.db`
+* :file:`/opt/rhodecode/store/{unique-hash}`
+
+Default Repositories Location
+-----------------------------
+
+* :file:`/home/{user}/repos`
+
+Connection Methods
+------------------
+
+* HTTPS
+* SSH
+* |RCM| API
+
+Internationalization Support
+----------------------------
+
+Currently available in the following languages, see `Transifex`_ for the
+latest details. If you want a new language added, please contact us. To
+configure your language settings, see the :ref:`set-lang` section.
+
+.. hlist::
+
+ * Belorussian
+ * Chinese
+ * French
+ * German
+ * Italian
+ * Japanese
+ * Portuguese
+ * Polish
+ * Russian
+ * Spanish
+
+Licencing Information
+---------------------
+
+* See licencing information `here`_
+
+Peer-to-peer Failover Support
+-----------------------------
+
+* Yes
+
+Additional Binaries
+-------------------
+
+* Yes, see :ref:`rhodecode-nix-ref` for full details.
+
+Remote Connectivity
+-------------------
+
+* Available
+
+Executable Files
+----------------
+
+Windows: :file:`RhodeCode-installer-{version}.exe`
+
+Deprecated Support
+------------------
+
+- Internet Explorer 8 support deprecated since version 3.7.0.
+- Internet Explorer 9 support deprecated since version 3.8.0.
+
+.. _here: https://rhodecode.com/licenses/
+.. _Transifex: https://www.transifex.com/projects/p/RhodeCode/
diff --git a/docs/admin/tuning-change-encoding.rst b/docs/admin/tuning-change-encoding.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/tuning-change-encoding.rst
@@ -0,0 +1,22 @@
+.. _change-encoding:
+
+Change Default Encoding
+-----------------------
+
+|RCE| uses ``utf8`` encoding by default. You can change the default encoding
+in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. To
+change the default encoding used by |RCE|, set a new value for the
+``default_encoding``.
+
+.. code-block:: ini
+
+ # default encoding used to convert from and to unicode
+ # can be also a comma separated list of encoding in case of mixed
+ # encodings
+ default_encoding = utf8
+
+.. note::
+
+ Changing the default encoding will affect many parts of your |RCE|
+ installation, including committers names,
+ file names, and the encoding of commit messages.
diff --git a/docs/admin/tuning-change-large-file-dir.rst b/docs/admin/tuning-change-large-file-dir.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/tuning-change-large-file-dir.rst
@@ -0,0 +1,32 @@
+.. _hg-lrg-loc:
+
+Change the |hg| Large Files Location
+------------------------------------
+
+|RCE| manages |hg| larges files from the following default location
+:file:`/home/{user}/repos/.cache/largefiles`. If you wish to change this, use
+the following steps:
+
+1. Open ishell from the terminal and use it to log into the |RCE| database by
+ specifying the instance :file:`rhodecode.ini` file.
+
+.. code-block:: bash
+
+ # Open iShell from the terminal and set ini file
+ $ .rccontrol/enterprise-1/profile/bin/paster ishell .rccontrol/enterprise-1/rhodecode.ini
+
+2. Run the following commands, and ensure that |RCE| has write access to the
+ new directory:
+
+.. code-block:: mysql
+
+ # Once logged into the database, use SQL to redirect
+ # the large files location
+ In [1]: from rhodecode.model.settings import SettingsModel
+ In [2]: SettingsModel().get_ui_by_key('usercache')
+ Out[2]: /mnt/hgfs/shared/workspace/xxxx/.cache/largefiles]>
+
+ In [3]: largefiles_cache = SettingsModel().get_ui_by_key('usercache')
+ In [4]: largefiles_cache.ui_value = '/new/path’
+ In [5]: Session().add(largefiles_cache);Session().commit()
+
diff --git a/docs/admin/tuning-gunicorn.rst b/docs/admin/tuning-gunicorn.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/tuning-gunicorn.rst
@@ -0,0 +1,111 @@
+.. _increase-gunicorn:
+
+Increase Gunicorn Workers
+-------------------------
+
+.. important::
+
+ If you increase the number of :term:`Gunicorn` workers, you also need to
+ increase the threadpool size of the VCS Server. The recommended size is
+ 6 times the number of Gunicorn workers. To set this, see
+ :ref:`vcs-server-config-file`.
+
+|RCE| comes with `Gunicorn`_ packaged in its Nix environment. To improve
+performance you can increase the number of workers. To do this, use the
+following steps:
+
+1. Open the :file:`home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+2. In the ``[server:main]`` section, increase the number of Gunicorn
+ ``workers`` using the following formula :math:`(2 * Cores) + 1`.
+
+.. code-block:: ini
+
+ [server:main]
+ host = 127.0.0.1
+ port = 10002
+ use = egg:gunicorn#main
+ workers = 1
+ threads = 1
+ proc_name = RhodeCodeEnterprise
+ worker_class = sync
+ max_requests = 1000
+ timeout = 3600
+
+3. In the ``[app:main]`` section, set the ``instance_id`` property to ``*``.
+
+.. code-block:: ini
+
+ # In the [app:main] section
+ [app:main]
+ # You must set `instance_id = *`
+ instance_id = *
+
+4. Save your changes.
+5. Restart your |RCE| instance, using the following command:
+
+.. code-block:: bash
+
+ $ rccontrol restart enterprise-1
+
+If you scale across different machines, each |RCM| instance
+needs to store its data on a shared disk, preferably together with your
+|repos|. This data directory contains template caches, a whoosh index,
+and is used for task locking to ensure safety across multiple instances.
+To do this, set the following properties in the :file:`rhodecode.ini` file to
+set the shared location across all |RCM| instances.
+
+.. code-block:: ini
+
+ cache_dir = /file/path # set to shared location
+ search.location = /file/path # set to shared location
+
+ ####################################
+ ### BEAKER CACHE ####
+ ####################################
+ beaker.cache.data_dir = /file/path # set to shared location
+ beaker.cache.lock_dir = /file/path # set to shared location
+
+
+
+Gunicorn SSL support
+--------------------
+
+
+:term:`Gunicorn` wsgi server allows users to use HTTPS connection directly
+without a need to use HTTP server like Nginx or Apache. To Configure
+SSL support directly with :term:`Gunicorn` you need to simply add the key
+and certificate paths to your configuration file.
+
+1. Open the :file:`home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+2. In the ``[server:main]`` section, add two new variables
+ called `certfile` and `keyfile`.
+
+.. code-block:: ini
+
+ [server:main]
+ host = 127.0.0.1
+ port = 10002
+ use = egg:gunicorn#main
+ workers = 1
+ threads = 1
+ proc_name = RhodeCodeEnterprise
+ worker_class = sync
+ max_requests = 1000
+ timeout = 3600
+ # adding ssl support
+ certfile = /home/ssl/my_server_com.pem
+ keyfile = /home/ssl/my_server_com.key
+
+4. Save your changes.
+5. Restart your |RCE| instance, using the following command:
+
+.. code-block:: bash
+
+ $ rccontrol restart enterprise-1
+
+After this is enabled you can *only* access your instances via https://
+protocol. Check out more docs here `Gunicorn SSL Docs`_
+
+
+.. _Gunicorn: http://gunicorn.org/
+.. _Gunicorn SSL Docs: http://docs.gunicorn.org/en/stable/settings.html#ssl
diff --git a/docs/admin/tuning-hg-auth-loop.rst b/docs/admin/tuning-hg-auth-loop.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/tuning-hg-auth-loop.rst
@@ -0,0 +1,17 @@
+.. _hg-auth-loop:
+
+|hg| Authentication Tuning
+--------------------------
+
+When using external authentication tools such as LDAP with |hg|, a
+password retry loop in |hg| can result in users being locked out due to too
+many failed password attempts. To prevent this from happening, add the
+following setting to your
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file, in the
+``[app:main]`` section.
+
+
+.. code-block:: ini
+
+ [app:main]
+ auth_ret_code_detection = true
diff --git a/docs/admin/tuning-increase-cache-size.rst b/docs/admin/tuning-increase-cache-size.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/tuning-increase-cache-size.rst
@@ -0,0 +1,17 @@
+.. _cache-size:
+
+Increase Cache Size
+-------------------
+
+When managing hundreds of |repos| from the main |RCE| interface the system
+can become slow when the cache expires. Increasing the cache expiration
+option improves the response times of the main user interface.
+To increase your cache size, change the following default value in the
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. The value
+is specified in seconds.
+
+.. code-block:: ini
+
+ beaker.cache.long_term.expire=3600 # day (86400) week (604800)
+
+.. note:: The |RCE| cache automatically expires for changed |repos|.
diff --git a/docs/admin/tuning-increase-db-performance.rst b/docs/admin/tuning-increase-db-performance.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/tuning-increase-db-performance.rst
@@ -0,0 +1,23 @@
+.. _db-session-ref:
+
+Increase Database Performance
+-----------------------------
+
+To increase database performance switch to database-based user sessions.
+File-based sessions are only suitable for smaller setups. The most common
+issue being file limit errors which occur if there are lots of session files.
+Therefore, in a large scale deployment, to give better performance,
+scalability, and maintainability we recommend switching from file-based
+sessions to database-based user sessions.
+
+To switch to database-based user sessions uncomment the following section in
+your :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+
+.. code-block:: ini
+
+ # db session
+ beaker.session.type = ext:database
+
+ # adjust this property to include your database credentials
+ beaker.session.sa.url = postgresql://postgres:@localhost/rhodecode
+ beaker.session.table_name = db_session
diff --git a/docs/admin/tuning-mount-cache-memory.rst b/docs/admin/tuning-mount-cache-memory.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/tuning-mount-cache-memory.rst
@@ -0,0 +1,42 @@
+.. _data-mem:
+
+Mount Cache Folders To Memory
+-----------------------------
+
+To increase the performance of folders containing cache data, you can mount
+them to memory. The following folders specified in the :file:`rhodecode.ini`
+file would benefit from this.
+
+.. code-block:: ini
+
+ cache_dir = %(here)s/data
+ search.location = %(here)s/data/index
+
+Use the following Ubuntu example to mount these to memory, or see your
+particular |os| instructions. The expected performance benefit is
+approximately 5%. You should ensure you allocate an adequate amount of memory
+depending on your available resources.
+
+.. code-block:: bash
+
+ # mount to memory with 2GB limit and 755 write permissions
+ mount -t tmpfs -o size=2G,mode=0755 tmpfs /home/user/.rccontrol/enterprise-1/data
+ mount -t tmpfs -o size=2G,mode=0755 tmpfs /home/user/.rccontrol/enterprise-1/data/index
+
+.. _move-tmp:
+
+Move ``tmp`` to TMPFS
+---------------------
+
+|RCE| components heavily use the :file:`/tmp` folder, so moving your
+:file:`/tmp` folder into to a RAM-based TMPS can lead to a noticeable
+performance boost.
+
+.. code-block:: bash
+
+ # mount tmp to memory with 2GB limit and 755 write permissions
+ mount -t tmpfs -o size=2G,mode=0755 tmpfs /tmp
+
+For more information about TMPFS, see the documentation `here`_.
+
+.. _here: https://wiki.archlinux.org/index.php/Tmpfs
diff --git a/docs/admin/tuning-rhodecode.rst b/docs/admin/tuning-rhodecode.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/tuning-rhodecode.rst
@@ -0,0 +1,20 @@
+.. _rhodecode-tuning-ref:
+
+Tuning |RCE|
+============
+
+To customize your |RCE| |version| installation for maximum performance you
+may find some of the following methods useful.
+
+.. toctree::
+
+ tuning-gunicorn
+ tuning-vcs-memory-cache
+ tuning-increase-db-performance
+ tuning-scale-horizontally
+ tuning-increase-cache-size
+ tuning-mount-cache-memory
+ tuning-change-encoding
+ tuning-change-large-file-dir
+ tuning-hg-auth-loop
+
diff --git a/docs/admin/tuning-scale-horizontally.rst b/docs/admin/tuning-scale-horizontally.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/tuning-scale-horizontally.rst
@@ -0,0 +1,51 @@
+.. _scale-horizontal:
+
+Scale Horizontally
+------------------
+
+Horizontal scaling means adding more machines or workers into your pool of
+resources. Horizontally scaling |RCE| gives a huge performance increase,
+especially under large traffic scenarios with a high number of requests. This
+is very beneficial when |RCE| is serving many users simultaneously,
+or if continuous integration servers are automatically pulling and pushing code.
+
+To horizontally scale |RCE| you should use the following steps:
+
+1. In the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file,
+ set ``instance_id = *``. This enables |RCE| to use multiple nodes.
+2. Define the number of worker threads using the formula
+ :math:`(2 * Cores) + 1`. For example 4 CPU cores would lead to
+ :math:`(2 * 4) + 1 = 9` workers. In some cases it's ok to increase number of
+ workers even beyond this formula. Generally the more workers, the more
+ simultaneous connections the system can handle.
+
+It is recommended to create another dedicated |RCE| instance to handle
+traffic from build farms or continuous integration servers.
+
+.. note::
+
+ You should configure your load balancing accordingly. We recommend writing
+ load balancing rules that will separate regular user traffic from
+ automated process traffic like continuous servers or build bots.
+
+If you scale across different machines, each |RCE| instance needs to store
+its data on a shared disk, preferably together with your repositories. This
+data directory contains template caches, a whoosh index,
+and is used for task locking to ensure safety across multiple instances. To
+do this, set the following properties in the
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file to set
+the shared location across all |RCE| instances.
+
+.. code-block:: ini
+
+ cache_dir = /file/path # set to shared directory location
+ search.location = /file/path # set to shared directory location
+ beaker.cache.data_dir = /file/path # set to shared directory location
+ beaker.cache.lock_dir = /file/path # set to shared directory location
+
+.. note::
+
+ If Celery is used on each instance then you should run separate Celery
+ instances, but the message broker should be the same for all of them.
+ This excludes one RabbitMQ shared server.
+
diff --git a/docs/admin/tuning-vcs-memory-cache.rst b/docs/admin/tuning-vcs-memory-cache.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/tuning-vcs-memory-cache.rst
@@ -0,0 +1,8 @@
+.. _adjust-vcs-mem-cache:
+
+Adjusting VCS Memory Cache
+--------------------------
+
+The VCS Server mamory cache can be adjusted to work best with the resources
+available to your |RCE| instance. If you find that memory resources are under
+pressure, see the :ref:`vcs-server-maintain` section for details.
diff --git a/docs/admin/user-admin.rst b/docs/admin/user-admin.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/user-admin.rst
@@ -0,0 +1,23 @@
+.. _user-admin-set:
+
+User Administration
+===================
+
+|RCM| enables you to define permissions for the following entities within the
+system; **users**, **user groups**, **repositories**, **repository groups**.
+
+Within each one of these entities you can set default settings,
+and then all users or |repos| inherit those default permission settings
+unless individually defined. Each of these entities can have the following
+permissions applied to it; |perm|.
+
+.. toctree::
+
+ public-access
+ default-user-perms
+ adding-anonymous-user
+ adding-new-user
+ setting-default-permissions
+ setting-usergroup-permissions
+
+.. |perm| replace:: **None**, **Read**, **Write**, or **Admin**
\ No newline at end of file
diff --git a/docs/admin/vcs-server.rst b/docs/admin/vcs-server.rst
new file mode 100644
--- /dev/null
+++ b/docs/admin/vcs-server.rst
@@ -0,0 +1,301 @@
+.. _vcs-server:
+
+VCS Server Management
+---------------------
+
+The VCS Server handles |RCM| backend functionality. You need to configure
+a VCS Server to run with a |RCM| instance. If you do not, you will be missing
+the connection between |RCM| and its |repos|. This will cause error messages
+on the web interface. You can run your setup in the following configurations,
+currently the best performance is one VCS Server per |RCM| instance:
+
+* One VCS Server per |RCM| instance.
+* One VCS Server handling multiple instances.
+
+.. important::
+
+ If your server locale settings are not correctly configured,
+ |RCE| and the VCS Server can run into issues. See this `Ask Ubuntu`_ post
+ which explains the problem and gives a solution.
+
+For more information, see the following sections:
+
+* :ref:`install-vcs`
+* :ref:`config-vcs`
+* :ref:`vcs-server-options`
+* :ref:`vcs-server-versions`
+* :ref:`vcs-server-maintain`
+* :ref:`vcs-server-config-file`
+
+.. _install-vcs:
+
+VCS Server Installation
+^^^^^^^^^^^^^^^^^^^^^^^
+
+To install a VCS Server, see
+:ref:`Installing a VCS server `.
+
+.. _config-vcs:
+
+Hooking |RCE| to its VCS Server
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To configure a |RCE| instance to use a VCS server, see
+:ref:`Configuring the VCS Server connection `.
+
+.. _vcs-server-options:
+
+|RCE| VCS Server Options
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+The following list shows the available options on the |RCM| side of the
+connection to the VCS Server. The settings are configured per
+instance in the
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+
+.. rst-class:: dl-horizontal
+
+ \vcs.backends
+ Set a comma-separated list of the |repo| options available from the
+ web interface. The default is ``hg, git, svn``,
+ which is all |repo| types available.
+
+ \vcs.connection_timeout
+ Set the length of time in seconds that the VCS Server waits for
+ requests to process. After the timeout expires,
+ the request is closed. The default is ``3600``. Set to a higher
+ number if you experience network latency, or timeout issues with very
+ large push/pull requests.
+
+ \vcs.server.enable
+ Enable or disable the VCS Server. The available options are ``true`` or
+ ``false``. The default is ``true``.
+
+ \vcs.server
+ Set the host, either hostname or IP Address, and port of the VCS server
+ you wish to run with your |RCM| instance.
+
+.. code-block:: ini
+
+ ##################
+ ### VCS CONFIG ###
+ ##################
+ # set this line to match your VCS Server
+ vcs.server = 127.0.0.1:10004
+ # Set to False to disable the VCS Server
+ vcs.server.enable = True
+ vcs.backends = hg, git, svn
+ vcs.connection_timeout = 3600
+
+
+.. _vcs-server-versions:
+
+VCS Server Versions
+^^^^^^^^^^^^^^^^^^^
+
+An updated version of the VCS Server is released with each |RCE| version. Use
+the VCS Server number that matches with the |RCE| version to pair the
+appropriate ones together. For |RCE| versions pre 3.3.0,
+VCS Server 1.X.Y works with |RCE| 3.X.Y, for example:
+
+* VCS Server 1.0.0 works with |RCE| 3.0.0
+* VCS Server 1.2.2 works with |RCE| 3.2.2
+
+For |RCE| versions post 3.3.0, the VCS Server and |RCE| version numbers
+match, for example:
+
+* VCS Server |release| works with |RCE| |release|
+
+.. _vcs-server-maintain:
+
+VCS Server Memory Optimization
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To configure the VCS server to manage the cache efficiently, you need to
+configure the following options in the
+:file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini` file. Once
+configured, restart the VCS Server.
+
+.. rst-class:: dl-horizontal
+
+ \beaker.cache.repo_object.type = memorylru
+ Configures the cache to discard the least recently used items.
+ This setting takes the following valid options:
+
+ * ``memorylru``: The default setting, which removes the least recently
+ used items from the cache.
+ * ``memory``: Runs the VCS Server without clearing the cache.
+ * ``nocache``: Runs the VCS Server without a cache. This will
+ dramatically reduce the VCS Server performance.
+
+ \beaker.cache.repo_object.max_items = 100
+ Sets the maximum number of items stored in the cache, before the cache
+ starts to be cleared.
+
+ As a general rule of thumb, running this value at 120 resulted in a
+ 5GB cache. Running it at 240 resulted in a 9GB cache. Your results
+ will differ based on usage patterns and |repo| sizes.
+
+ Tweaking this value to run at a fairly constant memory load on your
+ server will help performance.
+
+To clear the cache completely, you can restart the VCS Server.
+
+.. important::
+
+ While the VCS Server handles a restart gracefully on the web interface,
+ it will drop connections during push/pull requests. So it is recommended
+ you only perform this when there is very little traffic on the instance.
+
+Use the following example to restart your VCS Server,
+for full details see the :ref:`RhodeCode Control CLI `.
+
+.. code-block:: bash
+
+ $ rccontrol status
+
+.. code-block:: vim
+
+ - NAME: vcsserver-1
+ - STATUS: RUNNING
+ - TYPE: VCSServer
+ - VERSION: 1.0.0
+ - URL: http://127.0.0.1:10001
+
+ $ rccontrol restart vcsserver-1
+ Instance "vcsserver-1" successfully stopped.
+ Instance "vcsserver-1" successfully started.
+
+.. _vcs-server-config-file:
+
+VCS Server Configuration
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+You can configure settings for multiple VCS Servers on your
+system using their individual configuration files. Use the following
+properties inside the configuration file to set up your system. The default
+location is :file:`home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini`.
+For a more detailed explanation of the logger levers, see :ref:`debug-mode`.
+
+.. rst-class:: dl-horizontal
+
+ \host
+ Set the host on which the VCS Server will run.
+
+ \port
+ Set the port number on which the VCS Server will be available.
+
+ \locale
+ Set the locale the VCS Server expects.
+
+ \threadpool_size
+ Set the size of the threadpool used to communicate
+ with the WSGI workers. This should be at least 6 times the number of
+ WSGI worker processes.
+
+ \timeout
+ Set the timeout for RPC communication in seconds.
+
+.. note::
+
+ After making changes, you need to restart your VCS Server to pick them up.
+
+.. code-block:: ini
+
+ ################################################################################
+ # RhodeCode VCSServer - configuration #
+ # #
+ ################################################################################
+
+ [DEFAULT]
+ host = 127.0.0.1
+ port = 9900
+ locale = en_US.UTF-8
+ # number of worker threads, this should be set based on a formula threadpool=N*6
+ # where N is number of RhodeCode Enterprise workers, eg. running 2 instances
+ # 8 gunicorn workers each would be 2 * 8 * 6 = 96, threadpool_size = 96
+ threadpool_size = 16
+ timeout = 0
+
+ # cache regions, please don't change
+ beaker.cache.regions = repo_object
+ beaker.cache.repo_object.type = memorylru
+ beaker.cache.repo_object.max_items = 1000
+
+ # cache auto-expires after N seconds
+ beaker.cache.repo_object.expire = 10
+ beaker.cache.repo_object.enabled = true
+
+
+ ################################
+ ### LOGGING CONFIGURATION ####
+ ################################
+ [loggers]
+ keys = root, vcsserver, pyro4, beaker
+
+ [handlers]
+ keys = console
+
+ [formatters]
+ keys = generic
+
+ #############
+ ## LOGGERS ##
+ #############
+ [logger_root]
+ level = NOTSET
+ handlers = console
+
+ [logger_vcsserver]
+ level = DEBUG
+ handlers =
+ qualname = vcsserver
+ propagate = 1
+
+ [logger_beaker]
+ level = DEBUG
+ handlers =
+ qualname = beaker
+ propagate = 1
+
+ [logger_pyro4]
+ level = DEBUG
+ handlers =
+ qualname = Pyro4
+ propagate = 1
+
+
+ ##############
+ ## HANDLERS ##
+ ##############
+
+ [handler_console]
+ class = StreamHandler
+ args = (sys.stderr,)
+ level = DEBUG
+ formatter = generic
+
+ [handler_file]
+ class = FileHandler
+ args = ('vcsserver.log', 'a',)
+ level = DEBUG
+ formatter = generic
+
+ [handler_file_rotating]
+ class = logging.handlers.TimedRotatingFileHandler
+ # 'D', 5 - rotate every 5days
+ # you can set 'h', 'midnight'
+ args = ('vcsserver.log', 'D', 5, 10,)
+ level = DEBUG
+ formatter = generic
+
+ ################
+ ## FORMATTERS ##
+ ################
+
+ [formatter_generic]
+ format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+ datefmt = %Y-%m-%d %H:%M:%S
+
+
+.. _Ask Ubuntu: http://askubuntu.com/questions/162391/how-do-i-fix-my-locale-issue
diff --git a/docs/api/api.rst b/docs/api/api.rst
new file mode 100644
--- /dev/null
+++ b/docs/api/api.rst
@@ -0,0 +1,2824 @@
+.. _api:
+
+API Documentation
+=================
+
+The |RCE| API uses a single scheme for calling all API methods. The API is
+implemented with JSON protocol in both directions. To send API requests to
+your instance of |RCE|, use the following URL format
+``/_admin``
+
+.. note::
+
+ To use the API, you should configure the :file:`~/.rhoderc` file with
+ access details per instance. For more information, see
+ :ref:`config-rhoderc`.
+
+
+API ACCESS FOR WEB VIEWS
+------------------------
+
+API access can also be turned on for each web view in |RCE| that is
+decorated with a `@LoginRequired` decorator. To enable API access, change
+the standard login decorator to `@LoginRequired(api_access=True)`.
+
+From |RCM| version 1.7.0 you can configure a white list
+of views that have API access enabled by default. To enable these,
+edit the |RCM| configuration ``.ini`` file. The default location is:
+
+* |RCM| Pre-2.2.7 :file:`root/rhodecode/data/production.ini`
+* |RCM| 3.0 :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
+
+To configure the white list, edit this section of the file. In this
+configuration example, API access is granted to the patch/diff raw file and
+archive.
+
+.. code-block:: ini
+
+ ## List of controllers (using glob syntax) that AUTH TOKENS could be used for access.
+ ## Adding ?auth_token = to the url authenticates this request as if it
+ ## came from the the logged in user who own this authentication token.
+ ##
+ ## Syntax is :.
+ ## The list should be "," separated and on a single line.
+ ##
+ api_access_controllers_whitelist = ChangesetController:changeset_patch,ChangesetController:changeset_raw,ilesController:raw,FilesController:archivefile,
+
+After this change, a |RCE| view can be accessed without login by adding a
+GET parameter ``?auth_token=`` to a url. For example to
+access the raw diff.
+
+.. code-block:: html
+
+ http:////changeset-diff/?auth_token=
+
+By default this is only enabled on RSS/ATOM feed views. Exposing raw diffs is a
+good way to integrate with 3rd party services like code review, or build farms
+that could download archives.
+
+API ACCESS
+----------
+
+All clients are required to send JSON-RPC spec JSON data.
+
+.. code-block:: bash
+
+ {
+ "id:"",
+ "auth_token":"",
+ "method":"",
+ "args":{"":""}
+ }
+
+Example call for auto pulling from remote repositories using curl:
+
+.. code-block:: bash
+
+ curl https://server.com/_admin/api -X POST -H 'content-type:text/plain' --data-binary '{"id":1,
+ "auth_token":"xe7cdb2v278e4evbdf5vs04v832v0efvcbcve4a3","method":"pull", "args":{"repo":"CPython"}}'
+
+Provide those parameters:
+ - **id** A value of any type, which is used to match the response with the
+ request that it is replying to.
+ - **auth_token** for access and permission validation.
+ - **method** is name of method to call
+ - **args** is an ``key:value`` list of arguments to pass to method
+
+.. note::
+
+ To get your |authtoken|, from the |RCE| interface,
+ go to:
+ :menuselection:`username --> My account --> Auth tokens`
+
+ For security reasons you should always create a dedicated |authtoken| for
+ API use only.
+
+
+The |RCE| API will always return a JSON-RPC response:
+
+.. code-block:: bash
+
+ {
+ "id": , # matching id sent by request
+ "result": ""|null, # JSON formatted result, null if any errors
+ "error": "null"| # JSON formatted error (if any)
+ }
+
+All responses from API will be with `HTTP/1.0 200 OK` status code.
+If there is an error when calling the API, the *error* key will contain a
+failure description and the *result* will be `null`.
+
+API CLIENT
+----------
+
+To install the |RCE| API, see :ref:`install-tools`. To configure the API per
+instance, see the :ref:`rc-tools` section as you need to configure a
+:file:`~/.rhoderc` file with your |authtokens|.
+
+Once you have set up your instance API access, use the following examples to
+get started.
+
+.. code-block:: bash
+
+ # Getting the 'rhodecode' repository
+ # from a RhodeCode Enterprise instance
+ rhodecode-api --instance-name=enterprise-1 get_repo repoid:rhodecode
+
+ Calling method get_repo => http://127.0.0.1:5000
+ Server response
+ {
+
+ }
+
+ # Creating a new mercurial repository called 'brand-new'
+ # with a description 'Repo-description'
+ rhodecode-api --instance-name=enterprise-1 create_repo repo_name:brand-new repo_type:hg description:Repo-description
+ {
+ "error": null,
+ "id": 1110,
+ "result": {
+ "msg": "Created new repository `brand-new`",
+ "success": true,
+ "task": null
+ }
+ }
+
+A broken example, what not to do.
+
+.. code-block:: bash
+
+ # A call missing the required arguments
+ # and not specifying the instance
+ rhodecode-api get_repo
+
+ Calling method get_repo => http://127.0.0.1:5000
+ Server response
+ "Missing non optional `repoid` arg in JSON DATA"
+
+You can specify pure JSON using the ``--format`` parameter.
+
+.. code-block:: bash
+
+ rhodecode-api --format=json get_repo repoid:rhodecode
+
+In such case only output that this function shows is pure JSON, we can use that
+and pipe output to some json formatter.
+
+If output is in pure JSON format, you can pipe output to a JSON formatter.
+
+.. code-block:: bash
+
+ rhodecode-api --instance-name=enterprise-1 --format=json get_repo repoid:rhodecode | python -m json.tool
+
+API METHODS
+-----------
+
+Each method by default required following arguments.
+
+.. code-block:: bash
+
+ id : ""
+ auth_token : ""
+ method : ""
+ args : {}
+
+Use each **param** from docs and put it in args, Optional parameters
+are not required in args.
+
+.. code-block:: bash
+
+ args: {"repoid": "rhodecode"}
+
+.. Note: From this point on things are generated by the script in
+ `scripts/fabfile.py`. To change things below, update the docstrings in the
+ ApiController.
+
+.. --- API DEFS MARKER ---
+
+pull
+----
+
+.. py:function:: pull(apiuser, repoid)
+
+ Triggers a pull on the given repository from a remote location. You
+ can use this to keep remote repositories up-to-date.
+
+ This command can only be run using an |authtoken| with admin
+ rights to the specified repository. For more information,
+ see :ref:`config-token-ref`.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param repoid: The repository name or repository ID.
+ :type repoid: str or int
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "msg": "Pulled from ``"
+ "repository": ""
+ }
+ error : null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ "Unable to pull changes from ``"
+ }
+
+
+strip
+-----
+
+.. py:function:: strip(apiuser, repoid, revision, branch)
+
+ Strips the given revision from the specified repository.
+
+ * This will remove the revision and all of its decendants.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param repoid: The repository name or repository ID.
+ :type repoid: str or int
+ :param revision: The revision you wish to strip.
+ :type revision: str
+ :param branch: The branch from which to strip the revision.
+ :type branch: str
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "msg": "'Stripped commit from repo ``'"
+ "repository": ""
+ }
+ error : null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ "Unable to strip commit from repo ``"
+ }
+
+
+rescan_repos
+------------
+
+.. py:function:: rescan_repos(apiuser, remove_obsolete=)
+
+ Triggers a rescan of the specified repositories.
+
+ * If the ``remove_obsolete`` option is set, it also deletes repositories
+ that are found in the database but not on the file system, so called
+ "clean zombies".
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param remove_obsolete: Deletes repositories from the database that
+ are not found on the filesystem.
+ :type remove_obsolete: Optional(``True`` | ``False``)
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ 'added': [,...]
+ 'removed': [,...]
+ }
+ error : null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ 'Error occurred during rescan repositories action'
+ }
+
+
+invalidate_cache
+----------------
+
+.. py:function:: invalidate_cache(apiuser, repoid, delete_keys=)
+
+ Invalidates the cache for the specified repository.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from |authtoken|.
+ :type apiuser: AuthUser
+ :param repoid: Sets the repository name or repository ID.
+ :type repoid: str or int
+ :param delete_keys: This deletes the invalidated keys instead of
+ just flagging them.
+ :type delete_keys: Optional(``True`` | ``False``)
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ 'msg': Cache for repository `` was invalidated,
+ 'repository':
+ }
+ error : null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ 'Error occurred during cache invalidation action'
+ }
+
+
+lock
+----
+
+.. py:function:: lock(apiuser, repoid, locked=, userid=>)
+
+ Sets the lock state of the specified |repo| by the given user.
+ From more information, see :ref:`repo-locking`.
+
+ * If the ``userid`` option is not set, the repository is locked to the
+ user who called the method.
+ * If the ``locked`` parameter is not set, the current lock state of the
+ repository is displayed.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param repoid: Sets the repository name or repository ID.
+ :type repoid: str or int
+ :param locked: Sets the lock state.
+ :type locked: Optional(``True`` | ``False``)
+ :param userid: Set the repository lock to this user.
+ :type userid: Optional(str or int)
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ 'repo': '',
+ 'locked': ,
+ 'locked_since': ,
+ 'locked_by': ,
+ 'lock_reason': ,
+ 'lock_state_changed': ,
+ 'msg': 'Repo `` locked by `` on .'
+ or
+ 'msg': 'Repo `` not locked.'
+ or
+ 'msg': 'User `` set lock state for repo `` to ``'
+ }
+ error : null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ 'Error occurred locking repository ``
+ }
+
+
+get_locks
+---------
+
+.. py:function:: get_locks(apiuser, userid=>)
+
+ Displays all repositories locked by the specified user.
+
+ * If this command is run by a non-admin user, it returns
+ a list of |repos| locked by that user.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param userid: Sets the userid whose list of locked |repos| will be
+ displayed.
+ :type userid: Optional(str or int)
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ [repo_object, repo_object,...]
+ }
+ error : null
+
+
+get_ip
+------
+
+.. py:function:: get_ip(apiuser, userid=>)
+
+ Displays the IP Address as seen from the |RCE| server.
+
+ * This command displays the IP Address, as well as all the defined IP
+ addresses for the specified user. If the ``userid`` is not set, the
+ data returned is for the user calling the method.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from |authtoken|.
+ :type apiuser: AuthUser
+ :param userid: Sets the userid for which associated IP Address data
+ is returned.
+ :type userid: Optional(str or int)
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "server_ip_addr": "",
+ "user_ips": [
+ {
+ "ip_addr": "",
+ "ip_range": ["", ""],
+ },
+ ...
+ ]
+ }
+
+
+show_ip
+-------
+
+.. py:function:: show_ip(apiuser, userid=>)
+
+ Displays the IP Address as seen from the |RCE| server.
+
+ * This command displays the IP Address, as well as all the defined IP
+ addresses for the specified user. If the ``userid`` is not set, the
+ data returned is for the user calling the method.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from |authtoken|.
+ :type apiuser: AuthUser
+ :param userid: Sets the userid for which associated IP Address data
+ is returned.
+ :type userid: Optional(str or int)
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "server_ip_addr": "",
+ "user_ips": [
+ {
+ "ip_addr": "",
+ "ip_range": ["", ""],
+ },
+ ...
+ ]
+ }
+
+
+get_license_info
+----------------
+
+.. py:function:: get_license_info(apiuser)
+
+ Returns the |RCE| license information.
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ 'rhodecode_version': ,
+ 'token': ,
+ 'issued_to': ,
+ 'issued_on': ,
+ 'expires_on': ,
+ 'type': ,
+ 'users_limit': ,
+ 'key':
+ }
+ error : null
+
+
+set_license_key
+---------------
+
+.. py:function:: set_license_key(apiuser, key)
+
+ Sets the |RCE| license key.
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param key: This is the license key to be set.
+ :type key: str
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result: {
+ "msg" : "updated license information",
+ "key":
+ }
+ error: null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ "license key is not valid"
+ or
+ "trial licenses cannot be uploaded"
+ or
+ "error occurred while updating license"
+ }
+
+
+get_server_info
+---------------
+
+.. py:function:: get_server_info(apiuser)
+
+ Returns the |RCE| server information.
+
+ This includes the running version of |RCE| and all installed
+ packages. This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ 'modules': [,...]
+ 'py_version': ,
+ 'platform': ,
+ 'rhodecode_version':
+ }
+ error : null
+
+
+get_user
+--------
+
+.. py:function:: get_user(apiuser, userid=>)
+
+ Returns the information associated with a username or userid.
+
+ * If the ``userid`` is not set, this command returns the information
+ for the ``userid`` calling the method.
+
+ .. note::
+
+ Normal users may only run this command against their ``userid``. For
+ full privileges you must run this command using an |authtoken| with
+ admin rights.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param userid: Sets the userid for which data will be returned.
+ :type userid: Optional(str or int)
+
+ Example output:
+
+ .. code-block:: bash
+
+ {
+ "error": null,
+ "id": ,
+ "result": {
+ "active": true,
+ "admin": false,
+ "api_key": "api-key",
+ "api_keys": [ list of keys ],
+ "email": "user@example.com",
+ "emails": [
+ "user@example.com"
+ ],
+ "extern_name": "rhodecode",
+ "extern_type": "rhodecode",
+ "firstname": "username",
+ "ip_addresses": [],
+ "language": null,
+ "last_login": "Timestamp",
+ "lastname": "surnae",
+ "permissions": {
+ "global": [
+ "hg.inherit_default_perms.true",
+ "usergroup.read",
+ "hg.repogroup.create.false",
+ "hg.create.none",
+ "hg.extern_activate.manual",
+ "hg.create.write_on_repogroup.false",
+ "hg.usergroup.create.false",
+ "group.none",
+ "repository.none",
+ "hg.register.none",
+ "hg.fork.repository"
+ ],
+ "repositories": { "username/example": "repository.write"},
+ "repositories_groups": { "user-group/repo": "group.none" },
+ "user_groups": { "user_group_name": "usergroup.read" }
+ },
+ "user_id": 32,
+ "username": "username"
+ }
+ }
+
+
+get_users
+---------
+
+.. py:function:: get_users(apiuser)
+
+ Lists all users in the |RCE| user database.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result: [, ...]
+ error: null
+
+
+create_user
+-----------
+
+.. py:function:: create_user(apiuser, username, email, password=, firstname=, lastname=, active=, admin=, extern_name=, extern_type=, force_password_change=)
+
+ Creates a new user and returns the new user object.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param username: Set the new username.
+ :type username: str or int
+ :param email: Set the user email address.
+ :type email: str
+ :param password: Set the new user password.
+ :type password: Optional(str)
+ :param firstname: Set the new user firstname.
+ :type firstname: Optional(str)
+ :param lastname: Set the new user surname.
+ :type lastname: Optional(str)
+ :param active: Set the user as active.
+ :type active: Optional(``True`` | ``False``)
+ :param admin: Give the new user admin rights.
+ :type admin: Optional(``True`` | ``False``)
+ :param extern_name: Set the authentication plugin name.
+ Using LDAP this is filled with LDAP UID.
+ :type extern_name: Optional(str)
+ :param extern_type: Set the new user authentication plugin.
+ :type extern_type: Optional(str)
+ :param force_password_change: Force the new user to change password
+ on next login.
+ :type force_password_change: Optional(``True`` | ``False``)
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result: {
+ "msg" : "created new user ``",
+ "user":
+ }
+ error: null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ "user `` already exist"
+ or
+ "email `` already exist"
+ or
+ "failed to create user ``"
+ }
+
+
+update_user
+-----------
+
+.. py:function:: update_user(apiuser, userid, username=, email=, password=, firstname=, lastname=, active=, admin=, extern_type=, extern_name=)
+
+ Updates the details for the specified user, if that user exists.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from |authtoken|.
+ :type apiuser: AuthUser
+ :param userid: Set the ``userid`` to update.
+ :type userid: str or int
+ :param username: Set the new username.
+ :type username: str or int
+ :param email: Set the new email.
+ :type email: str
+ :param password: Set the new password.
+ :type password: Optional(str)
+ :param firstname: Set the new first name.
+ :type firstname: Optional(str)
+ :param lastname: Set the new surname.
+ :type lastname: Optional(str)
+ :param active: Set the new user as active.
+ :type active: Optional(``True`` | ``False``)
+ :param admin: Give the user admin rights.
+ :type admin: Optional(``True`` | ``False``)
+ :param extern_name: Set the authentication plugin user name.
+ Using LDAP this is filled with LDAP UID.
+ :type extern_name: Optional(str)
+ :param extern_type: Set the authentication plugin type.
+ :type extern_type: Optional(str)
+
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result: {
+ "msg" : "updated user ID: ",
+ "user": ,
+ }
+ error: null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ "failed to update user ``"
+ }
+
+
+delete_user
+-----------
+
+.. py:function:: delete_user(apiuser, userid)
+
+ Deletes the specified user from the |RCE| user database.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ .. important::
+
+ Ensure all open pull requests and open code review
+ requests to this user are close.
+
+ Also ensure all repositories, or repository groups owned by this
+ user are reassigned before deletion.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param userid: Set the user to delete.
+ :type userid: str or int
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result: {
+ "msg" : "deleted user ID: ",
+ "user": null
+ }
+ error: null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ "failed to delete user ID: "
+ }
+
+
+get_user_group
+--------------
+
+.. py:function:: get_user_group(apiuser, usergroupid)
+
+ Returns the data of an existing user group.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param usergroupid: Set the user group from which to return data.
+ :type usergroupid: str or int
+
+ Example error output:
+
+ .. code-block:: bash
+
+ {
+ "error": null,
+ "id": ,
+ "result": {
+ "active": true,
+ "group_description": "group description",
+ "group_name": "group name",
+ "members": [
+ {
+ "name": "owner-name",
+ "origin": "owner",
+ "permission": "usergroup.admin",
+ "type": "user"
+ },
+ {
+ {
+ "name": "user name",
+ "origin": "permission",
+ "permission": "usergroup.admin",
+ "type": "user"
+ },
+ {
+ "name": "user group name",
+ "origin": "permission",
+ "permission": "usergroup.write",
+ "type": "user_group"
+ }
+ ],
+ "owner": "owner name",
+ "users": [],
+ "users_group_id": 2
+ }
+ }
+
+
+get_user_groups
+---------------
+
+.. py:function:: get_user_groups(apiuser)
+
+ Lists all the existing user groups within RhodeCode.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : [,...]
+ error : null
+
+
+create_user_group
+-----------------
+
+.. py:function:: create_user_group(apiuser, group_name, description=, owner=>, active=)
+
+ Creates a new user group.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param group_name: Set the name of the new user group.
+ :type group_name: str
+ :param description: Give a description of the new user group.
+ :type description: str
+ :param owner: Set the owner of the new user group.
+ If not set, the owner is the |authtoken| user.
+ :type owner: Optional(str or int)
+ :param active: Set this group as active.
+ :type active: Optional(``True`` | ``False``)
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result: {
+ "msg": "created new user group ``",
+ "user_group":
+ }
+ error: null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ "user group `` already exist"
+ or
+ "failed to create group ``"
+ }
+
+
+update_user_group
+-----------------
+
+.. py:function:: update_user_group(apiuser, usergroupid, group_name=, description=, owner=, active=)
+
+ Updates the specified `user group` with the details provided.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param usergroupid: Set the id of the `user group` to update.
+ :type usergroupid: str or int
+ :param group_name: Set the new name the `user group`
+ :type group_name: str
+ :param description: Give a description for the `user group`
+ :type description: str
+ :param owner: Set the owner of the `user group`.
+ :type owner: Optional(str or int)
+ :param active: Set the group as active.
+ :type active: Optional(``True`` | ``False``)
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "msg": 'updated user group ID: ',
+ "user_group":
+ }
+ error : null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ "failed to update user group ``"
+ }
+
+
+delete_user_group
+-----------------
+
+.. py:function:: delete_user_group(apiuser, usergroupid)
+
+ Deletes the specified `user group`.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified repository.
+
+ This command takes the following options:
+
+ :param apiuser: filled automatically from apikey
+ :type apiuser: AuthUser
+ :param usergroupid:
+ :type usergroupid: int
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "msg": "deleted user group ID: "
+ }
+ error : null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ "failed to delete user group ID: "
+ or
+ "RepoGroup assigned to "
+ }
+
+
+add_user_to_user_group
+----------------------
+
+.. py:function:: add_user_to_user_group(apiuser, usergroupid, userid)
+
+ Adds a user to a `user group`. If the user already exists in the group
+ this command will return false.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified user group.
+
+ This command takes the following options:
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param usergroupid: Set the name of the `user group` to which a
+ user will be added.
+ :type usergroupid: int
+ :param userid: Set the `user_id` of the user to add to the group.
+ :type userid: int
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "success": True|False # depends on if member is in group
+ "msg": "added member `` to user group `` |
+ User is already in that group"
+
+ }
+ error : null
+
+ Example error output:
+
+ .. code-block:: bash
+
+ id :
+ result : null
+ error : {
+ "failed to add member to user group ``"
+ }
+
+
+remove_user_from_user_group
+---------------------------
+
+.. py:function:: remove_user_from_user_group(apiuser, usergroupid, userid)
+
+ Removes a user from a user group.
+
+ * If the specified user is not in the group, this command will return
+ `false`.
+
+ This command can only be run using an |authtoken| with admin rights to
+ the specified user group.
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param usergroupid: Sets the user group name.
+ :type usergroupid: str or int
+ :param userid: The user you wish to remove from |RCE|.
+ :type userid: str or int
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result: {
+ "success": True|False, # depends on if member is in group
+ "msg": "removed member from user group |
+ User wasn't in group"
+ }
+ error: null
+
+
+grant_user_permission_to_user_group
+-----------------------------------
+
+.. py:function:: grant_user_permission_to_user_group(apiuser, usergroupid, userid, perm)
+
+ Set permissions for a user in a user group.
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param usergroupid: Set the user group to edit permissions on.
+ :type usergroupid: str or int
+ :param userid: Set the user from whom you wish to set permissions.
+ :type userid: str
+ :param perm: (usergroup.(none|read|write|admin))
+ :type perm: str
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "msg": "Granted perm: `` for user: `` in user group: ``",
+ "success": true
+ }
+ error : null
+
+
+revoke_user_permission_from_user_group
+--------------------------------------
+
+.. py:function:: revoke_user_permission_from_user_group(apiuser, usergroupid, userid)
+
+ Revoke a users permissions in a user group.
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param usergroupid: Set the user group from which to revoke the user
+ permissions.
+ :type: usergroupid: str or int
+ :param userid: Set the userid of the user whose permissions will be
+ revoked.
+ :type userid: str
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "msg": "Revoked perm for user: `` in user group: ``",
+ "success": true
+ }
+ error : null
+
+
+grant_user_group_permission_to_user_group
+-----------------------------------------
+
+.. py:function:: grant_user_group_permission_to_user_group(apiuser, usergroupid, sourceusergroupid, perm)
+
+ Give one user group permissions to another user group.
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param usergroupid: Set the user group on which to edit permissions.
+ :type usergroupid: str or int
+ :param sourceusergroupid: Set the source user group to which
+ access/permissions will be granted.
+ :type sourceusergroupid: str or int
+ :param perm: (usergroup.(none|read|write|admin))
+ :type perm: str
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "msg": "Granted perm: `` for user group: `` in user group: ``",
+ "success": true
+ }
+ error : null
+
+
+revoke_user_group_permission_from_user_group
+--------------------------------------------
+
+.. py:function:: revoke_user_group_permission_from_user_group(apiuser, usergroupid, sourceusergroupid)
+
+ Revoke the permissions that one user group has to another.
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param usergroupid: Set the user group on which to edit permissions.
+ :type usergroupid: str or int
+ :param sourceusergroupid: Set the user group from which permissions
+ are revoked.
+ :type sourceusergroupid: str or int
+
+ Example output:
+
+ .. code-block:: bash
+
+ id :
+ result : {
+ "msg": "Revoked perm for user group: `` in user group: ``",
+ "success": true
+ }
+ error : null
+
+
+get_pull_request
+----------------
+
+.. py:function:: get_pull_request(apiuser, repoid, pullrequestid)
+
+ Get a pull request based on the given ID.
+
+ :param apiuser: This is filled automatically from the |authtoken|.
+ :type apiuser: AuthUser
+ :param repoid: Repository name or repository ID from where the pull
+ request was opened.
+ :type repoid: str or int
+ :param pullrequestid: ID of the requested pull request.
+ :type pullrequestid: int
+
+ Example output:
+
+ .. code-block:: bash
+
+ "id": ,
+ "result":
+ {
+ "pull_request_id": "",
+ "url": "",
+ "title": "",
+ "description": "",
+ "status" : "",
+ "created_on": "",
+ "updated_on": "",
+ "commit_ids": [
+ ...
+ "",
+ "",
+ ...
+ ],
+ "review_status": "",
+ "mergeable": {
+ "status": "",
+ "message": "