##// END OF EJS Templates
docs: better capitalisation
Andrew Shadura -
r4914:95fe05b1 default
parent child Browse files
Show More
@@ -1,160 +1,160 b''
1 1 .. _contributing:
2 2
3 3 =========================
4 4 Contributing to Kallithea
5 5 =========================
6 6
7 7 Kallithea is developed and maintained by its users. Please join us and scratch
8 8 your own itch.
9 9
10 10
11 11 Infrastructure
12 12 --------------
13 13
14 14 The main repository is hosted at Our Own Kallithea (aka OOK) on
15 15 https://kallithea-scm.org/repos/kallithea/ (which is our self-hosted instance
16 16 of Kallithea).
17 17
18 18 For now, we use Bitbucket_ for `Pull Requests`_ and `Issue Tracker`_ services. The
19 19 issue tracker is for tracking bugs, not for "support", discussion or ideas -
20 20 please use the `mailing list`_ to reach the community.
21 21
22 22 We use Weblate_ to translate the user interface messages into languages other
23 23 than English. Join our project on `Hosted Weblate`_ to help us.
24 24 To register, you can use your Bitbucket or GitHub account.
25 25
26 26
27 27 Getting started
28 28 ---------------
29 29
30 30 To get started with development::
31 31
32 32 hg clone https://kallithea-scm.org/repos/kallithea
33 33 cd kallithea
34 34 virtualenv ../kallithea-venv
35 35 source ../kallithea-venv/bin/activate
36 36 python setup.py develop
37 37 paster make-config Kallithea my.ini
38 38 paster setup-db my.ini --user=user --email=user@example.com --password=password --repos=/tmp
39 39 paster serve my.ini --reload &
40 40 firefox http://127.0.0.1:5000/
41 41
42 42 You can also start out by forking https://bitbucket.org/conservancy/kallithea
43 43 on Bitbucket_ and create a local clone of your own fork.
44 44
45 45
46 46 Running tests
47 47 -------------
48 48
49 49 After finishing your changes make sure all tests pass cleanly. You can run
50 50 the testsuite running ``nosetest`` from the project root, or if you use tox
51 51 run tox for python2.6-2.7 with multiple database test. When using `nosetests`
52 test.ini file is used and by default it uses sqlite for tests, edit this file
52 test.ini file is used and by default it uses SQLite for tests, edit this file
53 53 to change your testing enviroment.
54 54
55 There's a special set of tests for push/pull operations, you can runn them using::
55 There's a special set of tests for push/pull operations, you can run them using::
56 56
57 57 paster serve test.ini --pid-file=test.pid --daemon
58 58 KALLITHEA_WHOOSH_TEST_DISABLE=1 KALLITHEA_NO_TMP_PATH=1 nosetests -x kallithea/tests/other/test_vcs_operations.py
59 59 kill -9 $(cat test.pid)
60 60
61 61
62 62 Coding/contribution guidelines
63 63 ------------------------------
64 64
65 65 Kallithea is GPLv3 and we assume all contributions are made by the
66 66 committer/contributor and under GPLv3 unless explicitly stated. We do care a
67 67 lot about preservation of copyright and license information for existing code
68 68 that is brought into the project.
69 69
70 70 We don't have a formal coding/formatting standard. We are currently using a mix
71 71 of Mercurial (http://mercurial.selenic.com/wiki/CodingStyle), pep8, and
72 72 consistency with existing code. Run whitespacecleanup.sh to avoid stupid
73 73 whitespace noise in your patches.
74 74
75 75 We support both Python 2.6.x and 2.7.x and nothing else. For now we don't care
76 76 about Python 3 compatibility.
77 77
78 78 We try to support the most common modern web browsers. IE8 is still supported
79 79 to the extent it is feasible but we may stop supporting it very soon.
80 80
81 81 We primarily support Linux and OS X on the server side but Windows should also work.
82 82
83 83 Html templates should use 2 spaces for indentation ... but be pragmatic. We
84 84 should use templates cleverly and avoid duplication. We should use reasonable
85 85 semantic markup with classes and ids that can be used for styling and testing.
86 86 We should only use inline styles in places where it really is semantic (such as
87 87 display:none).
88 88
89 89 JavaScript must use ';' between/after statements. Indentation 4 spaces. Inline
90 90 multiline functions should be indented two levels - one for the () and one for
91 91 {}. jQuery value arrays should have a leading $.
92 92
93 93 Commit messages should have a leading short line summarizing the changes. For
94 94 bug fixes, put "(Issue #123)" at the end of this line.
95 95
96 96 Contributions will be accepted in most formats - such as pull requests on
97 97 bitbucket, something hosted on your own Kallithea instance, or patches sent by
98 98 mail to the kallithea-general mailing list.
99 99
100 100 Make sure to test your changes both manually and with the automatic tests
101 101 before posting.
102 102
103 103 We care about quality and review and keeping a clean repository history. We
104 104 might give feedback that requests polishing contributions until they are
105 105 "perfect". We might also rebase and collapse and make minor adjustments to your
106 106 changes when we apply them.
107 107
108 108 We try to make sure we have consensus on the direction the project is taking.
109 109 Everything non-sensitive should be discussed in public - preferably on the
110 110 mailing list. We aim at having all non-trivial changes reviewed by at least
111 111 one other core developer before pushing. Obvious non-controversial changes will
112 112 be handled more casually.
113 113
114 114 For now we just have one official branch ("default") and will keep it so stable
115 115 that it can be (and is) used in production. Experimental changes should live
116 116 elsewhere (for example in a pull request) until they are ready.
117 117
118 118
119 119 "Roadmap"
120 120 ---------
121 121
122 122 We do not have a road map but are waiting for your contributions. Here are some
123 123 ideas of places we might want to go - contributions in these areas are very
124 124 welcome:
125 125
126 126 * Front end:
127 127 * kill YUI - more jQuery
128 128 * remove other dependencies - especially the embedded cut'n'pasted ones
129 129 * remove hardcoded styling in templates, make markup more semantic while moving all styling to css
130 130 * switch to bootstrap or some other modern UI library and cleanup of style.css and contextbar.css
131 131 * new fancy style that looks good
132 132 * testing
133 133 * better test coverage with the existing high level test framework
134 134 * test even more high level and javascript - selenium/robot and splinter seems like the top candidates
135 135 * more unit testing
136 136 * code cleanup
137 137 * move code from templates to controllers and from controllers to libs or models
138 138 * more best practice for web apps and the frameworks
139 139 * features
140 140 * relax dependency version requirements after thorough testing
141 141 * support for evolve
142 142 * updates of PRs ... while preserving history and comment context
143 143 * auto pr merge/rebase
144 144 * ssh
145 145 * bitbucket compatible wiki
146 146 * realtime preview / wysiwyg when editing comments and files
147 147 * make journal more useful - filtering on branches and files
148 148 * community mode with self registration and personal space
149 149 * improve documentation
150 150
151 151 Thank you for your contribution!
152 152 --------------------------------
153 153
154 154
155 155 .. _Weblate: http://weblate.org/
156 156 .. _Issue Tracker: https://bitbucket.org/conservancy/kallithea/issues?status=new&status=open
157 157 .. _Pull Requests: https://bitbucket.org/conservancy/kallithea/pull-requests
158 158 .. _bitbucket: http://bitbucket.org/
159 159 .. _mailing list: http://lists.sfconservancy.org/mailman/listinfo/kallithea-general
160 160 .. _Hosted Weblate: https://hosted.weblate.org/projects/kallithea/kallithea/
@@ -1,201 +1,201 b''
1 1 .. _installation:
2 2
3 3 ==========================
4 4 Installation on Unix/Linux
5 5 ==========================
6 6
7 7 **Kallithea** is written entirely in Python. Kallithea requires Python version
8 8 2.6 or higher.
9 9
10 10 .. Note:: Alternative very detailed installation instructions for Ubuntu Server
11 11 with celery, indexer and daemon scripts: https://gist.github.com/4546398
12 12
13 13
14 14 Installing Kallithea from Python Package Index (PyPI)
15 15 -----------------------------------------------------
16 16
17 17 **Kallithea** can be installed from PyPI with::
18 18
19 19 pip install kallithea
20 20
21 21
22 22 Installation in virtualenv
23 23 --------------------------
24 24
25 25 It is highly recommended to use a separate virtualenv_ for installing Kallithea.
26 26 This way, all libraries required by Kallithea will be installed separately from your
27 27 main Python installation and things will be less problematic when upgrading the
28 28 system or Kallithea.
29 29 An additional benefit of virtualenv_ is that it doesn't require root privileges.
30 30
31 31 - Assuming you have installed virtualenv_, create a new virtual environment
32 32 using virtualenv command::
33 33
34 34 virtualenv /srv/kallithea/venv
35 35
36 36 .. note:: Older versions of virtualenv required ``--no-site-packages`` to work
37 37 correctly. It should no longer be necessary.
38 38
39 39 - this will install new virtualenv_ into `/srv/kallithea/venv`.
40 40 - Activate the virtualenv_ in your current shell session by running::
41 41
42 42 source /srv/kallithea/venv/bin/activate
43 43
44 44 .. note:: If you're using UNIX, *do not* use ``sudo`` to run the
45 45 ``virtualenv`` script. It's perfectly acceptable (and desirable)
46 46 to create a virtualenv as a normal user.
47 47
48 48 - Make a folder for Kallithea data files, and configuration somewhere on the
49 49 filesystem. For example::
50 50
51 51 mkdir /srv/kallithea
52 52
53 53 - Go into the created directory run this command to install kallithea::
54 54
55 55 pip install kallithea
56 56
57 57 Alternatively, download a .tar.gz from http://pypi.python.org/pypi/Kallithea,
58 58 extract it and run::
59 59
60 60 python setup.py install
61 61
62 62 - This will install Kallithea together with pylons and all other required
63 63 python libraries into the activated virtualenv.
64 64
65 65
66 66 Requirements for Celery (optional)
67 67 ----------------------------------
68 68
69 69 In order to gain maximum performance
70 70 there are some third-party you must install. When Kallithea is used
71 71 together with celery you have to install some kind of message broker,
72 72 recommended one is rabbitmq_ to make the async tasks work.
73 73
74 74 Of course Kallithea works in sync mode also and then you do not have to install
75 75 any third party applications. However, using Celery_ will give you a large
76 76 speed improvement when using many big repositories. If you plan to use
77 77 Kallithea for say 7 to 10 repositories, Kallithea will perform perfectly well
78 78 without celery running.
79 79
80 80 If you make the decision to run Kallithea with celery make sure you run
81 81 celeryd using paster and message broker together with the application.
82 82
83 83 .. note::
84 84 Installing message broker and using celery is optional, Kallithea will
85 85 work perfectly fine without them.
86 86
87 87
88 88 **Message Broker**
89 89
90 90 - preferred is `RabbitMq <http://www.rabbitmq.com/>`_
91 91 - A possible alternative is `Redis <http://code.google.com/p/redis/>`_
92 92
93 93 For installation instructions you can visit:
94 94 http://ask.github.com/celery/getting-started/index.html.
95 95 This is a very nice tutorial on how to start using celery_ with rabbitmq_
96 96
97 97
98 98 Next
99 99 ----
100 100
101 101 You can now proceed to :ref:`setup`.
102 102
103 103
104 104 Upgrading Kallithea from Python Package Index (PyPI)
105 105 -----------------------------------------------------
106 106
107 107 .. note::
108 108 Firstly, it is recommended that you **always** perform a database and
109 109 configuration backup before doing an upgrade.
110 110
111 111 (These directions will use '{version}' to note that this is the version of
112 112 Kallithea that these files were used with. If backing up your Kallithea
113 113 instance from version 0.1 to 0.2, the ``my.ini`` file could be
114 114 backed up to ``my.ini.0-1``.)
115 115
116 116
117 If using a sqlite database, stop the Kallithea process/daemon/service, and
117 If using a SQLite database, stop the Kallithea process/daemon/service, and
118 118 then make a copy of the database file::
119 119
120 120 service kallithea stop
121 121 cp kallithea.db kallithea.db.{version}
122 122
123 123
124 124 Back up your configuration file::
125 125
126 126 cp my.ini my.ini.{version}
127 127
128 128
129 129 Ensure that you are using the Python Virtual Environment that you'd originally
130 130 installed Kallithea in::
131 131
132 132 pip freeze
133 133
134 134 will list all packages installed in the current environment. If Kallithea
135 135 isn't listed, change virtual environments to your venv location::
136 136
137 137 source /srv/kallithea/venv/bin/activate
138 138
139 139
140 140 Once you have verified the environment you can upgrade Kallithea with::
141 141
142 142 pip install --upgrade kallithea
143 143
144 144
145 145 Then run the following command from the installation directory::
146 146
147 147 paster make-config Kallithea my.ini
148 148
149 149 This will display any changes made by the new version of Kallithea to your
150 150 current configuration. It will try to perform an automerge. It's recommended
151 151 that you re-check the content after the automerge.
152 152
153 153 .. note::
154 154 Please always make sure your .ini files are up to date. Often errors are
155 155 caused by missing params added in new versions.
156 156
157 157
158 158 It is also recommended that you rebuild the whoosh index after upgrading since
159 159 the new whoosh version could introduce some incompatible index changes. Please
160 160 read the changelog to see if there were any changes to whoosh.
161 161
162 162
163 163 The final step is to upgrade the database. To do this simply run::
164 164
165 165 paster upgrade-db my.ini
166 166
167 167 This will upgrade the schema and update some of the defaults in the database,
168 168 and will always recheck the settings of the application, if there are no new
169 169 options that need to be set.
170 170
171 171
172 172 .. note::
173 173 DB schema upgrade library has some limitations and can sometimes fail if you try to
174 174 upgrade from older major releases. In such case simply run upgrades sequentially, eg.
175 175 upgrading from 0.1.X to 0.3.X should be done like that: 0.1.X. > 0.2.X > 0.3.X
176 176 You can always specify what version of Kallithea you want to install for example in pip
177 177 `pip install Kallithea==0.2`
178 178
179 179 You may find it helpful to clear out your log file so that new errors are
180 180 readily apparent::
181 181
182 182 echo > kallithea.log
183 183
184 184 Once that is complete, you may now start your upgraded Kallithea Instance::
185 185
186 186 service kallithea start
187 187
188 188 Or::
189 189
190 190 paster serve /srv/kallithea/my.ini
191 191
192 192 .. note::
193 193 If you're using Celery, make sure you restart all instances of it after
194 194 upgrade.
195 195
196 196
197 197 .. _virtualenv: http://pypi.python.org/pypi/virtualenv
198 198 .. _python: http://www.python.org/
199 199 .. _mercurial: http://mercurial.selenic.com/
200 200 .. _celery: http://celeryproject.org/
201 201 .. _rabbitmq: http://www.rabbitmq.com/
@@ -1,764 +1,764 b''
1 1 .. _setup:
2 2
3 3 =====
4 4 Setup
5 5 =====
6 6
7 7
8 8 Setting up Kallithea
9 9 --------------------
10 10
11 11 First, you will need to create a Kallithea configuration file. Run the
12 12 following command to do this::
13 13
14 14 paster make-config Kallithea my.ini
15 15
16 16 - This will create the file `my.ini` in the current directory. This
17 17 configuration file contains the various settings for Kallithea, e.g proxy
18 18 port, email settings, usage of static files, cache, celery settings and
19 19 logging.
20 20
21 21
22 22 Next, you need to create the databases used by Kallithea. It is recommended to
23 use postgresql or sqlite (default). If you choose a database other than the
24 default ensure you properly adjust the db url in your my.ini
23 use PostgreSQL or SQLite (default). If you choose a database other than the
24 default ensure you properly adjust the database URL in your my.ini
25 25 configuration file to use this other database. Kallithea currently supports
26 postgresql, sqlite and mysql databases. Create the database by running
26 PostgreSQL, SQLite and MySQL databases. Create the database by running
27 27 the following command::
28 28
29 29 paster setup-db my.ini
30 30
31 31 This will prompt you for a "root" path. This "root" path is the location where
32 32 Kallithea will store all of its repositories on the current machine. After
33 33 entering this "root" path ``setup-db`` will also prompt you for a username
34 34 and password for the initial admin account which ``setup-db`` sets
35 35 up for you.
36 36
37 37 setup process can be fully automated, example for lazy::
38 38
39 39 paster setup-db my.ini --user=nn --password=secret --email=nn@your.kallithea.server --repos=/srv/repos
40 40
41 41
42 42 - The ``setup-db`` command will create all of the needed tables and an
43 43 admin account. When choosing a root path you can either use a new empty
44 44 location, or a location which already contains existing repositories. If you
45 choose a location which contains existing repositories Kallithea will simply
46 add all of the repositories at the chosen location to it's database.
45 choose a location which contains existing repositories Kallithea will
46 add all of the repositories at the chosen location to its database.
47 47 (Note: make sure you specify the correct path to the root).
48 - Note: the given path for mercurial_ repositories **must** be write accessible
48 - Note: the given path for Mercurial_ repositories **must** be write accessible
49 49 for the application. It's very important since the Kallithea web interface
50 50 will work without write access, but when trying to do a push it will
51 51 eventually fail with permission denied errors unless it has write access.
52 52
53 53 You are now ready to use Kallithea, to run it simply execute::
54 54
55 55 paster serve my.ini
56 56
57 57 - This command runs the Kallithea server. The web app should be available at the
58 58 127.0.0.1:5000. This ip and port is configurable via the my.ini
59 59 file created in previous step
60 60 - Use the admin account you created above when running ``setup-db``
61 61 to login to the web app.
62 62 - The default permissions on each repository is read, and the owner is admin.
63 63 Remember to update these if needed.
64 64 - In the admin panel you can toggle LDAP, anonymous, permissions settings. As
65 65 well as edit more advanced options on users and repositories
66 66
67 67 Optionally users can create `rcextensions` package that extends Kallithea
68 68 functionality. To do this simply execute::
69 69
70 70 paster make-rcext my.ini
71 71
72 72 This will create `rcextensions` package in the same place that your `ini` file
73 73 lives. With `rcextensions` it's possible to add additional mapping for whoosh,
74 74 stats and add additional code into the push/pull/create/delete repo hooks.
75 For example for sending signals to build-bots such as jenkins.
75 For example for sending signals to build-bots such as Jenkins.
76 76 Please see the `__init__.py` file inside `rcextensions` package
77 77 for more details.
78 78
79 79
80 80 Using Kallithea with SSH
81 81 ------------------------
82 82
83 83 Kallithea currently only hosts repositories using http and https. (The addition
84 84 of ssh hosting is a planned future feature.) However you can easily use ssh in
85 85 parallel with Kallithea. (Repository access via ssh is a standard "out of
86 the box" feature of mercurial_ and you can use this to access any of the
86 the box" feature of Mercurial_ and you can use this to access any of the
87 87 repositories that Kallithea is hosting. See PublishingRepositories_)
88 88
89 89 Kallithea repository structures are kept in directories with the same name
90 90 as the project. When using repository groups, each group is a subdirectory.
91 91 This allows you to easily use ssh for accessing repositories.
92 92
93 93 In order to use ssh you need to make sure that your web-server and the users
94 94 login accounts have the correct permissions set on the appropriate directories.
95 95 (Note that these permissions are independent of any permissions you have set up
96 96 using the Kallithea web interface.)
97 97
98 98 If your main directory (the same as set in Kallithea settings) is for example
99 99 set to **/srv/repos** and the repository you are using is named `kallithea`, then
100 100 to clone via ssh you should run::
101 101
102 102 hg clone ssh://user@server.com//srv/repos/kallithea
103 103
104 104 Using other external tools such as mercurial-server_ or using ssh key based
105 105 authentication is fully supported.
106 106
107 107 Note: In an advanced setup, in order for your ssh access to use the same
108 108 permissions as set up via the Kallithea web interface, you can create an
109 109 authentication hook to connect to the Kallithea db and runs check functions for
110 110 permissions against that.
111 111
112 112 Setting up Whoosh full text search
113 113 ----------------------------------
114 114
115 115 The whoosh index can be build by using the paster
116 116 command ``make-index``. To use ``make-index`` you must specify the configuration
117 117 file that stores the location of the index. You may specify the location of the
118 118 repositories (`--repo-location`). If not specified, this value is retrieved
119 119 from the Kallithea database.
120 120 It is also possible to specify a comma separated list of
121 121 repositories (`--index-only`) to build index only on chooses repositories
122 122 skipping any other found in repos location
123 123
124 124 You may optionally pass the option `-f` to enable a full index rebuild. Without
125 125 the `-f` option, indexing will run always in "incremental" mode.
126 126
127 127 For an incremental index build use::
128 128
129 129 paster make-index my.ini
130 130
131 131 For a full index rebuild use::
132 132
133 133 paster make-index my.ini -f
134 134
135 135
136 136 building index just for chosen repositories is possible with such command::
137 137
138 138 paster make-index my.ini --index-only=vcs,kallithea
139 139
140 140
141 141 In order to do periodical index builds and keep your index always up to date.
142 142 It's recommended to do a crontab entry for incremental indexing.
143 143 An example entry might look like this::
144 144
145 145 /path/to/python/bin/paster make-index /path/to/kallithea/my.ini
146 146
147 147 When using incremental mode (the default) whoosh will check the last
148 148 modification date of each file and add it to be reindexed if a newer file is
149 149 available. The indexing daemon checks for any removed files and removes them
150 150 from index.
151 151
152 152 If you want to rebuild index from scratch, you can use the `-f` flag as above,
153 153 or in the admin panel you can check `build from scratch` flag.
154 154
155 155
156 156 Setting up LDAP support
157 157 -----------------------
158 158
159 159 Kallithea supports LDAP authentication. In order
160 160 to use LDAP, you have to install the python-ldap_ package. This package is
161 161 available via pypi, so you can install it by running
162 162
163 163 pip install python-ldap
164 164
165 165 .. note::
166 166 python-ldap requires some certain libs on your system, so before installing
167 167 it check that you have at least `openldap`, and `sasl` libraries.
168 168
169 169 LDAP settings are located in Admin->LDAP section.
170 170
171 171 Here's a typical LDAP setup::
172 172
173 173 Connection settings
174 174 Enable LDAP = checked
175 175 Host = host.example.org
176 176 Port = 389
177 177 Account = <account>
178 178 Password = <password>
179 179 Connection Security = LDAPS connection
180 180 Certificate Checks = DEMAND
181 181
182 182 Search settings
183 183 Base DN = CN=users,DC=host,DC=example,DC=org
184 184 LDAP Filter = (&(objectClass=user)(!(objectClass=computer)))
185 185 LDAP Search Scope = SUBTREE
186 186
187 187 Attribute mappings
188 188 Login Attribute = uid
189 189 First Name Attribute = firstName
190 190 Last Name Attribute = lastName
191 191 E-mail Attribute = mail
192 192
193 193 If your user groups are placed in a Organisation Unit (OU) structure the Search Settings configuration differs::
194 194
195 195 Search settings
196 196 Base DN = DC=host,DC=example,DC=org
197 197 LDAP Filter = (&(memberOf=CN=your user group,OU=subunit,OU=unit,DC=host,DC=example,DC=org)(objectClass=user))
198 198 LDAP Search Scope = SUBTREE
199 199
200 200 .. _enable_ldap:
201 201
202 202 Enable LDAP : required
203 203 Whether to use LDAP for authenticating users.
204 204
205 205 .. _ldap_host:
206 206
207 207 Host : required
208 208 LDAP server hostname or IP address. Can be also a comma separated
209 209 list of servers to support LDAP fail-over.
210 210
211 211 .. _Port:
212 212
213 213 Port : required
214 214 389 for un-encrypted LDAP, 636 for SSL-encrypted LDAP.
215 215
216 216 .. _ldap_account:
217 217
218 218 Account : optional
219 219 Only required if the LDAP server does not allow anonymous browsing of
220 220 records. This should be a special account for record browsing. This
221 221 will require `LDAP Password`_ below.
222 222
223 223 .. _LDAP Password:
224 224
225 225 Password : optional
226 226 Only required if the LDAP server does not allow anonymous browsing of
227 227 records.
228 228
229 229 .. _Enable LDAPS:
230 230
231 231 Connection Security : required
232 232 Defines the connection to LDAP server
233 233
234 234 No encryption
235 235 Plain non encrypted connection
236 236
237 237 LDAPS connection
238 238 Enable LDAPS connections. It will likely require `Port`_ to be set to
239 239 a different value (standard LDAPS port is 636). When LDAPS is enabled
240 240 then `Certificate Checks`_ is required.
241 241
242 242 START_TLS on LDAP connection
243 243 START TLS connection
244 244
245 245 .. _Certificate Checks:
246 246
247 247 Certificate Checks : optional
248 248 How SSL certificates verification is handled - this is only useful when
249 249 `Enable LDAPS`_ is enabled. Only DEMAND or HARD offer full SSL security
250 250 while the other options are susceptible to man-in-the-middle attacks. SSL
251 251 certificates can be installed to /etc/openldap/cacerts so that the
252 252 DEMAND or HARD options can be used with self-signed certificates or
253 253 certificates that do not have traceable certificates of authority.
254 254
255 255 NEVER
256 256 A serve certificate will never be requested or checked.
257 257
258 258 ALLOW
259 259 A server certificate is requested. Failure to provide a
260 260 certificate or providing a bad certificate will not terminate the
261 261 session.
262 262
263 263 TRY
264 264 A server certificate is requested. Failure to provide a
265 265 certificate does not halt the session; providing a bad certificate
266 266 halts the session.
267 267
268 268 DEMAND
269 269 A server certificate is requested and must be provided and
270 270 authenticated for the session to proceed.
271 271
272 272 HARD
273 273 The same as DEMAND.
274 274
275 275 .. _Base DN:
276 276
277 277 Base DN : required
278 278 The Distinguished Name (DN) where searches for users will be performed.
279 279 Searches can be controlled by `LDAP Filter`_ and `LDAP Search Scope`_.
280 280
281 281 .. _LDAP Filter:
282 282
283 283 LDAP Filter : optional
284 284 A LDAP filter defined by RFC 2254. This is more useful when `LDAP
285 285 Search Scope`_ is set to SUBTREE. The filter is useful for limiting
286 286 which LDAP objects are identified as representing Users for
287 287 authentication. The filter is augmented by `Login Attribute`_ below.
288 288 This can commonly be left blank.
289 289
290 290 .. _LDAP Search Scope:
291 291
292 292 LDAP Search Scope : required
293 293 This limits how far LDAP will search for a matching object.
294 294
295 295 BASE
296 296 Only allows searching of `Base DN`_ and is usually not what you
297 297 want.
298 298
299 299 ONELEVEL
300 300 Searches all entries under `Base DN`_, but not Base DN itself.
301 301
302 302 SUBTREE
303 303 Searches all entries below `Base DN`_, but not Base DN itself.
304 304 When using SUBTREE `LDAP Filter`_ is useful to limit object
305 305 location.
306 306
307 307 .. _Login Attribute:
308 308
309 309 Login Attribute : required
310 310 The LDAP record attribute that will be matched as the USERNAME or
311 311 ACCOUNT used to connect to Kallithea. This will be added to `LDAP
312 312 Filter`_ for locating the User object. If `LDAP Filter`_ is specified as
313 313 "LDAPFILTER", `Login Attribute`_ is specified as "uid" and the user has
314 314 connected as "jsmith" then the `LDAP Filter`_ will be augmented as below
315 315 ::
316 316
317 317 (&(LDAPFILTER)(uid=jsmith))
318 318
319 319 .. _ldap_attr_firstname:
320 320
321 321 First Name Attribute : required
322 322 The LDAP record attribute which represents the user's first name.
323 323
324 324 .. _ldap_attr_lastname:
325 325
326 326 Last Name Attribute : required
327 327 The LDAP record attribute which represents the user's last name.
328 328
329 329 .. _ldap_attr_email:
330 330
331 331 Email Attribute : required
332 332 The LDAP record attribute which represents the user's email address.
333 333
334 334 If all data are entered correctly, and python-ldap_ is properly installed
335 335 users should be granted access to Kallithea with LDAP accounts. At this
336 336 time user information is copied from LDAP into the Kallithea user database.
337 337 This means that updates of an LDAP user object may not be reflected as a
338 338 user update in Kallithea.
339 339
340 340 If You have problems with LDAP access and believe You entered correct
341 341 information check out the Kallithea logs, any error messages sent from LDAP
342 342 will be saved there.
343 343
344 344 Active Directory
345 345 ''''''''''''''''
346 346
347 347 Kallithea can use Microsoft Active Directory for user authentication. This
348 348 is done through an LDAP or LDAPS connection to Active Directory. The
349 349 following LDAP configuration settings are typical for using Active
350 350 Directory ::
351 351
352 352 Base DN = OU=SBSUsers,OU=Users,OU=MyBusiness,DC=v3sys,DC=local
353 353 Login Attribute = sAMAccountName
354 354 First Name Attribute = givenName
355 355 Last Name Attribute = sn
356 356 E-mail Attribute = mail
357 357
358 358 All other LDAP settings will likely be site-specific and should be
359 359 appropriately configured.
360 360
361 361
362 362 Authentication by container or reverse-proxy
363 363 --------------------------------------------
364 364
365 365 Kallithea supports delegating the authentication
366 366 of users to its WSGI container, or to a reverse-proxy server through which all
367 367 clients access the application.
368 368
369 369 When these authentication methods are enabled in Kallithea, it uses the
370 370 username that the container/proxy (Apache/Nginx/etc) authenticated and doesn't
371 371 perform the authentication itself. The authorization, however, is still done by
372 372 Kallithea according to its settings.
373 373
374 374 When a user logs in for the first time using these authentication methods,
375 375 a matching user account is created in Kallithea with default permissions. An
376 376 administrator can then modify it using Kallithea's admin interface.
377 377 It's also possible for an administrator to create accounts and configure their
378 378 permissions before the user logs in for the first time.
379 379
380 380
381 381 Container-based authentication
382 382 ''''''''''''''''''''''''''''''
383 383
384 384 In a container-based authentication setup, Kallithea reads the user name from
385 385 the ``REMOTE_USER`` server variable provided by the WSGI container.
386 386
387 387 After setting up your container (see `Apache's WSGI config`_), you'd need
388 388 to configure it to require authentication on the location configured for
389 389 Kallithea.
390 390
391 391
392 392 Proxy pass-through authentication
393 393 '''''''''''''''''''''''''''''''''
394 394
395 395 In a proxy pass-through authentication setup, Kallithea reads the user name
396 396 from the ``X-Forwarded-User`` request header, which should be configured to be
397 397 sent by the reverse-proxy server.
398 398
399 399 After setting up your proxy solution (see `Apache virtual host reverse proxy example`_,
400 400 `Apache as subdirectory`_ or `Nginx virtual host example`_), you'd need to
401 401 configure the authentication and add the username in a request header named
402 402 ``X-Forwarded-User``.
403 403
404 404 For example, the following config section for Apache sets a subdirectory in a
405 405 reverse-proxy setup with basic auth::
406 406
407 407 <Location /<someprefix> >
408 408 ProxyPass http://127.0.0.1:5000/<someprefix>
409 409 ProxyPassReverse http://127.0.0.1:5000/<someprefix>
410 410 SetEnvIf X-Url-Scheme https HTTPS=1
411 411
412 412 AuthType Basic
413 413 AuthName "Kallithea authentication"
414 414 AuthUserFile /srv/kallithea/.htpasswd
415 415 require valid-user
416 416
417 417 RequestHeader unset X-Forwarded-User
418 418
419 419 RewriteEngine On
420 420 RewriteCond %{LA-U:REMOTE_USER} (.+)
421 421 RewriteRule .* - [E=RU:%1]
422 422 RequestHeader set X-Forwarded-User %{RU}e
423 423 </Location>
424 424
425 425
426 426 .. note::
427 427 If you enable proxy pass-through authentication, make sure your server is
428 428 only accessible through the proxy. Otherwise, any client would be able to
429 429 forge the authentication header and could effectively become authenticated
430 430 using any account of their liking.
431 431
432 432 Integration with Issue trackers
433 433 -------------------------------
434 434
435 435 Kallithea provides a simple integration with issue trackers. It's possible
436 436 to define a regular expression that will fetch issue id stored in commit
437 437 messages and replace that with an url to this issue. To enable this simply
438 438 uncomment following variables in the ini file::
439 439
440 440 issue_pat = (?:^#|\s#)(\w+)
441 441 issue_server_link = https://myissueserver.com/{repo}/issue/{id}
442 442 issue_prefix = #
443 443
444 444 `issue_pat` is the regular expression describing which strings in
445 445 commit messages will be treated as issue references. A match group in
446 446 parentheses should be used to specify the actual issue id.
447 447
448 448 The default expression matches issues in the format '#<number>', e.g. '#300'.
449 449
450 450 Matched issues are replaced with the link specified as `issue_server_link`
451 451 {id} is replaced with issue id, and {repo} with repository name.
452 452 Since the # is stripped away, `issue_prefix` is prepended to the link text.
453 453 `issue_prefix` doesn't necessarily need to be #: if you set issue
454 454 prefix to ISSUE- this will generate a URL in format::
455 455
456 456 <a href="https://myissueserver.com/example_repo/issue/300">ISSUE-300</a>
457 457
458 458 If needed, more than one pattern can be specified by appending a unique suffix to
459 459 the variables. For example::
460 460
461 461 issue_pat_wiki = (?:wiki-)(.+)
462 462 issue_server_link_wiki = https://mywiki.com/{id}
463 463 issue_prefix_wiki = WIKI-
464 464
465 465 With these settings, wiki pages can be referenced as wiki-some-id, and every
466 466 such reference will be transformed into::
467 467
468 468 <a href="https://mywiki.com/some-id">WIKI-some-id</a>
469 469
470 470
471 471 Hook management
472 472 ---------------
473 473
474 474 Hooks can be managed in similar way to this used in .hgrc files.
475 475 To access hooks setting click `advanced setup` on Hooks section of Mercurial
476 476 Settings in Admin.
477 477
478 478 There are 4 built in hooks that cannot be changed (only enable/disable by
479 479 checkboxes on previos section).
480 480 To add another custom hook simply fill in first section with
481 481 <name>.<hook_type> and the second one with hook path. Example hooks
482 482 can be found at *kallithea.lib.hooks*.
483 483
484 484
485 485 Changing default encoding
486 486 -------------------------
487 487
488 By default, Kallithea uses utf8 encoding.
488 By default, Kallithea uses UTF-8 encoding.
489 489 It is configurable as `default_encoding` in the .ini file.
490 490 This affects many parts in Kallithea including user names, filenames, and
491 491 encoding of commit messages. In addition Kallithea can detect if `chardet`
492 492 library is installed. If `chardet` is detected Kallithea will fallback to it
493 493 when there are encode/decode errors.
494 494
495 495
496 496 Celery configuration
497 497 --------------------
498 498
499 499 Celery is configured in the Kallithea ini configuration files.
500 500 Simply set use_celery=true in the ini file then add / change the configuration
501 501 variables inside the ini file.
502 502
503 503 Remember that the ini files use the format with '.' not with '_' like celery.
504 504 So for example setting `BROKER_HOST` in celery means setting `broker.host` in
505 505 the config file.
506 506
507 507 In order to start using celery run::
508 508
509 509 paster celeryd <configfile.ini>
510 510
511 511
512 512 .. note::
513 513 Make sure you run this command from the same virtualenv, and with the same
514 514 user that Kallithea runs.
515 515
516 516 HTTPS support
517 517 -------------
518 518
519 519 Kallithea will by default generate URLs based on the WSGI environment.
520 520
521 521 Alternatively, you can use some special configuration settings to control
522 522 directly which scheme/protocol Kallithea will use when generating URLs:
523 523
524 524 - With `https_fixup = true`, the scheme will be taken from the HTTP_X_URL_SCHEME,
525 525 HTTP_X_FORWARDED_SCHEME or HTTP_X_FORWARDED_PROTO HTTP header (default 'http').
526 526 - With `force_https = true` the default will be 'https'.
527 527 - With `use_htsts = true`, it will set Strict-Transport-Security when using https.
528 528
529 529 Nginx virtual host example
530 530 --------------------------
531 531
532 532 Sample config for nginx using proxy::
533 533
534 534 upstream kallithea {
535 535 server 127.0.0.1:5000;
536 536 # add more instances for load balancing
537 537 #server 127.0.0.1:5001;
538 538 #server 127.0.0.1:5002;
539 539 }
540 540
541 541 ## gist alias
542 542 server {
543 543 listen 443;
544 544 server_name gist.myserver.com;
545 545 access_log /var/log/nginx/gist.access.log;
546 546 error_log /var/log/nginx/gist.error.log;
547 547
548 548 ssl on;
549 549 ssl_certificate gist.your.kallithea.server.crt;
550 550 ssl_certificate_key gist.your.kallithea.server.key;
551 551
552 552 ssl_session_timeout 5m;
553 553
554 554 ssl_protocols SSLv3 TLSv1;
555 555 ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5;
556 556 ssl_prefer_server_ciphers on;
557 557
558 558 rewrite ^/(.+)$ https://your.kallithea.server/_admin/gists/$1;
559 559 rewrite (.*) https://your.kallithea.server/_admin/gists;
560 560 }
561 561
562 562 server {
563 563 listen 443;
564 564 server_name your.kallithea.server;
565 565 access_log /var/log/nginx/kallithea.access.log;
566 566 error_log /var/log/nginx/kallithea.error.log;
567 567
568 568 ssl on;
569 569 ssl_certificate your.kallithea.server.crt;
570 570 ssl_certificate_key your.kallithea.server.key;
571 571
572 572 ssl_session_timeout 5m;
573 573
574 574 ssl_protocols SSLv3 TLSv1;
575 575 ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5;
576 576 ssl_prefer_server_ciphers on;
577 577
578 578 ## uncomment root directive if you want to serve static files by nginx
579 579 ## requires static_files = false in .ini file
580 580 #root /path/to/installation/kallithea/public;
581 581 include /etc/nginx/proxy.conf;
582 582 location / {
583 583 try_files $uri @kallithea;
584 584 }
585 585
586 586 location @kallithea {
587 587 proxy_pass http://kallithea;
588 588 }
589 589
590 590 }
591 591
592 592 Here's the proxy.conf. It's tuned so it will not timeout on long
593 593 pushes or large pushes::
594 594
595 595 proxy_redirect off;
596 596 proxy_set_header Host $host;
597 597 ## needed for container auth
598 598 #proxy_set_header REMOTE_USER $remote_user;
599 599 #proxy_set_header X-Forwarded-User $remote_user;
600 600 proxy_set_header X-Url-Scheme $scheme;
601 601 proxy_set_header X-Host $http_host;
602 602 proxy_set_header X-Real-IP $remote_addr;
603 603 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
604 604 proxy_set_header Proxy-host $proxy_host;
605 605 proxy_buffering off;
606 606 proxy_connect_timeout 7200;
607 607 proxy_send_timeout 7200;
608 608 proxy_read_timeout 7200;
609 609 proxy_buffers 8 32k;
610 610 client_max_body_size 1024m;
611 611 client_body_buffer_size 128k;
612 612 large_client_header_buffers 8 64k;
613 613
614 614
615 615 Apache virtual host reverse proxy example
616 616 -----------------------------------------
617 617
618 618 Here is a sample configuration file for apache using proxy::
619 619
620 620 <VirtualHost *:80>
621 621 ServerName hg.myserver.com
622 622 ServerAlias hg.myserver.com
623 623
624 624 <Proxy *>
625 625 Order allow,deny
626 626 Allow from all
627 627 </Proxy>
628 628
629 629 #important !
630 630 #Directive to properly generate url (clone url) for pylons
631 631 ProxyPreserveHost On
632 632
633 633 #kallithea instance
634 634 ProxyPass / http://127.0.0.1:5000/
635 635 ProxyPassReverse / http://127.0.0.1:5000/
636 636
637 637 #to enable https use line below
638 638 #SetEnvIf X-Url-Scheme https HTTPS=1
639 639
640 640 </VirtualHost>
641 641
642 642
643 643 Additional tutorial
644 644 http://wiki.pylonshq.com/display/pylonscookbook/Apache+as+a+reverse+proxy+for+Pylons
645 645
646 646
647 647 Apache as subdirectory
648 648 ----------------------
649 649
650 650 Apache subdirectory part::
651 651
652 652 <Location /<someprefix> >
653 653 ProxyPass http://127.0.0.1:5000/<someprefix>
654 654 ProxyPassReverse http://127.0.0.1:5000/<someprefix>
655 655 SetEnvIf X-Url-Scheme https HTTPS=1
656 656 </Location>
657 657
658 658 Besides the regular apache setup you will need to add the following line
659 659 into [app:main] section of your .ini file::
660 660
661 661 filter-with = proxy-prefix
662 662
663 663 Add the following at the end of the .ini file::
664 664
665 665 [filter:proxy-prefix]
666 666 use = egg:PasteDeploy#prefix
667 667 prefix = /<someprefix>
668 668
669 669
670 670 then change <someprefix> into your chosen prefix
671 671
672 672 Apache's WSGI config
673 673 --------------------
674 674
675 675 Alternatively, Kallithea can be set up with Apache under mod_wsgi. For
676 676 that, you'll need to:
677 677
678 678 - Install mod_wsgi. If using a Debian-based distro, you can install
679 679 the package libapache2-mod-wsgi::
680 680
681 681 aptitude install libapache2-mod-wsgi
682 682
683 683 - Enable mod_wsgi::
684 684
685 685 a2enmod wsgi
686 686
687 687 - Create a wsgi dispatch script, like the one below. Make sure you
688 688 check the paths correctly point to where you installed Kallithea
689 689 and its Python Virtual Environment.
690 690 - Enable the WSGIScriptAlias directive for the wsgi dispatch script,
691 691 as in the following example. Once again, check the paths are
692 692 correctly specified.
693 693
694 694 Here is a sample excerpt from an Apache Virtual Host configuration file::
695 695
696 696 WSGIDaemonProcess kallithea \
697 697 processes=1 threads=4 \
698 698 python-path=/srv/kallithea/pyenv/lib/python2.7/site-packages
699 699 WSGIScriptAlias / /srv/kallithea/dispatch.wsgi
700 700 WSGIPassAuthorization On
701 701
702 702 Or if using a dispatcher wsgi script with proper virtualenv activation::
703 703
704 704 WSGIDaemonProcess kallithea processes=1 threads=4
705 705 WSGIScriptAlias / /srv/kallithea/dispatch.wsgi
706 706 WSGIPassAuthorization On
707 707
708 708
709 709 .. note::
710 710 When running apache as root, please make sure it doesn't run Kallithea as
711 711 root, for examply by adding: `user=www-data group=www-data` to the configuration.
712 712
713 713 .. note::
714 714 If running Kallithea in multiprocess mode,
715 715 make sure you set `instance_id = \*` in the configuration so each process
716 716 gets it's own cache invalidationkey.
717 717
718 718
719 719 Example wsgi dispatch script::
720 720
721 721 import os
722 722 os.environ["HGENCODING"] = "UTF-8"
723 723 os.environ['PYTHON_EGG_CACHE'] = '/srv/kallithea/.egg-cache'
724 724
725 725 # sometimes it's needed to set the curent dir
726 726 os.chdir('/srv/kallithea/')
727 727
728 728 import site
729 729 site.addsitedir("/srv/kallithea/pyenv/lib/python2.7/site-packages")
730 730
731 731 from paste.deploy import loadapp
732 732 from paste.script.util.logging_config import fileConfig
733 733
734 734 fileConfig('/srv/kallithea/my.ini')
735 735 application = loadapp('config:/srv/kallithea/my.ini')
736 736
737 737 Or using proper virtualenv activation::
738 738
739 739 activate_this = '/srv/kallithea/venv/bin/activate_this.py'
740 740 execfile(activate_this,dict(__file__=activate_this))
741 741
742 742 import os
743 743 os.environ['HOME'] = '/srv/kallithea'
744 744
745 745 ini = '/srv/kallithea/kallithea.ini'
746 746 from paste.script.util.logging_config import fileConfig
747 747 fileConfig(ini)
748 748 from paste.deploy import loadapp
749 749 application = loadapp('config:' + ini)
750 750
751 751
752 752 Other configuration files
753 753 -------------------------
754 754
755 755 Some example init.d scripts can be found in init.d directory: https://kallithea-scm.org/repos/kallithea/files/tip/init.d/
756 756
757 757 .. _virtualenv: http://pypi.python.org/pypi/virtualenv
758 758 .. _python: http://www.python.org/
759 .. _mercurial: http://mercurial.selenic.com/
759 .. _Mercurial: http://mercurial.selenic.com/
760 760 .. _celery: http://celeryproject.org/
761 761 .. _rabbitmq: http://www.rabbitmq.com/
762 762 .. _python-ldap: http://www.python-ldap.org/
763 763 .. _mercurial-server: http://www.lshift.net/mercurial-server.html
764 764 .. _PublishingRepositories: http://mercurial.selenic.com/wiki/PublishingRepositories
General Comments 0
You need to be logged in to leave comments. Login now