Freebsd – How to adjust subversion repository file permissions automatically for use w. Apache/DAV

apache-2.2freebsdsvnwebdav

I've set-up a subversion server accessible with Apache/DAV and after screwing up the repositories file permissions a couple of days ago I started wondering if there's a better way to do this than the way I'm doing it.

The repositories are owned by a dedicated user and group, and apache runs as the customary www:www user, hence it has no write permissions to the repositories. So far my solution has been to add the www user to the svn group and make sure that the files inside the repositories are group-writable… but six months from now I'll create a new repository, forget to fix file permissions and get some email as soon as someone tries to commit something.

Is there any other way to do that? Maybe force svnadmin to create repositories group-writable in the first place? (In case you're wondering the server is FreeBSD 6.2)

Best Answer

When you access the repository with Apache, the user Apache runs as must have write permission. So, the simplest solution is to give the repository to this user.

Here is how it looks on my Debian machine where Apache runs as www-data:

    % ls -ald /home/Subversion-Repository 
    drwxr-xr-x 7 www-data www-data 4096 Nov 14 10:02 /home/Subversion-Repository

This is only a problem if you want the same repository to be accessible via Apache/DAV and via another mean. But this practice is discouraged. I quote:

Fortunately, most repository administrators will never need to have such a complex configuration. Users who wish to access repositories that live on the same machine are not limited to using file:// access URLs—they can typically contact the Apache HTTP server or svnserve using localhost for the server name in their http:// or svn:// URL. And maintaining multiple server processes for your Subversion repositories is likely to be more of a headache than necessary. We recommend that you choose a single server that best meets your needs and stick with it!

Related Solutions

Svn – How to configure Apache to redirect a subdirectory to a subversion repo

Short answer: Use the PT flag on your RewriteRule.

First, a little Apache backstory. When Apache receives a request, it goes though a process of mapping that request to the local storage. After that, Apache actually has two pieces of data on what you requested. The request url, and the file path. So a request for /svn/blah is translated into /var/www/vhosts/myserver.com/html/svn/blah and that path is stored separately. mod_rewrite lets you tweak this behavior to route urls where you want.

Now, the two RewriteRules you have there are implicitly doing different things.

The first one you have there is a rewrite. It takes a url like /svn/blah and instead of using the behavior above, it maps it as if you actually requested /svn/myrepo/blah, so the resulting filepath would be /var/www/vhosts/myserver.com/html/svn/myrepo/blah. However, and here's the sticking point, it does not modify the requested url. The request url is still /svn/blah, apache just now thinks that file is to be found at .../svn/myrepo/blah rather than .../svn/blah.

Why does this matter you ask? Because the subversion module doesn't use the filepath. It looks at the request url. So apache and mod_rewrite just wasted time doing all that, because mod_dav_svn just ignores it. What you need is for mod_rewrite to change the request url. And that's what PT does. It modifies both the request url and the file path, so later when it gets to mod_dav_svn, it will see the changed url.
The second one is a redirect. Since the substitution starts with http:// and apache doesn't have a virtualhost named 192.168.0.1, it assumes you actually meant to put an R in your flags, since it can't translate that into a filepath. That is sending back a "Hey, it's over here" message to the subversion client, and it's making another request for it.

Now, having said all that, you're never going to have more than one repository on there anyway with this setup unless you do something to force mod_rewrite to skip the urls of the other repositories. mod_rewrite will cheerfully change /svn/bignewproject/blah into /svn/myrepo/bignewproject/blah for you every time. You could add a rule before the RewriteRule you have such as:

RewriteRule ^/svn/(myrepo|myotherrepo|coolproject|stuff|etc)/ - [S=1]

That will cause it to skip the next rule. However, you're going to be updating it by hand from here on out. You might be able to pull off something automated with some RewriteCond magic, but it'll probably be tricky. I'm not really familiar with that, so someone else would have to help you out there.

If this is only used by a small group of people, then you might be better off skipping this rewriting stuff entirely and just update everyone's working copies. svn switch --relocate is meant specifically for situations where the repos is moved and you just want to update your working copy without checking it out again. I understand there are situations where this simply isn't feasible though.

Linux – Trac + SVN: Why post commit hook doesn’t work

I assume the problem is permission-related. Make sure both the post-commit script and the rac-post-commit-hook have the proper privileges. If it works for you using the command line, try to do it as the user that is running the svn daemon (sudo -u svnuser [cmd]).

I could fix a similar problem a year or so ago by adding "chmod o+x" both of the scripts.

Best Answer

Related Solutions

Svn – How to configure Apache to redirect a subdirectory to a subversion repo

Linux – Trac + SVN: Why post commit hook doesn’t work

Related Topic