Gitolite and Gitlab – How the `www-data` user can checkout

gitgitolite

I have just installed Gitolite and Gitlab and I am very happy with it. Everything works fine so far.
I can create repos, push to them, clone them on other clients on the network. Great!

But now I wanted to do some post-receive hooks.
I.e. when I push to some repo, this repo should be checked out on the server in the /var/www/repos directory.

I did this with Gitlabs Deploy Hooks and this Endpoint-Script.

The problem is that the scripts are run under the user "www-data" which has no access to gitlab/gitolite.

How do I change this?
I need to be able to checkout repos with www-data user and using git@server/repo.git syntax.

Best Answer

You don't need to use ssh for his. If you add the www-data user to the gitolite group your webserver should be able to read the repositories from the filesystem.

Related Solutions

Linux – correct file permissions for trac and git user to access gitolite server repos

The most secure way of doing it I would say is to have a group called git-readers

add git and www-data to it, then have the following folder structure:

/home/git - git:git-readers u=rwx,g=rx,o=
/home/git/repositories - git:git u=rwx,g=rwx,o=rx

This will allow www-data into the folder for reading, but only give the git user write access. Any other user can't do anything.

If you want to add additional writers, I would add another group git-writers and add the users and git to it as well as the git-readers group, then use the following structure:

/home/git - git:git-readers u=rwx,g=rx,o=
/home/git/repositories - git:git-writers u=rwx,g=rwxs,o=rx

Note the 's' in the group permissions. This makes the writer users use git-writers group as their default group. This will only work properly if the writers are all umask 0002.

Allow User ‘git’ to run ‘git pull’ as ‘www-data’ via sudo

You need to use full path name for 'git' command, following lines doesn't produce syntax error in visudo and works fine.

git ALL = (www-data) /usr/bin/git pull

Best Answer

Related Solutions

Linux – correct file permissions for trac and git user to access gitolite server repos

Allow User ‘git’ to run ‘git pull’ as ‘www-data’ via sudo

Related Topic