master TOC | chapter TOC | support

Hosting git repositories

Gitolite allows you to setup git hosting on a central server, with fine-grained access control and many (many!) more powerful features.

quick install

If you're comfortable with Unix and ssh, and you have a relatively sane setup, the following steps should work:

• create a user called git. Login to this user.
• copy your ssh pubkey from your workstation. Rename it to YourName.pub.

• now run these commands:

  git clone git://github.com/sitaramc/gitolite
  gitolite/src/gl-system-install
  gl-setup -q ~/YourName.pub
  

You're done. If it didn't work, well that's what the install doc is for, especially the if you run into trouble section.

WARNING: do NOT add repos or users directly on the server! You MUST manage the server by cloning the special 'gitolite-admin' repo on your workstation (git clone git@server:gitolite-admin), making changes, and pushing them. Here's how to add users and repos.

what to read...

Gitolite comes with a lot of documentation. The master TOC (see link above) is the only comprehensive list of what is there, but here's an overview.

• understanding gitolite

  • what is gitolite, and the rest of this document
  • gitolite install and basic admin in pictures
  • gitolite and ssh

• explaining gitolite to your users

  • the user document is all they need

• install and setup

  • the "install trouble?" section, which links, among other things, to arguably the most useful doc for a newbie: ssh troubleshooting!
  • maybe even the complete install document

• normal admin tasks done on the server

  • adding users and repos
  • admin: add your own hooks, add existing repos into gitolite, etc.
  • rc: sett gitolite behaviour options (warning: some of the variables have a security impact if you're careless)

• normal admin tasks done by changing gitolite.conf

  • basic access control
  • advanced access control
  • extras: personal branches, gitweb/git-daemon access, git config settings
  • gitolite.conf by example may also help

• advanced use (experts only; you can shoot yourself in the foot nicely!)

  • ADCs: allow users to run specific shell commands (but not give them a shell)
  • (also, sample ADCs that come with gitolite)
  • let users create their own repos and assign permissions
  • delegate admin rights
  • mirror your servers

• special installation scenarios:

  • use smart-http instead of ssh
  • migrate from gitosis

Finally, tips has a lot of useful information.

what is gitolite?

Gitolite is an access control layer on top of git. Here's an "executive summary":

• use a single unix user ("real" user) on the server
• provide access to many gitolite users
  • they are not "real" users
  • they do not get shell access
• control access to many git repositories
  • read access controlled at the repo level
  • write access controlled at the branch/tag/file/directory level, including who can rewind, create, and delete branches/tags
• can be installed without root access, assuming git and perl are already installed
• authentication is most commonly done using sshd, but you can also use httpd if you prefer (this may require root access).
• several other neat features, too many to list here

why is gitolite needed?: Link

why did I write it?

The most important feature I needed was per-branch permissions. This is pretty much mandatory in a corporate environment, and is almost the single reason I started thinking about writing gitolite.

It's not just "read-only" versus "read-write". Rewinding a branch (aka "non fast forward push") is potentially dangerous, but sometimes needed. So is deleting a branch (which is really just an extreme form of rewind). I needed something in between allowing anyone to do it (the default) and disabling it completely (receive.denyNonFastForwards or receive.denyDeletes).

some more features: Link

security

Due to the environment in which this was created and the need it fills, I consider this a "security" program, albeit a very modest one.

The first person to find a hole that allows a non-admin user to push a change to a repository that he is not allowed to, will get a modest reward of 5000 INR. The hole should not require enabling any of the options listed as having a security impact in the rc file, nor obvious things like setting the umask too loose, etc.

contact and license

Gitolite is released under GPL v2. See COPYING for details.

• author: sitaramc@gmail.com, sitaram@atc.tcs.com
• mailing list: gitolite@googlegroups.com
• list subscribe address : gitolite+subscribe@googlegroups.com
• IRC: #git and #gitolite on freenode. Note that I live in India (UTC+0530 time zone).