is the git repository hosting service for the network.

Installation is a standard web service and can be installed through the standard procedure. However, there are several additional steps required.

  • the web service
  • webhook delivery service
  • gitsrht-periodic: various maintenance tasks. Recommended configuration is */20 * * * * gitsrht-periodic
Repository storage

You will need to set up a directory for repositories to be stored in - we suggest /var/lib/git/. Also configure a git user and assign ownership over /var/lib/git/ to this user. The package will automatically prepare these for you. If you do not use the package, you must create the user yourself and ensure that the web application runs as this user.

SSH dispatch

It is necessary to configure's SSH dispatcher as the system-wide SSH authorization hook. First you need to install go, then build the dispatcher with go install in the gitsrht-dispatch repository. The gitsrht-shell helper is also written in Go, run the same process from its directory.

In /etc/ssh/sshd_config, configure gitsrht-dispatch like so:

AuthorizedKeysCommand=/usr/bin/gitsrht-dispatch "%u" "%h" "%t" "%k"
PermitUserEnvironment SRHT_*

sshd will invoke our dispatcher whenever a connection is made to the server to obtain a list of authorized keys for the connecting user. The default behavior is to read the .ssh/authorized_keys file from that user's HOME directory, but the dispatcher can also "dispatch" to other authentication tools for other users. This is used to authorize and perform git operations via the gitsrht-keys and gitsrht-shell. See the [dispatch] section of your configuration for details on how this works and how to configure it for additional services (e.g.

Authorization logs are written to /var/log/gitsrht-dispatch and gitsrht-shell.

HTTP(s) Cloning does not do this for you - you need to wire it up in nginx. Here's an example config:

location = /authorize {
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;

location ~ ^/([^/]+)/([^/]+)/(HEAD|info/refs|objects/info/.*|git-upload-pack).*$ {
    auth_request /authorize;
    root /var/lib/git;
    fastcgi_pass unix:/run/fcgiwrap.sock;
    fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
    fastcgi_param PATH_INFO $uri;
    fastcgi_param GIT_PROJECT_ROOT $document_root;
    fastcgi_param GIT_HTTP_EXPORT_ALL "";
    include fastcgi_params;
    gzip off;

It's important that you set up the /authorize endpoint to enforce the privacy of private repositories.

If you don't have /run/fcgiwrap.sock on your system, you'll need to install the fcgiwrap package (for instance: apt-get install fcgiwrap). On some systems, the script might be /run/fcgiwrap.socket or /run/fcgiwrap/fcgiwrap.sock.

About this wiki

commit dbbd1297d4a4bd8b400e5b6f611e5f29f0c6209d
Author: boringcactus <>
Date:   2020-07-14T14:10:47-06:00

Clarify Alpine dependencies
Clone this wiki (read-only) (read/write)