Update Debian release information
[cacert-infradocs.git] / docs / systems / git.rst
1 .. index::
2 single: Systems; Git
3
4 ===
5 Git
6 ===
7
8 Purpose
9 =======
10
11 `Git`_ server for the :wiki:`Software` development and :wiki:`System
12 Administration <SystemAdministration/Team>` teams.
13
14 .. _Git: https://www.git-scm.com/
15
16 Application Links
17 -----------------
18
19 Gitweb
20 http://git.cacert.org/gitweb/
21
22 Administration
23 ==============
24
25 System Administration
26 ---------------------
27
28 * Primary: :ref:`people_jandd`
29 * Secondary: None
30
31 .. todo:: find an additional admin
32
33 Application Administration
34 --------------------------
35
36 +-------------+---------------------+
37 | Application | Administrator(s) |
38 +=============+=====================+
39 | Git | :ref:`people_jandd` |
40 +-------------+---------------------+
41 | Gitweb | :ref:`people_jandd` |
42 +-------------+---------------------+
43
44 Contact
45 -------
46
47 * git-admin@cacert.org
48
49 Additional People
50 -----------------
51
52 :ref:`people_mario`, :ref:`people_benbe` and :ref:`people_neo` have
53 :program:`sudo` access on that machine too.
54
55 Basics
56 ======
57
58 Physical Location
59 -----------------
60
61 This system is located in an :term:`LXC` container on physical machine
62 :doc:`infra02`.
63
64 Logical Location
65 ----------------
66
67 :IP Internet: :ip:v4:`213.154.225.250`
68 :IP Intranet: :ip:v4:`172.16.2.250`
69 :IP Internal: :ip:v4:`10.0.0.250`
70 :MAC address: :mac:`00:ff:2e:b0:4b:1b` (eth0)
71
72 .. seealso::
73
74 See :doc:`../network`
75
76 DNS
77 ---
78
79 .. index::
80 single: DNS records; <machine>
81
82 ===================== ======== ============================================
83 Name Type Content
84 ===================== ======== ============================================
85 git.cacert.org. IN A 213.154.225.250
86 git.cacert.org. IN SSHFP 1 1 23C7622D6DB5822C809152C1C0FD9EA7838F76C6
87 git.cacert.org. IN SSHFP 1 2 DABBE1766C7933071C4E6942A1DFC72C26D9D867D8DEE84BEDA210C8EF9EA2C5
88 git.cacert.org. IN SSHFP 2 1 8509DB491902FE10AB84C8F24B02F10C1ADF0E7F
89 git.cacert.org. IN SSHFP 2 2 00C20C26B6B9A026BBB11B5C45CBEC5D3AB44A039DC0F097CAD88374D3567D01
90 git.cacert.org. IN SSHFP 3 1 60DE5788BD83ABC7F315B667F634BDA5DA8502ED
91 git.cacert.org. IN SSHFP 3 2 132BD98483440124F6B8117148B02A66645477F53C18F974E4DECB32A7495644
92 git.intra.cacert.org. IN A 172.16.2.250
93 ===================== ======== ============================================
94
95 .. seealso::
96
97 See :wiki:`SystemAdministration/Procedures/DNSChanges`
98
99 Operating System
100 ----------------
101
102 .. index::
103 single: Debian GNU/Linux; Jessie
104 single: Debian GNU/Linux; 8.8
105
106 * Debian GNU/Linux 8.8
107
108 Applicable Documentation
109 ------------------------
110
111 This is it :-)
112
113 Services
114 ========
115
116 Listening services
117 ------------------
118
119 +----------+---------+---------+-----------------------------+
120 | Port | Service | Origin | Purpose |
121 +==========+=========+=========+=============================+
122 | 22/tcp | ssh | ANY | admin console access |
123 +----------+---------+---------+-----------------------------+
124 | 25/tcp | smtp | local | mail delivery to local MTA |
125 +----------+---------+---------+-----------------------------+
126 | 80/tcp | http | ANY | application |
127 +----------+---------+---------+-----------------------------+
128 | 443/tcp | https | ANY | application |
129 +----------+---------+---------+-----------------------------+
130 | 5666/tcp | nrpe | monitor | remote monitoring service |
131 +----------+---------+---------+-----------------------------+
132 | 9418/tcp | git | ANY | Git daemon port |
133 +----------+---------+---------+-----------------------------+
134
135 .. todo:: disable insecure git-daemon port and http for git, replace these with
136 https for read access and git+ssh for write access
137
138 Running services
139 ----------------
140
141 .. index::
142 single: Apache httpd
143 single: Postfix
144 single: cron
145 single: nrpe
146 single: openssh
147 single: rsyslog
148 single: git-daemon
149
150 +--------------------+---------------------+----------------------------------------+
151 | Service | Usage | Start mechanism |
152 +====================+=====================+========================================+
153 | openssh server | ssh daemon for | init script :file:`/etc/init.d/ssh` |
154 | | remote | |
155 | | administration | |
156 +--------------------+---------------------+----------------------------------------+
157 | Apache httpd | Webserver for | init script |
158 | | gitweb | :file:`/etc/init.d/apache2` |
159 | | | |
160 +--------------------+---------------------+----------------------------------------+
161 | cron | job scheduler | init script :file:`/etc/init.d/cron` |
162 +--------------------+---------------------+----------------------------------------+
163 | rsyslog | syslog daemon | init script |
164 | | | :file:`/etc/init.d/syslog` |
165 +--------------------+---------------------+----------------------------------------+
166 | Postfix | SMTP server for | init script |
167 | | local mail | :file:`/etc/init.d/postfix` |
168 | | submission | |
169 +--------------------+---------------------+----------------------------------------+
170 | Nagios NRPE server | remote monitoring | init script |
171 | | service queried by | :file:`/etc/init.d/nagios-nrpe-server` |
172 | | :doc:`monitor` | |
173 +--------------------+---------------------+----------------------------------------+
174 | runit | service supervision | :file:`/etc/inittab` entry |
175 | | for git-daemon | |
176 +--------------------+---------------------+----------------------------------------+
177 | git-daemon | Daemon for native | runit service description in |
178 | | Git protocol | :file:`/etc/sv/git-daemon/run` |
179 | | access | |
180 +--------------------+---------------------+----------------------------------------+
181
182 Connected Systems
183 -----------------
184
185 * :doc:`monitor`
186 * :doc:`jenkins` for git repository access
187
188 Outbound network connections
189 ----------------------------
190
191 * DNS (53) resolving nameservers 172.16.2.2 and 172.16.2.3
192 * :doc:`emailout` as SMTP relay
193 * ftp.nl.debian.org as Debian mirror
194 * security.debian.org for Debian security updates
195 * crl.cacert.org (rsync) for getting CRLs
196 * :doc:`jenkins` for triggering web hooks
197
198 Security
199 ========
200
201 .. sshkeys::
202 :RSA: b6:85:16:ad:57:a1:45:3c:33:e5:f1:64:04:0d:7a:ab
203 :DSA: 27:e5:f3:95:b8:4e:73:48:b5:f2:28:8f:32:5a:96:70
204 :ECDSA: b2:f4:80:77:98:95:46:17:7a:9e:7d:73:65:6e:f4:9c
205
206 .. todo:: setup ED25519 host key
207
208 Dedicated user roles
209 --------------------
210
211 +-----------------+----------------------------------------------------+
212 | Group | Purpose |
213 +=================+====================================================+
214 | git-birdshack | access to :wiki:`BirdShack` git repositories |
215 +-----------------+----------------------------------------------------+
216 | softass | Software assessors |
217 +-----------------+----------------------------------------------------+
218 | git-boardvoting | access to board voting git repository |
219 +-----------------+----------------------------------------------------+
220 | git-rccrtauth | access to Roundcube certificate authentication git |
221 | | repository |
222 +-----------------+----------------------------------------------------+
223 | git-infra | access to infrastructure git repositories |
224 +-----------------+----------------------------------------------------+
225
226 .. todo:: think about regulating git access by a proper git repository manager
227 like gitolite
228
229 Non-distribution packages and modifications
230 -------------------------------------------
231
232 Gitweb has been modified to use https for `Gravatar`_ lookups:
233
234 .. code-block:: diff
235
236 --- gitweb.cgi 2014-02-06 14:01:48.696730208 +0000
237 +++ /usr/share/gitweb/gitweb.cgi 2014-02-06 14:03:52.933721422 +0000
238 @@ -2064,7 +2064,7 @@
239 my $email = lc shift;
240 my $size = shift;
241 $avatar_cache{$email} ||=
242 - "http://www.gravatar.com/avatar/" .
243 + "https://secure.gravatar.com/avatar/" .
244 Digest::MD5::md5_hex($email) . "?s=";
245 return $avatar_cache{$email} . $size;
246 }
247
248 .. _Gravatar: http://www.gravatar.com/
249
250
251 Risk assessments on critical packages
252 -------------------------------------
253
254 The package git-daemon-run exposes the git native protocol which is prone to
255 man in the middle attacks that could hand out modified code to users. There are
256 alternatives (ssh, https) and git-daemon support should be disabled.
257
258 Critical Configuration items
259 ============================
260
261 Keys and X.509 certificates
262 ---------------------------
263
264 .. sslcert:: git.cacert.org
265 :altnames: DNS:git.cacert.org
266 :certfile: /etc/ssl/public/git.c.o.chain.crt
267 :keyfile: /etc/ssl/private/git.c.o.key
268 :serial: 11E84D
269 :expiration: Mar 31 20:07:57 18 GMT
270 :sha1fp: B8:F9:FF:4E:F3:F6:45:A9:44:7D:8A:1E:F5:D7:28:24:74:ED:48:46
271 :issuer: CA Cert Signing Authority
272
273 The :file:`/etc/ssl/public/git.c.o.chain.crt` contains the CAcert.org Class 1
274 certificate too.
275
276 .. seealso::
277
278 * :wiki:`SystemAdministration/CertificateList`
279
280 .. index:: Git repositories
281
282 Git repositories
283 ----------------
284
285 .. index::
286 pair: Apache httpd; configuration
287
288 Apache httpd configuration
289 --------------------------
290
291 Apache httpd serves the gitweb interface via http and https. The http
292 VirtualHost redirects all traffic to https. The following changes have been
293 applied to the Debian package's Apache httpd configuration:
294
295 .. literalinclude:: ../configdiff/git/git-apache-config.diff
296 :language: diff
297
298 .. index::
299 pair: Gitweb; configuration
300
301 Gitweb configuration
302 --------------------
303
304 Gitweb is configured in :file:`/etc/gitweb.conf` which has the following
305 changes to the version contained in the distribution package:
306
307 .. literalinclude:: ../configdiff/git/gitweb.conf.diff
308 :language: diff
309
310 .. index::
311 pair: runit; configuration
312 pair: git-daemon; configuration
313
314 git-daemon configuration
315 ------------------------
316
317 The git-daemon is started by runit. The configuration is stored in
318 :file:`/etc/sv/git-daemon/run` and has the following changes to the version
319 contained in the distribution package git-daemon-run:
320
321 .. literalinclude:: ../configdiff/git/git-daemon-run.diff
322 :language: diff
323
324 Tasks
325 =====
326
327 Planned
328 -------
329
330 .. todo:: enable IPv6
331
332 Changes
333 =======
334
335 System Future
336 -------------
337
338 * No plans
339
340 Additional documentation
341 ========================
342
343 Adding a git repository
344 -----------------------
345
346 The git repositories are stored in :file:`/var/cache/git/`. To create a new
347 repository use:
348
349 .. code-block:: shell
350
351 cd /var/cache/git/
352 git init --bare --shared=group <reponame.git>
353 chgrp -R <groupname> <reponame.git>
354
355 The gitweb index is built from all repositories that contain a file
356 :file:`git-daemon-export-ok`. You should also put a description in the
357 repository's :file:`description` file and set the repository owner via:
358
359 .. code-block:: shell
360
361 cd <reponame.git>
362 git config gitweb.owner "Owner information"
363
364 .. seealso::
365
366 * :wiki:`PostfixConfiguration`
367
368 References
369 ----------
370
371 Apache httpd documentation
372 http://httpd.apache.org/docs/2.4/