engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

project: added all source files and assets

Browse source
This commit is contained in:
Marcin Kuzminski 2016-05-24 15:56:53 +02:00
parent a059b651ea
commit 9a0d8c0b77
1365 changed files with 696516 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
.bumpversion.cfg Normal file
View file

@ -0,0 +1,5 @@
[bumpversion]
current_version = 4.0.0
message = release: Bump version {current_version} to {new_version}
[bumpversion:file:rhodecode/VERSION]

18
.coveragerc Normal file
View file

@ -0,0 +1,18 @@
[run]
branch = True
include =
rhodecode/lib/*
rhodecode/model/*
rhodecode/controllers/*
omit =
rhodecode/lib/vcs/remote/*
rhodecode/lib/dbmigrate/*
[report]
exclude_lines =
raise NotImplementedError

38
.jshintrc Normal file
View file

@ -0,0 +1,38 @@
{
/*
* ENVIRONMENTS
* =================
*/
// Define globals exposed by modern browsers.
"browser": true,
// Define globals exposed by jQuery.
"jquery": true,
/*
* ENFORCING OPTIONS
* =================
*/
// Prohibit use of == and != in favor of === and !==.
"eqeqeq": true,
// Enforce tab width of 2 spaces.
"indent": 2,
// Prohibit use of a variable before it is defined.
"latedef": true,
// Enforce line length to 100 characters
"maxlen": 100,
// Require capitalized names for constructor functions.
"newcap": true,
// Enforce placing 'use strict' at the top function scope
"strict": true,
// Prohibit use of explicitly undeclared variables.
"undef": true
}

31
.release.cfg Normal file
View file

@ -0,0 +1,31 @@
[DEFAULT]
done = false
[task:fixes_on_stable]
done = true
[task:changelog_updated]
done = true
[task:nix_dependencies_moved]
done = true
[task:bump_version]
done = true
[task:generate_js_routes]
done = true
[task:generate_api_docs]
done = true
[release]
state = prepared
version = 3.8.3
[task:updated_translation]
[task:updated_trial_license]
[task:generate_oss_licenses]

18
.tx/config Normal file
View file

@ -0,0 +1,18 @@
[main]
host = https://www.transifex.com
[RhodeCode.pot]
source_file = rhodecode/i18n/rhodecode.pot
source_lang = en
type = PO
trans.be = rhodecode/i18n/be/LC_MESSAGES/rhodecode.po
trans.de = rhodecode/i18n/de/LC_MESSAGES/rhodecode.po
trans.es = rhodecode/i18n/es/LC_MESSAGES/rhodecode.po
trans.fr = rhodecode/i18n/fr/LC_MESSAGES/rhodecode.po
trans.it = rhodecode/i18n/it/LC_MESSAGES/rhodecode.po
trans.ja = rhodecode/i18n/ja/LC_MESSAGES/rhodecode.po
trans.pl = rhodecode/i18n/pl/LC_MESSAGES/rhodecode.po
trans.pt = rhodecode/i18n/pt/LC_MESSAGES/rhodecode.po
trans.ru = rhodecode/i18n/ru/LC_MESSAGES/rhodecode.po
trans.zh = rhodecode/i18n/zh/LC_MESSAGES/rhodecode.po

1
CHANGES.rst Normal file
View file

@ -0,0 +1 @@
.. include:: docs/release-notes/release-notes.rst

137
Gruntfile.js Normal file
View file

@ -0,0 +1,137 @@
module.exports = function(grunt) {
grunt.initConfig({
dirs: {
css: "rhodecode/public/css",
js: {
"src": "rhodecode/public/js/src",
"dest": "rhodecode/public/js"
}
},
concat: {
dist: {
src: [
// Base libraries
'<%= dirs.js.src %>/jquery-1.11.1.min.js',
'<%= dirs.js.src %>/logging.js',
'<%= dirs.js.src %>/bootstrap.js',
'<%= dirs.js.src %>/mousetrap.js',
'<%= dirs.js.src %>/moment.js',
'<%= dirs.js.src %>/appenlight-client-0.4.1.min.js',
// Plugins
'<%= dirs.js.src %>/plugins/jquery.pjax.js',
'<%= dirs.js.src %>/plugins/jquery.dataTables.js',
'<%= dirs.js.src %>/plugins/flavoured_checkbox.js',
'<%= dirs.js.src %>/plugins/jquery.auto-grow-input.js',
'<%= dirs.js.src %>/plugins/jquery.autocomplete.js',
'<%= dirs.js.src %>/plugins/jquery.debounce.js',
'<%= dirs.js.src %>/plugins/jquery.timeago.js',
'<%= dirs.js.src %>/plugins/jquery.timeago-extension.js',
// Select2
'<%= dirs.js.src %>/select2/select2.js',
// Code-mirror
'<%= dirs.js.src %>/codemirror/codemirror.js',
'<%= dirs.js.src %>/codemirror/codemirror_loadmode.js',
'<%= dirs.js.src %>/codemirror/codemirror_hint.js',
'<%= dirs.js.src %>/codemirror/codemirror_overlay.js',
'<%= dirs.js.src %>/codemirror/codemirror_placeholder.js',
// TODO: mikhail: this is an exception. Since the code mirror modes
// are loaded "on the fly", we need to keep them in a public folder
'<%= dirs.js.dest %>/mode/meta.js',
'<%= dirs.js.dest %>/mode/meta_ext.js',
'<%= dirs.js.dest %>/rhodecode/i18n/select2/translations.js',
// Rhodecode utilities
'<%= dirs.js.src %>/rhodecode/utils/array.js',
'<%= dirs.js.src %>/rhodecode/utils/string.js',
'<%= dirs.js.src %>/rhodecode/utils/pyroutes.js',
'<%= dirs.js.src %>/rhodecode/utils/ajax.js',
'<%= dirs.js.src %>/rhodecode/utils/autocomplete.js',
'<%= dirs.js.src %>/rhodecode/utils/colorgenerator.js',
'<%= dirs.js.src %>/rhodecode/utils/ie.js',
'<%= dirs.js.src %>/rhodecode/utils/os.js',
// Rhodecode widgets
'<%= dirs.js.src %>/rhodecode/widgets/multiselect.js',
// Rhodecode components
'<%= dirs.js.src %>/rhodecode/pyroutes.js',
'<%= dirs.js.src %>/rhodecode/codemirror.js',
'<%= dirs.js.src %>/rhodecode/comments.js',
'<%= dirs.js.src %>/rhodecode/constants.js',
'<%= dirs.js.src %>/rhodecode/files.js',
'<%= dirs.js.src %>/rhodecode/followers.js',
'<%= dirs.js.src %>/rhodecode/menus.js',
'<%= dirs.js.src %>/rhodecode/notifications.js',
'<%= dirs.js.src %>/rhodecode/permissions.js',
'<%= dirs.js.src %>/rhodecode/pjax.js',
'<%= dirs.js.src %>/rhodecode/pullrequests.js',
'<%= dirs.js.src %>/rhodecode/settings.js',
'<%= dirs.js.src %>/rhodecode/select2_widgets.js',
'<%= dirs.js.src %>/rhodecode/tooltips.js',
'<%= dirs.js.src %>/rhodecode/users.js',
'<%= dirs.js.src %>/rhodecode/appenlight.js',
// Rhodecode main module
'<%= dirs.js.src %>/rhodecode.js'
],
dest: '<%= dirs.js.dest %>/scripts.js',
nonull: true
}
},
less: {
development: {
options: {
compress: false,
yuicompress: false,
optimization: 0
},
files: {
"<%= dirs.css %>/style.css": "<%= dirs.css %>/main.less"
}
},
production: {
options: {
compress: true,
yuicompress: true,
optimization: 2
},
files: {
"<%= dirs.css %>/style.css": "<%= dirs.css %>/main.less"
}
}
},
watch: {
less: {
files: ["<%= dirs.css %>/*.less"],
tasks: ["less:production"]
},
js: {
files: ["<%= dirs.js.src %>/**/*.js"],
tasks: ["concat:dist"]
}
},
jshint: {
rhodecode: {
src: '<%= dirs.js.src %>/rhodecode/**/*.js',
options: {
jshintrc: '.jshintrc'
}
}
}
});
grunt.loadNpmTasks('grunt-contrib-less');
grunt.loadNpmTasks('grunt-contrib-concat');
grunt.loadNpmTasks('grunt-contrib-watch');
grunt.loadNpmTasks('grunt-contrib-jshint');
grunt.registerTask('default', ['less:production', 'concat:dist']);
};

690
LICENSE.txt Normal file
View file

@ -0,0 +1,690 @@
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License, version 3
(only), as published by the Free Software Foundation.
This program incorporates work covered by the following copyright and
permission notice:
Copyright (c) 2014-2016 - packaging
file:
Copyright (c) 2008-2011 - msgpack-python
file:licenses/msgpack_license.txt
Both licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
imitations under the License.
Below is the full text of GNU Affero General Public License, version 3
GNU AFFERO GENERAL PUBLIC LICENSE
Version 3, 19 November 2007
Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU Affero General Public License is a free, copyleft license for
software and other kinds of works, specifically designed to ensure
cooperation with the community in the case of network server software.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
our General Public Licenses are intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
Developers that use our General Public Licenses protect your rights
with two steps: (1) assert copyright on the software, and (2) offer
you this License which gives you legal permission to copy, distribute
and/or modify the software.
A secondary benefit of defending all users' freedom is that
improvements made in alternate versions of the program, if they
receive widespread use, become available for other developers to
incorporate. Many developers of free software are heartened and
encouraged by the resulting cooperation. However, in the case of
software used on network servers, this result may fail to come about.
The GNU General Public License permits making a modified version and
letting the public access it on a server without ever releasing its
source code to the public.
The GNU Affero General Public License is designed specifically to
ensure that, in such cases, the modified source code becomes available
to the community. It requires the operator of a network server to
provide the source code of the modified version running there to the
users of that server. Therefore, public use of a modified version, on
a publicly accessible server, gives the public access to the source
code of the modified version.
An older license, called the Affero General Public License and
published by Affero, was designed to accomplish similar goals. This is
a different license, not a version of the Affero GPL, but Affero has
released a new version of the Affero GPL which permits relicensing under
this license.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU Affero General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Remote Network Interaction; Use with the GNU General Public License.
Notwithstanding any other provision of this License, if you modify the
Program, your modified version must prominently offer all users
interacting with it remotely through a computer network (if your version
supports such interaction) an opportunity to receive the Corresponding
Source of your version by providing access to the Corresponding Source
from a network server at no charge, through some standard or customary
means of facilitating copying of software. This Corresponding Source
shall include the Corresponding Source for any work covered by version 3
of the GNU General Public License that is incorporated pursuant to the
following paragraph.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the work with which it is combined will remain governed by version
3 of the GNU General Public License.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU Affero General Public License from time to time. Such new versions
will be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU Affero General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU Affero General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU Affero General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
Also add information on how to contact you by electronic and paper mail.
If your software can interact with users remotely through a computer
network, you should also make sure that it provides a way for users to
get its source. For example, if your program is a web application, its
interface could display a "Source" link that leads users to an archive
of the code. There are many ways you could offer source, and different
solutions will be better for different programs; see section 13 for the
specific requirements.
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU AGPL, see
<http://www.gnu.org/licenses/>.

48
MANIFEST.in Normal file
View file

@ -0,0 +1,48 @@
# top level files
include test.ini
include MANIFEST.in
include README.rst
include rhodecode/VERSION
# docs
recursive-include docs *
# init.d
recursive-include init.d *
# translations
recursive-include rhodecode/i18n *
# bin stuff
recursive-include rhodecode/bin *
# hook templates
recursive-include rhodecode/config/hook_templates *
# non-python core stuff
recursive-include rhodecode *.cfg
recursive-include rhodecode *.json
recursive-include rhodecode *.ini_tmpl
recursive-include rhodecode *.sh
# images, css
include rhodecode/public/css/*.css
include rhodecode/public/images/*.*
# sound files
include rhodecode/public/sounds/*.mp3
include rhodecode/public/sounds/*.wav
# fonts
recursive-include rhodecode/public/fonts/ProximaNova *
recursive-include rhodecode/public/fonts/RCIcons *
# js
recursive-include rhodecode/public/js *
# templates
recursive-include rhodecode/templates *
# skip any tests files
recursive-exclude rhodecode/tests *

39
Makefile Normal file
View file

@ -0,0 +1,39 @@
WEBPACK=./node_modules/webpack/bin/webpack.js
GRUNT=grunt
NODE_PATH=./node_modules
FLAKE8=flake8 setup.py pytest_pylons/ rhodecode/ --select=E124 --ignore=E711,E712,E510,E121,E122,E126,E127,E128,E501,F401 --max-line-length=100 --exclude=*rhodecode/lib/dbmigrate/*,*rhodecode/tests/*,*rhodecode/lib/vcs/utils/*
CI_PREFIX=enterprise
.PHONY: help clean test test-clean test-lint test-only
help:
@echo "TODO: describe Makefile"
clean: test-clean
find . -type f \( -iname '*.c' -o -iname '*.pyc' -o -iname '*.so' \) -exec rm '{}' ';'
test: test-clean test-lint test-only
test-clean:
rm -rf coverage.xml htmlcov junit.xml pylint.log result
test-lint:
if [ "$$IN_NIX_SHELL" = "1" ]; then \
$(FLAKE8); \
else \
$(FLAKE8) --format=pylint --exit-zero > pylint.log; \
fi
test-only:
PYTHONHASHSEED=random py.test -vv -r xw --cov=rhodecode --cov-report=term-missing --cov-report=html rhodecode/tests/
web-build:
NODE_PATH=$(NODE_PATH) $(GRUNT)
web-test:
@echo "no test for our javascript, yet!"
docs-bootstrap:
(cd docs; nix-build default.nix -o result)
@echo "Please go to docs folder and run make html"

101
README.rst Normal file
View file

@ -0,0 +1,101 @@
=========
RhodeCode
=========
About
-----
``RhodeCode`` is a fast and powerful management tool for Mercurial_ and GIT_
and Subversion_ with a built in push/pull server, full text search,
pull requests and powerfull code-review system. It works on http/https and
has a few unique features like:
- plugable architecture
- advanced permission system with IP restrictions
- rich set of authentication plugins including LDAP,
ActiveDirectory, Atlassian Crowd, Http-Headers, Pam, Token-Auth.
- live code-review chat
- full web based file editing
- unified multi vcs support
- snippets (gist) system
- integration with all 3rd party issue trackers
RhodeCode also provides rich API, and multiple event hooks so it's easy
integrable with existing external systems.
RhodeCode is similar in some respects to gitlab_, github_ or bitbucket_,
however RhodeCode can be run as standalone hosted application on your own server.
RhodeCode can be installed on \*nix or Windows systems.
RhodeCode uses `PEP386 versioning <http://www.python.org/dev/peps/pep-0386/>`_
Installation
------------
Please visit https://docs.rhodecode.com/RhodeCode-Control/tasks/install-cli.html
for more details
Source code
-----------
The latest sources can be obtained from official RhodeCode instance
https://code.rhodecode.com
RhodeCode Features
------------------
Check out all features of RhodeCode at https://rhodecode.com/features
License
-------
``RhodeCode`` is dual-licensed with AGPLv3 and commercial license.
Please see LICENSE.txt file for details.
Getting help
------------
Listed bellow are various support resources that should help.
.. note::
Please try to read the documentation before posting any issues, especially
the **troubleshooting section**
- Official issue tracker `RhodeCode Issue tracker <https://issues.rhodecode.com>`_
- Search our community portal `Community portal <https://community.rhodecode.com>`_
- Join #rhodecode on FreeNode (irc.freenode.net)
or use http://webchat.freenode.net/?channels=rhodecode for web access to irc.
- You can also follow RhodeCode on twitter **@RhodeCode** where we often post
news and other interesting stuff about RhodeCode.
Online documentation
--------------------
Online documentation for the current version of RhodeCode is available at
- http://rhodecode.com/docs
You may also build the documentation for yourself - go into ``docs/`` and run::
nix-build default.nix -o result && make clean html
(You need to have sphinx_ installed to build the documentation. If you don't
have sphinx_ installed you can install it via the command:
``pip install sphinx``)
.. _virtualenv: http://pypi.python.org/pypi/virtualenv
.. _python: http://www.python.org/
.. _sphinx: http://sphinx.pocoo.org/
.. _mercurial: http://mercurial.selenic.com/
.. _bitbucket: http://bitbucket.org/
.. _github: http://github.com/
.. _gitlab: http://gitlab.com/
.. _subversion: http://subversion.tigris.org/
.. _git: http://git-scm.com/
.. _celery: http://celeryproject.org/
.. _vcs: http://pypi.python.org/pypi/vcs

47
acceptance_tests/README.rst Normal file
View file

@ -0,0 +1,47 @@
README - Quickstart
===================
This folder contains functional tests and the automation of specification
examples. Details about testing can be found in
`/docs-internal/testing/index.rst`.
Setting up your Rhodecode Enterprise instance
---------------------------------------------
The tests will create users and repositories as needed, so you can start with a
new and empty instance.
Use the following example call for the database setup of Enterprise::
paster setup-rhodecode \
--user=admin \
--email=admin@example.com \
--password=secret \
--api-key=9999999999999999999999999999999999999999 \
your-enterprise-config.ini
This way the username, password and auth token of the admin user will match the
defaults from the test run.
Usage
-----
1. Make sure your Rhodecode Enterprise instance is running at
http://localhost:5000.
2. Enter `nix-shell` from the acceptance_tests folder::
cd acceptance_tests
nix-shell -I ~/dev
Make sure that `rcpkgs` and `rcnixpkgs` are available on the nix path.
3. Run the tests::
py.test -c example.ini -vs
The parameter ``-vs`` allows you to see debugging output during the test
run. Check ``py.test --help`` and the documentation at http://pytest.org to
learn all details about the test runner.

575
configs/development.ini Normal file
View file

@ -0,0 +1,575 @@
################################################################################
################################################################################
# RhodeCode Enterprise - configuration file #
# Built-in functions and variables #
# The %(here)s variable will be replaced with the parent directory of this file#
# #
################################################################################
[DEFAULT]
debug = true
pdebug = false
################################################################################
## Uncomment and replace with the email address which should receive ##
## any error reports after an application crash ##
## Additionally these settings will be used by the RhodeCode mailing system ##
################################################################################
#email_to = admin@localhost
#error_email_from = paste_error@localhost
#app_email_from = rhodecode-noreply@localhost
#error_message =
#email_prefix = [RhodeCode]
#smtp_server = mail.server.com
#smtp_username =
#smtp_password =
#smtp_port =
#smtp_use_tls = false
#smtp_use_ssl = true
## Specify available auth parameters here (e.g. LOGIN PLAIN CRAM-MD5, etc.)
#smtp_auth =
[server:main]
## COMMON ##
host = 127.0.0.1
port = 5000
##########################
## WAITRESS WSGI SERVER ##
##########################
use = egg:waitress#main
## number of worker threads
threads = 5
## MAX BODY SIZE 100GB
max_request_body_size = 107374182400
## Use poll instead of select, fixes file descriptors limits problems.
## May not work on old windows systems.
asyncore_use_poll = true
##########################
## GUNICORN WSGI SERVER ##
##########################
## run with gunicorn --log-config <inifile.ini> --paste <inifile.ini>
#use = egg:gunicorn#main
## Sets the number of process workers. You must set `instance_id = *`
## when this option is set to more than one worker, recommended
## value is (2 * NUMBER_OF_CPUS + 1), eg 2CPU = 5 workers
## The `instance_id = *` must be set in the [app:main] section below
#workers = 1
## number of threads for each of the worker, must be set to 1 for gevent
## generally recommened to be at 1
#threads = 1
## process name
#proc_name = rhodecode
## type of worker class, one of sync, gevent
## recommended for bigger setup is using of of other than sync one
#worker_class = sync
## max number of requests that worker will handle before being gracefully
## restarted, could prevent memory leaks
#max_requests = 1000
#max_requests_jitter = 30
## ammount of time a worker can spend with handling a request before it
## gets killed and restarted. Set to 6hrs
#timeout = 21600
## prefix middleware for RhodeCode, disables force_https flag.
## allows to set RhodeCode under a prefix in server.
## eg https://server.com/<prefix>. Enable `filter-with =` option below as well.
#[filter:proxy-prefix]
#use = egg:PasteDeploy#prefix
#prefix = /<your-prefix>
[app:main]
use = egg:rhodecode-enterprise-ce
## enable proxy prefix middleware, defined below
#filter-with = proxy-prefix
# During development the we want to have the debug toolbar enabled
pyramid.includes =
pyramid_debugtoolbar
rhodecode.utils.debugtoolbar
rhodecode.lib.middleware.request_wrapper
pyramid.reload_templates = true
debugtoolbar.hosts = 0.0.0.0/0
debugtoolbar.exclude_prefixes =
/css
/fonts
/images
/js
## RHODECODE PLUGINS ##
rhodecode.includes =
rhodecode.api
# api prefix url
rhodecode.api.url = /_admin/api
## END RHODECODE PLUGINS ##
full_stack = true
## Serve static files via RhodeCode, disable to serve them via HTTP server
static_files = true
## Optional Languages
## en(default), be, de, es, fr, it, ja, pl, pt, ru, zh
lang = en
## perform a full repository scan on each server start, this should be
## set to false after first startup, to allow faster server restarts.
startup.import_repos = false
## Uncomment and set this path to use archive download cache.
## Once enabled, generated archives will be cached at this location
## and served from the cache during subsequent requests for the same archive of
## the repository.
#archive_cache_dir = /tmp/tarballcache
## change this to unique ID for security
app_instance_uuid = rc-production
## cut off limit for large diffs (size in bytes)
cut_off_limit_diff = 1024000
cut_off_limit_file = 256000
## use cache version of scm repo everywhere
vcs_full_cache = true
## force https in RhodeCode, fixes https redirects, assumes it's always https
## Normally this is controlled by proper http flags sent from http server
force_https = false
## use Strict-Transport-Security headers
use_htsts = false
## number of commits stats will parse on each iteration
commit_parse_limit = 25
## git rev filter option, --all is the default filter, if you need to
## hide all refs in changelog switch this to --branches --tags
git_rev_filter = --branches --tags
# Set to true if your repos are exposed using the dumb protocol
git_update_server_info = false
## RSS/ATOM feed options
rss_cut_off_limit = 256000
rss_items_per_page = 10
rss_include_diff = false
## gist URL alias, used to create nicer urls for gist. This should be an
## url that does rewrites to _admin/gists/<gistid>.
## example: http://gist.rhodecode.org/{gistid}. Empty means use the internal
## RhodeCode url, ie. http[s]://rhodecode.server/_admin/gists/<gistid>
gist_alias_url =
## List of controllers (using glob pattern syntax) that AUTH TOKENS could be
## used for access.
## Adding ?auth_token = <token> to the url authenticates this request as if it
## came from the the logged in user who own this authentication token.
##
## Syntax is <ControllerClass>:<function_pattern>.
## To enable access to raw_files put `FilesController:raw`.
## To enable access to patches add `ChangesetController:changeset_patch`.
## The list should be "," separated and on a single line.
##
## Recommended controllers to enable:
# ChangesetController:changeset_patch,
# ChangesetController:changeset_raw,
# FilesController:raw,
# FilesController:archivefile,
# GistsController:*,
api_access_controllers_whitelist =
## default encoding used to convert from and to unicode
## can be also a comma separated list of encoding in case of mixed encodings
default_encoding = UTF-8
## instance-id prefix
## a prefix key for this instance used for cache invalidation when running
## multiple instances of rhodecode, make sure it's globally unique for
## all running rhodecode instances. Leave empty if you don't use it
instance_id =
## alternative return HTTP header for failed authentication. Default HTTP
## response is 401 HTTPUnauthorized. Currently HG clients have troubles with
## handling that causing a series of failed authentication calls.
## Set this variable to 403 to return HTTPForbidden, or any other HTTP code
## This will be served instead of default 401 on bad authnetication
auth_ret_code =
## use special detection method when serving auth_ret_code, instead of serving
## ret_code directly, use 401 initially (Which triggers credentials prompt)
## and then serve auth_ret_code to clients
auth_ret_code_detection = false
## locking return code. When repository is locked return this HTTP code. 2XX
## codes don't break the transactions while 4XX codes do
lock_ret_code = 423
## allows to change the repository location in settings page
allow_repo_location_change = true
## allows to setup custom hooks in settings page
allow_custom_hooks_settings = true
## generated license token, goto license page in RhodeCode settings to obtain
## new token
license_token =
## supervisor connection uri, for managing supervisor and logs.
supervisor.uri =
## supervisord group name/id we only want this RC instance to handle
supervisor.group_id = dev
## Display extended labs settings
labs_settings_active = true
####################################
### CELERY CONFIG ####
####################################
use_celery = false
broker.host = localhost
broker.vhost = rabbitmqhost
broker.port = 5672
broker.user = rabbitmq
broker.password = qweqwe
celery.imports = rhodecode.lib.celerylib.tasks
celery.result.backend = amqp
celery.result.dburi = amqp://
celery.result.serialier = json
#celery.send.task.error.emails = true
#celery.amqp.task.result.expires = 18000
celeryd.concurrency = 2
#celeryd.log.file = celeryd.log
celeryd.log.level = debug
celeryd.max.tasks.per.child = 1
## tasks will never be sent to the queue, but executed locally instead.
celery.always.eager = false
####################################
### BEAKER CACHE ####
####################################
# default cache dir for templates. Putting this into a ramdisk
## can boost performance, eg. %(here)s/data_ramdisk
cache_dir = %(here)s/data
## locking and default file storage for Beaker. Putting this into a ramdisk
## can boost performance, eg. %(here)s/data_ramdisk/cache/beaker_data
beaker.cache.data_dir = %(here)s/data/cache/beaker_data
beaker.cache.lock_dir = %(here)s/data/cache/beaker_lock
beaker.cache.regions = super_short_term, short_term, long_term, sql_cache_short, auth_plugins, repo_cache_long
beaker.cache.super_short_term.type = memory
beaker.cache.super_short_term.expire = 10
beaker.cache.super_short_term.key_length = 256
beaker.cache.short_term.type = memory
beaker.cache.short_term.expire = 60
beaker.cache.short_term.key_length = 256
beaker.cache.long_term.type = memory
beaker.cache.long_term.expire = 36000
beaker.cache.long_term.key_length = 256
beaker.cache.sql_cache_short.type = memory
beaker.cache.sql_cache_short.expire = 10
beaker.cache.sql_cache_short.key_length = 256
# default is memory cache, configure only if required
# using multi-node or multi-worker setup
#beaker.cache.auth_plugins.type = ext:database
#beaker.cache.auth_plugins.lock_dir = %(here)s/data/cache/auth_plugin_lock
#beaker.cache.auth_plugins.url = postgresql://postgres:secret@localhost/rhodecode
#beaker.cache.auth_plugins.url = mysql://root:secret@127.0.0.1/rhodecode
#beaker.cache.auth_plugins.sa.pool_recycle = 3600
#beaker.cache.auth_plugins.sa.pool_size = 10
#beaker.cache.auth_plugins.sa.max_overflow = 0
beaker.cache.repo_cache_long.type = memorylru_base
beaker.cache.repo_cache_long.max_items = 4096
beaker.cache.repo_cache_long.expire = 2592000
# default is memorylru_base cache, configure only if required
# using multi-node or multi-worker setup
#beaker.cache.repo_cache_long.type = ext:memcached
#beaker.cache.repo_cache_long.url = localhost:11211
#beaker.cache.repo_cache_long.expire = 1209600
#beaker.cache.repo_cache_long.key_length = 256
####################################
### BEAKER SESSION ####
####################################
## .session.type is type of storage options for the session, current allowed
## types are file, ext:memcached, ext:database, and memory(default).
beaker.session.type = file
beaker.session.data_dir = %(here)s/data/sessions/data
## db based session, fast, and allows easy management over logged in users ##
#beaker.session.type = ext:database
#beaker.session.table_name = db_session
#beaker.session.sa.url = postgresql://postgres:secret@localhost/rhodecode
#beaker.session.sa.url = mysql://root:secret@127.0.0.1/rhodecode
#beaker.session.sa.pool_recycle = 3600
#beaker.session.sa.echo = false
beaker.session.key = rhodecode
beaker.session.secret = develop-rc-uytcxaz
beaker.session.lock_dir = %(here)s/data/sessions/lock
## Secure encrypted cookie. Requires AES and AES python libraries
## you must disable beaker.session.secret to use this
#beaker.session.encrypt_key = <key_for_encryption>
#beaker.session.validate_key = <validation_key>
## sets session as invalid(also logging out user) if it haven not been
## accessed for given amount of time in seconds
beaker.session.timeout = 2592000
beaker.session.httponly = true
#beaker.session.cookie_path = /<your-prefix>
## uncomment for https secure cookie
beaker.session.secure = false
## auto save the session to not to use .save()
beaker.session.auto = false
## default cookie expiration time in seconds, set to `true` to set expire
## at browser close
#beaker.session.cookie_expires = 3600
###################################
## SEARCH INDEXING CONFIGURATION ##
###################################
search.module = rhodecode.lib.index.whoosh
search.location = %(here)s/data/index
###################################
## ERROR AND LOG HANDLING SYSTEM ##
###################################
## Appenlight is tailored to work with RhodeCode, see
## http://appenlight.com for details how to obtain an account
## appenlight integration enabled
appenlight = false
appenlight.server_url = https://api.appenlight.com
appenlight.api_key = YOUR_API_KEY
;appenlight.transport_config = https://api.appenlight.com?threaded=1&timeout=5
# used for JS client
appenlight.api_public_key = YOUR_API_PUBLIC_KEY
## TWEAK AMOUNT OF INFO SENT HERE
## enables 404 error logging (default False)
appenlight.report_404 = false
## time in seconds after request is considered being slow (default 1)
appenlight.slow_request_time = 1
## record slow requests in application
## (needs to be enabled for slow datastore recording and time tracking)
appenlight.slow_requests = true
## enable hooking to application loggers
appenlight.logging = true
## minimum log level for log capture
appenlight.logging.level = WARNING
## send logs only from erroneous/slow requests
## (saves API quota for intensive logging)
appenlight.logging_on_error = false
## list of additonal keywords that should be grabbed from environ object
## can be string with comma separated list of words in lowercase
## (by default client will always send following info:
## 'REMOTE_USER', 'REMOTE_ADDR', 'SERVER_NAME', 'CONTENT_TYPE' + all keys that
## start with HTTP* this list be extended with additional keywords here
appenlight.environ_keys_whitelist =
## list of keywords that should be blanked from request object
## can be string with comma separated list of words in lowercase
## (by default client will always blank keys that contain following words
## 'password', 'passwd', 'pwd', 'auth_tkt', 'secret', 'csrf'
## this list be extended with additional keywords set here
appenlight.request_keys_blacklist =
## list of namespaces that should be ignores when gathering log entries
## can be string with comma separated list of namespaces
## (by default the client ignores own entries: appenlight_client.client)
appenlight.log_namespace_blacklist =
################################################################################
## WARNING: *THE LINE BELOW MUST BE UNCOMMENTED ON A PRODUCTION ENVIRONMENT* ##
## Debug mode will enable the interactive debugging tool, allowing ANYONE to ##
## execute malicious code after an exception is raised. ##
################################################################################
#set debug = false
##############
## STYLING ##
##############
debug_style = true
#########################################################
### DB CONFIGS - EACH DB WILL HAVE IT'S OWN CONFIG ###
#########################################################
sqlalchemy.db1.url = sqlite:///%(here)s/rhodecode.db?timeout=30
#sqlalchemy.db1.url = postgresql://postgres:qweqwe@localhost/rhodecode
#sqlalchemy.db1.url = mysql://root:qweqwe@localhost/rhodecode
# see sqlalchemy docs for other advanced settings
## print the sql statements to output
sqlalchemy.db1.echo = false
## recycle the connections after this ammount of seconds
sqlalchemy.db1.pool_recycle = 3600
sqlalchemy.db1.convert_unicode = true
## the number of connections to keep open inside the connection pool.
## 0 indicates no limit
#sqlalchemy.db1.pool_size = 5
## the number of connections to allow in connection pool "overflow", that is
## connections that can be opened above and beyond the pool_size setting,
## which defaults to five.
#sqlalchemy.db1.max_overflow = 10
##################
### VCS CONFIG ###
##################
vcs.server.enable = true
vcs.server = localhost:9900
# Available protocols: pyro4, http
vcs.server.protocol = pyro4
# available impl:
# vcsserver.scm_app (EE only, for testing),
# rhodecode.lib.middleware.utils.scm_app_http
# pyro4
#vcs.scm_app_implementation = rhodecode.lib.middleware.utils.scm_app_http
vcs.server.log_level = debug
vcs.start_server = true
vcs.backends = hg, git, svn
vcs.connection_timeout = 3600
## Compatibility version when creating SVN repositories. Defaults to newest version when commented out.
## Available options are: pre-1.4-compatible, pre-1.5-compatible, pre-1.6-compatible, pre-1.8-compatible
#vcs.svn.compatible_version = pre-1.8-compatible
################################
### LOGGING CONFIGURATION ####
################################
[loggers]
keys = root, routes, rhodecode, sqlalchemy, beaker, pyro4, templates, whoosh_indexer
[handlers]
keys = console, console_sql
[formatters]
keys = generic, color_formatter, color_formatter_sql
#############
## LOGGERS ##
#############
[logger_root]
level = NOTSET
handlers = console
[logger_routes]
level = DEBUG
handlers =
qualname = routes.middleware
## "level = DEBUG" logs the route matched and routing variables.
propagate = 1
[logger_beaker]
level = DEBUG
handlers =
qualname = beaker.container
propagate = 1
[logger_pyro4]
level = DEBUG
handlers =
qualname = Pyro4
propagate = 1
[logger_templates]
level = INFO
handlers =
qualname = pylons.templating
propagate = 1
[logger_rhodecode]
level = DEBUG
handlers =
qualname = rhodecode
propagate = 1
[logger_sqlalchemy]
level = INFO
handlers = console_sql
qualname = sqlalchemy.engine
propagate = 0
[logger_whoosh_indexer]
level = DEBUG
handlers =
qualname = whoosh_indexer
propagate = 1
##############
## HANDLERS ##
##############
[handler_console]
class = StreamHandler
args = (sys.stderr,)
level = DEBUG
formatter = color_formatter
[handler_console_sql]
class = StreamHandler
args = (sys.stderr,)
level = DEBUG
formatter = color_formatter_sql
################
## FORMATTERS ##
################
[formatter_generic]
class = rhodecode.lib.logging_formatter.Pyro4AwareFormatter
format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
datefmt = %Y-%m-%d %H:%M:%S
[formatter_color_formatter]
class = rhodecode.lib.logging_formatter.ColorFormatter
format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
datefmt = %Y-%m-%d %H:%M:%S
[formatter_color_formatter_sql]
class = rhodecode.lib.logging_formatter.ColorFormatterSql
format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
datefmt = %Y-%m-%d %H:%M:%S

96
configs/gunicorn_config.py Normal file
View file

@ -0,0 +1,96 @@
"""gunicorn config hooks"""
import multiprocessing
import sys
import threading
import traceback
# GLOBAL #
errorlog = '-'
accesslog = '-'
loglevel = 'debug'
# SECURITY #
limit_request_line = 4094
limit_request_fields = 100
limit_request_field_size = 8190
# SERVER MECHANICS #
# None == system temp dir #
worker_tmp_dir = None
tmp_upload_dir = None
#proc_name =
# self adjust workers based on CPU #
#workers = multiprocessing.cpu_count() * 2 + 1
access_log_format = '[%(p)s] %(h)15s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" request_time:%(L)s'
# For the gevent worker classes #
# this limits the maximum number of simultaneous clients that #
# a single process can handle. #
#worker_connections = 10
# Max requests to handle by each worker before restarting it, #
# could prevent memory leaks #
#max_requests = 1000
#max_requests_jitter = 30
# If a worker does not notify the master process in this #
# number of seconds it is killed and a new worker is spawned #
# to replace it. #
#timeout = 3600
access_log_format = (
'[%(p)-10s] %(h)s time:%(L)s %(l)s %(u)s '
'%(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s"')
def post_fork(server, worker):
server.log.info("[<%s>] worker spawned", worker.pid)
def pre_fork(server, worker):
pass
def pre_exec(server):
server.log.info("Forked child, re-executing.")
def when_ready(server):
server.log.info("Server is ready. Spawning workers")
def worker_int(worker):
worker.log.info("[<%-10s>] worker received INT or QUIT signal", worker.pid)
# get traceback info
id2name = dict([(th.ident, th.name) for th in threading.enumerate()])
code = []
for thread_id, stack in sys._current_frames().items():
code.append(
"\n# Thread: %s(%d)" % (id2name.get(thread_id, ""), thread_id))
for fname, lineno, name, line in traceback.extract_stack(stack):
code.append('File: "%s", line %d, in %s' % (fname, lineno, name))
if line:
code.append(" %s" % (line.strip()))
worker.log.debug("\n".join(code))
def worker_abort(worker):
worker.log.info("[<%-10s>] worker received SIGABRT signal", worker.pid)
def pre_request(worker, req):
return
worker.log.debug("[<%-10s>] PRE WORKER: %s %s",
worker.pid, req.method, req.path)
def post_request(worker, req, environ, resp):
return
worker.log.debug("[<%-10s>] POST WORKER: %s %s resp: %s", worker.pid,
req.method, req.path, resp.status_code)

1
configs/init.d/.readme.txt Normal file
View file

@ -0,0 +1 @@
Example init scripts.

61
configs/init.d/supervisord.conf Normal file
View file

@ -0,0 +1,61 @@
; Sample supervisor RhodeCode config file.
;
; For more information on the config file, please see:
; http://supervisord.org/configuration.html
;
; Note: shell expansion ("~" or "$HOME") is not supported. Environment
; variables can be expanded using this syntax: "%(ENV_HOME)s".
[unix_http_server]
file=/tmp/supervisor.sock ; (the path to the socket file)
;chmod=0700 ; socket file mode (default 0700)
;chown=nobody:nogroup ; socket file uid:gid owner
;username=user ; (default is no username (open server))
;password=123 ; (default is no password (open server))
[supervisord]
logfile=/home/ubuntu/rhodecode/supervisord.log ; (main log file;default $CWD/supervisord.log)
logfile_maxbytes=50MB ; (max main logfile bytes b4 rotation;default 50MB)
logfile_backups=10 ; (num of main logfile rotation backups;default 10)
loglevel=info ; (log level;default info; others: debug,warn,trace)
pidfile=/home/ubuntu/rhodecode/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
nodaemon=true ; (start in foreground if true;default false)
minfds=1024 ; (min. avail startup file descriptors;default 1024)
minprocs=200 ; (min. avail process descriptors;default 200)
;umask=022 ; (process file creation umask;default 022)
user=ubuntu ; (default is current user, required if root)
;identifier=supervisor ; (supervisord identifier, default is 'supervisor')
;directory=/tmp ; (default is not to cd during start)
;nocleanup=true ; (don't clean up tempfiles at start;default false)
;childlogdir=/tmp ; ('AUTO' child log dir, default $TEMP)
environment=HOME=/home/ubuntu,LANG=en_US.UTF-8 ; (key value pairs to add to environment)
;strip_ansi=false ; (strip ansi escape codes in logs; def. false)
; the below section must remain in the config file for RPC
; (supervisorctl/web interface) to work, additional interfaces may be
; added by defining them in separate rpcinterface: sections
[rpcinterface:supervisor]
supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
[supervisorctl]
serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL for a unix socket
;username=chris ; should be same as http_username if set
;password=123 ; should be same as http_password if set
; restart with supervisorctl restart rhodecode:*
[program:rhodecode]
numprocs = 1
numprocs_start = 5000
directory=/home/ubuntu/rhodecode/source
command = /home/ubuntu/rhodecode/venv/bin/paster serve /home/ubuntu/rhodecode/source/prod.ini
process_name = %(program_name)s_%(process_num)04d
redirect_stderr=true
stdout_logfile=/home/ubuntu/rhodecode/rhodecode.log
[program:rhodecode_workers]
numproces = 1
directory = /home/ubuntu/rhodecode/source
command = /home/ubuntu/rhodecode/venv/bin/paster celeryd /home/ubuntu/rhodecode/source/prod.ini --autoscale=10,2
redirect_stderr=true
stdout_logfile=/%(here)s/rhodecode_workers.log

541
configs/production.ini Normal file
View file

@ -0,0 +1,541 @@
################################################################################
################################################################################
# RhodeCode Enterprise - configuration file #
# Built-in functions and variables #
# The %(here)s variable will be replaced with the parent directory of this file#
# #
################################################################################
[DEFAULT]
debug = true
pdebug = false
################################################################################
## Uncomment and replace with the email address which should receive ##
## any error reports after an application crash ##
## Additionally these settings will be used by the RhodeCode mailing system ##
################################################################################
#email_to = admin@localhost
#error_email_from = paste_error@localhost
#app_email_from = rhodecode-noreply@localhost
#error_message =
#email_prefix = [RhodeCode]
#smtp_server = mail.server.com
#smtp_username =
#smtp_password =
#smtp_port =
#smtp_use_tls = false
#smtp_use_ssl = true
## Specify available auth parameters here (e.g. LOGIN PLAIN CRAM-MD5, etc.)
#smtp_auth =
[server:main]
## COMMON ##
host = 127.0.0.1
port = 5000
##########################
## WAITRESS WSGI SERVER ##
##########################
use = egg:waitress#main
## number of worker threads
threads = 5
## MAX BODY SIZE 100GB
max_request_body_size = 107374182400
## Use poll instead of select, fixes file descriptors limits problems.
## May not work on old windows systems.
asyncore_use_poll = true
##########################
## GUNICORN WSGI SERVER ##
##########################
## run with gunicorn --log-config <inifile.ini> --paste <inifile.ini>
#use = egg:gunicorn#main
## Sets the number of process workers. You must set `instance_id = *`
## when this option is set to more than one worker, recommended
## value is (2 * NUMBER_OF_CPUS + 1), eg 2CPU = 5 workers
## The `instance_id = *` must be set in the [app:main] section below
#workers = 1
## number of threads for each of the worker, must be set to 1 for gevent
## generally recommened to be at 1
#threads = 1
## process name
#proc_name = rhodecode
## type of worker class, one of sync, gevent
## recommended for bigger setup is using of of other than sync one
#worker_class = sync
## max number of requests that worker will handle before being gracefully
## restarted, could prevent memory leaks
#max_requests = 1000
#max_requests_jitter = 30
## ammount of time a worker can spend with handling a request before it
## gets killed and restarted. Set to 6hrs
#timeout = 21600
## prefix middleware for RhodeCode, disables force_https flag.
## allows to set RhodeCode under a prefix in server.
## eg https://server.com/<prefix>. Enable `filter-with =` option below as well.
#[filter:proxy-prefix]
#use = egg:PasteDeploy#prefix
#prefix = /<your-prefix>
[app:main]
use = egg:rhodecode-enterprise-ce
## enable proxy prefix middleware, defined below
#filter-with = proxy-prefix
full_stack = true
## Serve static files via RhodeCode, disable to serve them via HTTP server
static_files = true
## Optional Languages
## en(default), be, de, es, fr, it, ja, pl, pt, ru, zh
lang = en
## perform a full repository scan on each server start, this should be
## set to false after first startup, to allow faster server restarts.
startup.import_repos = false
## Uncomment and set this path to use archive download cache.
## Once enabled, generated archives will be cached at this location
## and served from the cache during subsequent requests for the same archive of
## the repository.
#archive_cache_dir = /tmp/tarballcache
## change this to unique ID for security
app_instance_uuid = rc-production
## cut off limit for large diffs (size in bytes)
cut_off_limit_diff = 1024000
cut_off_limit_file = 256000
## use cache version of scm repo everywhere
vcs_full_cache = true
## force https in RhodeCode, fixes https redirects, assumes it's always https
## Normally this is controlled by proper http flags sent from http server
force_https = false
## use Strict-Transport-Security headers
use_htsts = false
## number of commits stats will parse on each iteration
commit_parse_limit = 25
## git rev filter option, --all is the default filter, if you need to
## hide all refs in changelog switch this to --branches --tags
git_rev_filter = --branches --tags
# Set to true if your repos are exposed using the dumb protocol
git_update_server_info = false
## RSS/ATOM feed options
rss_cut_off_limit = 256000
rss_items_per_page = 10
rss_include_diff = false
## gist URL alias, used to create nicer urls for gist. This should be an
## url that does rewrites to _admin/gists/<gistid>.
## example: http://gist.rhodecode.org/{gistid}. Empty means use the internal
## RhodeCode url, ie. http[s]://rhodecode.server/_admin/gists/<gistid>
gist_alias_url =
## List of controllers (using glob pattern syntax) that AUTH TOKENS could be
## used for access.
## Adding ?auth_token = <token> to the url authenticates this request as if it
## came from the the logged in user who own this authentication token.
##
## Syntax is <ControllerClass>:<function_pattern>.
## To enable access to raw_files put `FilesController:raw`.
## To enable access to patches add `ChangesetController:changeset_patch`.
## The list should be "," separated and on a single line.
##
## Recommended controllers to enable:
# ChangesetController:changeset_patch,
# ChangesetController:changeset_raw,
# FilesController:raw,
# FilesController:archivefile,
# GistsController:*,
api_access_controllers_whitelist =
## default encoding used to convert from and to unicode
## can be also a comma separated list of encoding in case of mixed encodings
default_encoding = UTF-8
## instance-id prefix
## a prefix key for this instance used for cache invalidation when running
## multiple instances of rhodecode, make sure it's globally unique for
## all running rhodecode instances. Leave empty if you don't use it
instance_id =
## alternative return HTTP header for failed authentication. Default HTTP
## response is 401 HTTPUnauthorized. Currently HG clients have troubles with
## handling that causing a series of failed authentication calls.
## Set this variable to 403 to return HTTPForbidden, or any other HTTP code
## This will be served instead of default 401 on bad authnetication
auth_ret_code =
## use special detection method when serving auth_ret_code, instead of serving
## ret_code directly, use 401 initially (Which triggers credentials prompt)
## and then serve auth_ret_code to clients
auth_ret_code_detection = false
## locking return code. When repository is locked return this HTTP code. 2XX
## codes don't break the transactions while 4XX codes do
lock_ret_code = 423
## allows to change the repository location in settings page
allow_repo_location_change = true
## allows to setup custom hooks in settings page
allow_custom_hooks_settings = true
## generated license token, goto license page in RhodeCode settings to obtain
## new token
license_token =
## supervisor connection uri, for managing supervisor and logs.
supervisor.uri =
## supervisord group name/id we only want this RC instance to handle
supervisor.group_id = prod
## Display extended labs settings
labs_settings_active = true
####################################
### CELERY CONFIG ####
####################################
use_celery = false
broker.host = localhost
broker.vhost = rabbitmqhost
broker.port = 5672
broker.user = rabbitmq
broker.password = qweqwe
celery.imports = rhodecode.lib.celerylib.tasks
celery.result.backend = amqp
celery.result.dburi = amqp://
celery.result.serialier = json
#celery.send.task.error.emails = true
#celery.amqp.task.result.expires = 18000
celeryd.concurrency = 2
#celeryd.log.file = celeryd.log
celeryd.log.level = debug
celeryd.max.tasks.per.child = 1
## tasks will never be sent to the queue, but executed locally instead.
celery.always.eager = false
####################################
### BEAKER CACHE ####
####################################
# default cache dir for templates. Putting this into a ramdisk
## can boost performance, eg. %(here)s/data_ramdisk
cache_dir = %(here)s/data
## locking and default file storage for Beaker. Putting this into a ramdisk
## can boost performance, eg. %(here)s/data_ramdisk/cache/beaker_data
beaker.cache.data_dir = %(here)s/data/cache/beaker_data
beaker.cache.lock_dir = %(here)s/data/cache/beaker_lock
beaker.cache.regions = super_short_term, short_term, long_term, sql_cache_short, auth_plugins, repo_cache_long
beaker.cache.super_short_term.type = memory
beaker.cache.super_short_term.expire = 10
beaker.cache.super_short_term.key_length = 256
beaker.cache.short_term.type = memory
beaker.cache.short_term.expire = 60
beaker.cache.short_term.key_length = 256
beaker.cache.long_term.type = memory
beaker.cache.long_term.expire = 36000
beaker.cache.long_term.key_length = 256
beaker.cache.sql_cache_short.type = memory
beaker.cache.sql_cache_short.expire = 10
beaker.cache.sql_cache_short.key_length = 256
# default is memory cache, configure only if required
# using multi-node or multi-worker setup
#beaker.cache.auth_plugins.type = ext:database
#beaker.cache.auth_plugins.lock_dir = %(here)s/data/cache/auth_plugin_lock
#beaker.cache.auth_plugins.url = postgresql://postgres:secret@localhost/rhodecode
#beaker.cache.auth_plugins.url = mysql://root:secret@127.0.0.1/rhodecode
#beaker.cache.auth_plugins.sa.pool_recycle = 3600
#beaker.cache.auth_plugins.sa.pool_size = 10
#beaker.cache.auth_plugins.sa.max_overflow = 0
beaker.cache.repo_cache_long.type = memorylru_base
beaker.cache.repo_cache_long.max_items = 4096
beaker.cache.repo_cache_long.expire = 2592000
# default is memorylru_base cache, configure only if required
# using multi-node or multi-worker setup
#beaker.cache.repo_cache_long.type = ext:memcached
#beaker.cache.repo_cache_long.url = localhost:11211
#beaker.cache.repo_cache_long.expire = 1209600
#beaker.cache.repo_cache_long.key_length = 256
####################################
### BEAKER SESSION ####
####################################
## .session.type is type of storage options for the session, current allowed
## types are file(default), ext:memcached, ext:database, and memory.
#beaker.session.type = file
## db based session, fast, and allows easy management over logged in users ##
#beaker.session.type = ext:database
#beaker.session.lock_dir = %(here)s/data/cache/session_db_lock
#beaker.session.table_name = db_session
#beaker.session.sa.url = postgresql://postgres:secret@localhost/rhodecode
#beaker.session.sa.url = mysql://root:secret@127.0.0.1/rhodecode
#beaker.session.sa.pool_recycle = 3600
#beaker.session.sa.echo = false
beaker.session.key = rhodecode
beaker.session.secret = production-rc-uytcxaz
## Secure encrypted cookie. Requires AES and AES python libraries
## you must disable beaker.session.secret to use this
#beaker.session.encrypt_key = <key_for_encryption>
#beaker.session.validate_key = <validation_key>
## sets session as invalid(also logging out user) if it haven not been
## accessed for given amount of time in seconds
beaker.session.timeout = 2592000
beaker.session.httponly = true
#beaker.session.cookie_path = /<your-prefix>
## uncomment for https secure cookie
beaker.session.secure = false
## auto save the session to not to use .save()
beaker.session.auto = false
## default cookie expiration time in seconds, set to `true` to set expire
## at browser close
#beaker.session.cookie_expires = 3600
###################################
## SEARCH INDEXING CONFIGURATION ##
###################################
search.module = rhodecode.lib.index.whoosh
search.location = %(here)s/data/index
###################################
## ERROR AND LOG HANDLING SYSTEM ##
###################################
## Appenlight is tailored to work with RhodeCode, see
## http://appenlight.com for details how to obtain an account
## appenlight integration enabled
appenlight = false
appenlight.server_url = https://api.appenlight.com
appenlight.api_key = YOUR_API_KEY
;appenlight.transport_config = https://api.appenlight.com?threaded=1&timeout=5
# used for JS client
appenlight.api_public_key = YOUR_API_PUBLIC_KEY
## TWEAK AMOUNT OF INFO SENT HERE
## enables 404 error logging (default False)
appenlight.report_404 = false
## time in seconds after request is considered being slow (default 1)
appenlight.slow_request_time = 1
## record slow requests in application
## (needs to be enabled for slow datastore recording and time tracking)
appenlight.slow_requests = true
## enable hooking to application loggers
appenlight.logging = true
## minimum log level for log capture
appenlight.logging.level = WARNING
## send logs only from erroneous/slow requests
## (saves API quota for intensive logging)
appenlight.logging_on_error = false
## list of additonal keywords that should be grabbed from environ object
## can be string with comma separated list of words in lowercase
## (by default client will always send following info:
## 'REMOTE_USER', 'REMOTE_ADDR', 'SERVER_NAME', 'CONTENT_TYPE' + all keys that
## start with HTTP* this list be extended with additional keywords here
appenlight.environ_keys_whitelist =
## list of keywords that should be blanked from request object
## can be string with comma separated list of words in lowercase
## (by default client will always blank keys that contain following words
## 'password', 'passwd', 'pwd', 'auth_tkt', 'secret', 'csrf'
## this list be extended with additional keywords set here
appenlight.request_keys_blacklist =
## list of namespaces that should be ignores when gathering log entries
## can be string with comma separated list of namespaces
## (by default the client ignores own entries: appenlight_client.client)
appenlight.log_namespace_blacklist =
################################################################################
## WARNING: *THE LINE BELOW MUST BE UNCOMMENTED ON A PRODUCTION ENVIRONMENT* ##
## Debug mode will enable the interactive debugging tool, allowing ANYONE to ##
## execute malicious code after an exception is raised. ##
################################################################################
set debug = false
##############
## STYLING ##
##############
debug_style = false
#########################################################
### DB CONFIGS - EACH DB WILL HAVE IT'S OWN CONFIG ###
#########################################################
#sqlalchemy.db1.url = sqlite:///%(here)s/rhodecode.db?timeout=30
sqlalchemy.db1.url = postgresql://postgres:qweqwe@localhost/rhodecode
#sqlalchemy.db1.url = mysql://root:qweqwe@localhost/rhodecode
# see sqlalchemy docs for other advanced settings
## print the sql statements to output
sqlalchemy.db1.echo = false
## recycle the connections after this ammount of seconds
sqlalchemy.db1.pool_recycle = 3600
sqlalchemy.db1.convert_unicode = true
## the number of connections to keep open inside the connection pool.
## 0 indicates no limit
#sqlalchemy.db1.pool_size = 5
## the number of connections to allow in connection pool "overflow", that is
## connections that can be opened above and beyond the pool_size setting,
## which defaults to five.
#sqlalchemy.db1.max_overflow = 10
##################
### VCS CONFIG ###
##################
vcs.server.enable = true
vcs.server = localhost:9900
# Available protocols: pyro4, http
vcs.server.protocol = pyro4
vcs.server.log_level = info
vcs.start_server = false
vcs.backends = hg, git, svn
vcs.connection_timeout = 3600
## Compatibility version when creating SVN repositories. Defaults to newest version when commented out.
## Available options are: pre-1.4-compatible, pre-1.5-compatible, pre-1.6-compatible, pre-1.8-compatible
#vcs.svn.compatible_version = pre-1.8-compatible
################################
### LOGGING CONFIGURATION ####
################################
[loggers]
keys = root, routes, rhodecode, sqlalchemy, beaker, pyro4, templates, whoosh_indexer
[handlers]
keys = console, console_sql
[formatters]
keys = generic, color_formatter, color_formatter_sql
#############
## LOGGERS ##
#############
[logger_root]
level = NOTSET
handlers = console
[logger_routes]
level = DEBUG
handlers =
qualname = routes.middleware
## "level = DEBUG" logs the route matched and routing variables.
propagate = 1
[logger_beaker]
level = DEBUG
handlers =
qualname = beaker.container
propagate = 1
[logger_pyro4]
level = DEBUG
handlers =
qualname = Pyro4
propagate = 1
[logger_templates]
level = INFO
handlers =
qualname = pylons.templating
propagate = 1
[logger_rhodecode]
level = DEBUG
handlers =
qualname = rhodecode
propagate = 1
[logger_sqlalchemy]
level = INFO
handlers = console_sql
qualname = sqlalchemy.engine
propagate = 0
[logger_whoosh_indexer]
level = DEBUG
handlers =
qualname = whoosh_indexer
propagate = 1
##############
## HANDLERS ##
##############
[handler_console]
class = StreamHandler
args = (sys.stderr,)
level = INFO
formatter = generic
[handler_console_sql]
class = StreamHandler
args = (sys.stderr,)
level = WARN
formatter = generic
################
## FORMATTERS ##
################
[formatter_generic]
class = rhodecode.lib.logging_formatter.Pyro4AwareFormatter
format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
datefmt = %Y-%m-%d %H:%M:%S
[formatter_color_formatter]
class = rhodecode.lib.logging_formatter.ColorFormatter
format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
datefmt = %Y-%m-%d %H:%M:%S
[formatter_color_formatter_sql]
class = rhodecode.lib.logging_formatter.ColorFormatterSql
format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
datefmt = %Y-%m-%d %H:%M:%S

6
configs/rcchannelstream.ini Normal file
View file

@ -0,0 +1,6 @@
[channelstream]
admin_secret = secret
secret = secret
port = 9800
demo = false
allow_posting_from = 127.0.0.1

215
default.nix Normal file
View file

@ -0,0 +1,215 @@
# Nix environment for the community edition
#
# This shall be as lean as possible, just producing the Enterprise
# derivation. For advanced tweaks to pimp up the development environment we use
# "shell.nix" so that it does not have to clutter this file.
{ pkgs ? (import <nixpkgs> {})
, pythonPackages ? "python27Packages"
, pythonExternalOverrides ? self: super: {}
, doCheck ? true
}:
let pkgs_ = pkgs; in
let
pkgs = pkgs_.overridePackages (self: super: {
# Override subversion derivation to
# - activate python bindings
# - set version to 1.8
subversion = super.subversion18.override {
httpSupport = true;
pythonBindings = true;
python = self.python27Packages.python;
};
});
inherit (pkgs.lib) fix extends;
basePythonPackages = with builtins; if isAttrs pythonPackages
then pythonPackages
else getAttr pythonPackages pkgs;
elem = builtins.elem;
basename = path: with pkgs.lib; last (splitString "/" path);
startsWith = prefix: full: let
actualPrefix = builtins.substring 0 (builtins.stringLength prefix) full;
in actualPrefix == prefix;
src-filter = path: type: with pkgs.lib;
let
ext = last (splitString "." path);
in
!elem (basename path) [
".git" ".hg" "__pycache__" ".eggs" "node_modules"
"build" "data" "tmp"] &&
!elem ext ["egg-info" "pyc"] &&
!startsWith "result" path;
rhodecode-enterprise-ce-src = builtins.filterSource src-filter ./.;
# Load the generated node packages
nodePackages = pkgs.callPackage "${pkgs.path}/pkgs/top-level/node-packages.nix" rec {
self = nodePackages;
generated = pkgs.callPackage ./pkgs/node-packages.nix { inherit self; };
};
# TODO: Should be taken automatically out of the generates packages.
# apps.nix has one solution for this, although I'd prefer to have the deps
# from package.json mapped in here.
nodeDependencies = with nodePackages; [
grunt
grunt-contrib-concat
grunt-contrib-jshint
grunt-contrib-less
grunt-contrib-watch
jshint
];
pythonGeneratedPackages = self: basePythonPackages.override (a: {
inherit self;
})
// (scopedImport {
self = self;
super = basePythonPackages;
inherit pkgs;
inherit (pkgs) fetchurl fetchgit;
} ./pkgs/python-packages.nix);
pythonOverrides = import ./pkgs/python-packages-overrides.nix {
inherit
basePythonPackages
pkgs;
};
pythonLocalOverrides = self: super: {
rhodecode-enterprise-ce =
let
version = "${builtins.readFile ./rhodecode/VERSION}";
linkNodeModules = ''
echo "Link node packages"
# TODO: check if this adds stuff as a dependency, closure size
rm -fr node_modules
mkdir -p node_modules
${pkgs.lib.concatMapStrings (dep: ''
ln -sfv ${dep}/lib/node_modules/${dep.pkgName} node_modules/
'') nodeDependencies}
echo "DONE: Link node packages"
'';
in super.rhodecode-enterprise-ce.override (attrs: {
inherit doCheck;
name = "rhodecode-enterprise-ce-${version}";
version = version;
src = rhodecode-enterprise-ce-src;
buildInputs =
attrs.buildInputs ++
(with self; [
pkgs.nodePackages.grunt-cli
pkgs.subversion
pytest-catchlog
rc_testdata
]);
propagatedBuildInputs = attrs.propagatedBuildInputs ++ (with self; [
rhodecode-tools
]);
# TODO: johbo: Make a nicer way to expose the parts. Maybe
# pkgs/default.nix?
passthru = {
inherit myPythonPackagesUnfix;
pythonPackages = self;
};
LC_ALL = "en_US.UTF-8";
LOCALE_ARCHIVE =
if pkgs.stdenv ? glibc
then "${pkgs.glibcLocales}/lib/locale/locale-archive"
else "";
# Somewhat snappier setup of the development environment
# TODO: move into shell.nix
# TODO: think of supporting a stable path again, so that multiple shells
# can share it.
shellHook = ''
tmp_path=$(mktemp -d)
export PATH="$tmp_path/bin:$PATH"
export PYTHONPATH="$tmp_path/${self.python.sitePackages}:$PYTHONPATH"
mkdir -p $tmp_path/${self.python.sitePackages}
python setup.py develop --prefix $tmp_path --allow-hosts ""
'' + linkNodeModules;
preCheck = ''
export PATH="$out/bin:$PATH"
'';
postCheck = ''
rm -rf $out/lib/${self.python.libPrefix}/site-packages/pytest_pylons
rm -rf $out/lib/${self.python.libPrefix}/site-packages/rhodecode/tests
'';
preBuild = linkNodeModules + ''
grunt
rm -fr node_modules
'';
postInstall = ''
# python based programs need to be wrapped
ln -s ${self.supervisor}/bin/supervisor* $out/bin/
ln -s ${self.gunicorn}/bin/gunicorn $out/bin/
ln -s ${self.PasteScript}/bin/paster $out/bin/
# rhodecode-tools
# TODO: johbo: re-think this. Do the tools import anything from enterprise?
ln -s ${self.rhodecode-tools}/bin/rhodecode-* $out/bin/
# note that condition should be restricted when adding further tools
for file in $out/bin/*; do #*/
wrapProgram $file \
--prefix PYTHONPATH : $PYTHONPATH \
--set PYTHONHASHSEED random
done
mkdir $out/etc
cp configs/production.ini $out/etc
echo "Writing meta information for rccontrol to nix-support/rccontrol"
mkdir -p $out/nix-support/rccontrol
cp -v rhodecode/VERSION $out/nix-support/rccontrol/version
echo "DONE: Meta information for rccontrol written"
# TODO: johbo: Make part of ac-tests
if [ ! -f rhodecode/public/js/scripts.js ]; then
echo "Missing scripts.js"
exit 1
fi
if [ ! -f rhodecode/public/css/style.css ]; then
echo "Missing style.css"
exit 1
fi
'';
});
rc_testdata = self.buildPythonPackage rec {
name = "rc_testdata-0.7.0";
src = pkgs.fetchhg {
url = "https://code.rhodecode.com/upstream/rc_testdata";
rev = "v0.7.0";
sha256 = "0w3z0zn8lagr707v67lgys23sl6pbi4xg7pfvdbw58h3q384h6rx";
};
};
};
# Apply all overrides and fix the final package set
myPythonPackagesUnfix =
(extends pythonExternalOverrides
(extends pythonLocalOverrides
(extends pythonOverrides
pythonGeneratedPackages)));
myPythonPackages = (fix myPythonPackagesUnfix);
in myPythonPackages.rhodecode-enterprise-ce

15
docs-internal/vcs/http-transition.rst Normal file
View file

@ -0,0 +1,15 @@
.. _vcs-http:
========================================
Transition to HTTP based communication
========================================
We are in the process of replacing the Pyro4 based communication with an HTTP
based implementation. Currently both backends are supported and can be
activated via various settings in the configuration.
To run the system in full HTTP based mode, use the following settings::
vcs.hooks.protocol = http
vcs.scm_app_implementation = rhodecode.lib.middleware.utils.scm_app_http
vcs.server.protocol = http

23
docs-internal/vcs/index.rst Normal file
View file

@ -0,0 +1,23 @@
======================================
VCS client and VCSServer integration
======================================
Enterprise uses the VCSServer as a backend to provide version control
functionalities. This section describes the components in Enterprise which talk
to the VCSServer.
The client library is implemented in :mod:`rhodecode.lib.vcs`. For HTTP based
access of the command line clients special middlewares and utilities are
implemented in :mod:`rhodecode.lib.middleware`.
.. toctree::
:maxdepth: 2
http-transition
middleware
vcsserver
subversion

4
docs/.howto Normal file
View file

@ -0,0 +1,4 @@
# building the docs
cd docs
nix-build default.nix -o result
make clean html

177
docs/Makefile Normal file
View file

@ -0,0 +1,177 @@
# Makefile for Sphinx documentation
#
# You can set these variables from the command line.
SPHINXOPTS =
SPHINXBUILD = ./result/bin/sphinx-build
PAPER =
BUILDDIR = _build
# User-friendly check for sphinx-build
ifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1)
$(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/)
endif
# Internal variables.
PAPEROPT_a4 = -D latex_paper_size=a4
PAPEROPT_letter = -D latex_paper_size=letter
ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
# the i18n builder cannot share the environment and doctrees with the others
I18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext
help:
@echo "Please use \`make <target>' where <target> is one of"
@echo " html to make standalone HTML files"
@echo " dirhtml to make HTML files named index.html in directories"
@echo " singlehtml to make a single large HTML file"
@echo " pickle to make pickle files"
@echo " json to make JSON files"
@echo " htmlhelp to make HTML files and a HTML help project"
@echo " qthelp to make HTML files and a qthelp project"
@echo " devhelp to make HTML files and a Devhelp project"
@echo " epub to make an epub"
@echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
@echo " latexpdf to make LaTeX files and run them through pdflatex"
@echo " latexpdfja to make LaTeX files and run them through platex/dvipdfmx"
@echo " text to make text files"
@echo " man to make manual pages"
@echo " texinfo to make Texinfo files"
@echo " info to make Texinfo files and run them through makeinfo"
@echo " gettext to make PO message catalogs"
@echo " changes to make an overview of all changed/added/deprecated items"
@echo " xml to make Docutils-native XML files"
@echo " pseudoxml to make pseudoxml-XML files for display purposes"
@echo " linkcheck to check all external links for integrity"
@echo " doctest to run all doctests embedded in the documentation (if enabled)"
clean:
rm -rf $(BUILDDIR)/*
html:
$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
@echo
@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
dirhtml:
$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
@echo
@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
singlehtml:
$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
@echo
@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
pickle:
$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
@echo
@echo "Build finished; now you can process the pickle files."
json:
$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
@echo
@echo "Build finished; now you can process the JSON files."
htmlhelp:
$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
@echo
@echo "Build finished; now you can run HTML Help Workshop with the" \
".hhp project file in $(BUILDDIR)/htmlhelp."
qthelp:
$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
@echo
@echo "Build finished; now you can run "qcollectiongenerator" with the" \
".qhcp project file in $(BUILDDIR)/qthelp, like this:"
@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/RhodeCodeInstaller.qhcp"
@echo "To view the help file:"
@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/RhodeCodeInstaller.qhc"
devhelp:
$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
@echo
@echo "Build finished."
@echo "To view the help file:"
@echo "# mkdir -p $$HOME/.local/share/devhelp/RhodeCodeInstaller"
@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/RhodeCodeInstaller"
@echo "# devhelp"
epub:
$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
@echo
@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
latex:
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
@echo
@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
@echo "Run \`make' in that directory to run these through (pdf)latex" \
"(use \`make latexpdf' here to do that automatically)."
latexpdf:
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
@echo "Running LaTeX files through pdflatex..."
$(MAKE) -C $(BUILDDIR)/latex all-pdf
@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
latexpdfja:
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
@echo "Running LaTeX files through platex and dvipdfmx..."
$(MAKE) -C $(BUILDDIR)/latex all-pdf-ja
@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
text:
$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
@echo
@echo "Build finished. The text files are in $(BUILDDIR)/text."
man:
$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
@echo
@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
texinfo:
$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
@echo
@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
@echo "Run \`make' in that directory to run these through makeinfo" \
"(use \`make info' here to do that automatically)."
info:
$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
@echo "Running Texinfo files through makeinfo..."
make -C $(BUILDDIR)/texinfo info
@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
gettext:
$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
@echo
@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
changes:
$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
@echo
@echo "The overview file is in $(BUILDDIR)/changes."
linkcheck:
$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
@echo
@echo "Link check complete; look for any errors in the above output " \
"or in $(BUILDDIR)/linkcheck/output.txt."
doctest:
$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
@echo "Testing of doctests in the sources finished, look at the " \
"results in $(BUILDDIR)/doctest/output.txt."
xml:
$(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml
@echo
@echo "Build finished. The XML files are in $(BUILDDIR)/xml."
pseudoxml:
$(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml
@echo
@echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml."

18
docs/_templates/layout.html vendored Normal file
View file

@ -0,0 +1,18 @@
{% extends "!layout.html" %}
{% set css_files = css_files + ['_static/add.css'] %}
{% block footer %}
{{ super() }}
<script>
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','//www.google-analytics.com/analytics.js','ga');
ga('create', 'UA-55639800-3', 'auto');
ga('send', 'pageview');
</script>
{% endblock %}

22
docs/admin/adding-anonymous-user.rst Normal file
View file

@ -0,0 +1,22 @@
.. _permissions-info-anon-ref:
Anonymous Users
---------------
By default, |RCM| provides |repo| access for registered users only. It can be
configured to be **world-open** in terms of read and write permissions. This
configuration is called "Anonymous Access" and allows |RCM| to be used as a
public hub where unregistered users have access to your |repos|.
Anonymous access is useful for open source projects, universities,
or if running inside a restricted internal corporate network to serve
documents to all employees. Anonymous users get the default user permission
settings that are applied across the whole |RCM| system.
To enable anonymous access to your |repos|, use the following steps:
1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`.
2. On the Application tab, check the :guilabel:`Allow anonymous access` box.
3. Select :guilabel:`Save`.
4. To set the anonymous user access permissions, which are based on the
default user settings, see :ref:`permissions-default-ref`.

20
docs/admin/adding-new-user.rst Normal file
View file

@ -0,0 +1,20 @@
.. _permissions-add-user:
Adding Users
------------
To create a new user, use the following steps.
1. Select :menuselection:`Admin --> Users` in the top menu.
2. Select the :guilabel:`Add User` button at the top right.
3. Set the user credentials.
4. Select :guilabel:`Save`.
Once the user is created you can set which groups they belong to using the
following steps:
1. From the :menuselection:`Admin --> Users Groups` page select
:guilabel:`edit` beside the user group you want to include them in.
2. On the :guilabel:`Settings` page, move the user from
:guilabel:`Available Members` into :guilabel:`Chosen Members` and
:guilabel:`Save`.

222
docs/admin/admin-tricks.rst Normal file
View file

@ -0,0 +1,222 @@
.. _admin-tricks:
One-time Admin Tasks
--------------------
* :ref:`web-analytics`
* :ref:`admin-tricks-license`
* :ref:`announcements`
* :ref:`md-rst`
* :ref:`repo-stats`
* :ref:`server-side-merge`
* :ref:`remap-rescan`
* :ref:`custom-hooks`
* :ref:`clear-repo-cache`
* :ref:`set-repo-pub`
* :ref:`ping`
.. _web-analytics:
Adding Web Analytics
^^^^^^^^^^^^^^^^^^^^
If you wish to add a Google Analytics, or any other kind of tracker to your
|RCE| instance you can add the necessary codes to the header or footer
section of each instance using the following steps:
1. From the |RCE| interface, select
:menuselection:`Admin --> Settings --> Global`
2. To add a tracking code to you instance, enter it in the header or footer
section and select **Save**
Use the example templates in the drop-down menu to set up your configuration.
.. _admin-tricks-license:
Licence Key Management
^^^^^^^^^^^^^^^^^^^^^^
To manage your license key, go to
:menuselection:`Admin --> Settings --> License`.
On this page you can see the license key details. If you need a new license,
or have questions about your current one, contact support@rhodecode.com
.. _announcements:
Server-wide Announcements
^^^^^^^^^^^^^^^^^^^^^^^^^
If you need to make a server-wide announcement to all users,
you can add a message to be displayed using the following steps:
1. From the |RCE| interface, select
:menuselection:`Admin --> Settings --> Global`
2. To add a message that will be displayed to all users,
select :guilabel:`Server Announcement` from the drop-down menu and
change the ``var message = "TYPE YOUR MESSAGE HERE";`` example line.
3. Select :guilabel:`Save`, and you will see the message once your page
refreshes.
.. image:: ../images/server-wide-announcement.png
:alt: Server Wide Announcement
.. _md-rst:
Markdown or RST Rendering
^^^^^^^^^^^^^^^^^^^^^^^^^
|RCE| can use `Markdown`_ or `reStructured Text`_ in commit message,
code review messages, and inline comments. To set the default to either,
select your preference from the drop-down menu on the
:menuselection:`Admin --> Settings --> Visual` page and select
:guilabel:`Save settings`.
.. _repo-stats:
Enabling Repository Statistics
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To enable |repo| statistics, use the following steps:
1. From the |RCE| interface, open
:menuselection:`Admin --> Repositories` and select
:guilabel:`Edit` beside the |repo| for which you wish to enable statistics.
2. Check the :guilabel:`Enable statistics` box, and select :guilabel:`Save`
.. _server-side-merge:
Enabling Server-side Merging
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To enable server-side merging, use the following steps:
1. From the |RCE| interface, open :menuselection:`Admin --> Settings --> VCS`
2. Check the :guilabel:`Server-side merge` box, and select
:guilabel:`Save Settings`
If you encounter slow performance with server-side merging enabled, check the
speed at which your server is performing actions. When server-side merging is
enabled, the following actions occurs on the server.
* A |pr| is created in the database.
* A shadow |repo| is created as a working environment for the |pr|.
* On display, |RCE| checks if the |pr| can be merged.
To check how fast the shadow |repo| creation is occurring on your server, use
the following steps:
1. Log into your server and create a directory in your |repos| folder.
2. Clone a |repo| that is showing slow performance and time the action.
.. code-block:: bash
# One option is to use the time command
$ time hg clone SOURCE_REPO TARGET
.. _remap-rescan:
Remap and Rescan Repositories
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
You may want to Remap and rescan the |repos| that |RCE| is managing to ensure
the system is always up-to-date. This is useful after importing, deleting,
or carrying out general cleaning up operations. To do this use the
following steps:
1. From the |RCE|, open
:menuselection:`Admin --> Settings --> Remap and rescan`
2. Click :guilabel:`Rescan Repositories`
Check the additional options if needed:
* :guilabel:`Destroy old data`: Useful for purging deleted repository
information from the database.
* :guilabel:`Invalidate cache for all repositories`: Use this to completely
remap all |repos|. Useful when importing or migrating |repos| to ensure all
new information is picked up.
.. _custom-hooks:
Adding Custom Hooks
^^^^^^^^^^^^^^^^^^^
To add custom hooks to your instance, use the following steps:
1. Open :menuselection:`Admin --> Settings --> Hooks`
2. Add your custom hook details, you can use a file path to specify custom
hook scripts, for example: ``python:/path/to/custom_hook.py``
3. Select :guilabel:`Save`
Also, see the |RC| Extensions section of the :ref:`rc-tools` guide. |RC|
Extensions can be used to add additional hooks to your instance and comes
with a number of pre-built plugins if you chose to install them.
.. _clear-repo-cache:
Clearing |repo| cache
^^^^^^^^^^^^^^^^^^^^^
If you need to clear the cache for a particular |repo|, use the following steps:
1. Open :menuselection:`Admin --> Repositories` and select :guilabel:`Edit`
beside the |repo| whose cache you wish to clear.
2. On the |repo| settings page, go to the :guilabel:`Caches` tab and select
:guilabel:`Invalidate repository cache`.
.. _set-lang:
Changing Default Language
^^^^^^^^^^^^^^^^^^^^^^^^^
To change the default language of a |RCE| instance, change the language code
in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. To
do this, use the following steps.
1. Open the :file:`rhodecode.ini` file and set the required language code.
.. code-block:: ini
## Optional Languages
## en(default), de, fr, it, ja, pl, pt, ru, zh
lang = de
2. Restart the |RCE| instance and check that the language has been updated.
.. code-block:: bash
$ rccontrol restart enterprise-2
Instance "enterprise-2" successfully stopped.
Instance "enterprise-2" successfully started.
.. image:: ../images/language.png
.. _set-repo-pub:
Setting Repositories to Publish
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To automatically promote your local |repos| to public after pushing to |RCE|,
enable the :guilabel:`Set repositories as publishing` option on the
:menuselection:`Admin --> Settings --> VCS` page.
.. note::
This option is enabled by default on most |RCE| versions, but if upgrading
from a 1.7.x version it could be disabled on upgrade due to inheriting
older default settings.
.. _ping:
Pinging the |RCE| Server
^^^^^^^^^^^^^^^^^^^^^^^^
You can check the IP Address of your |RCE| instance using the
following URL: ``{instance-URL}/_admin/ping``.
.. code-block:: bash
$ curl https://your.rhodecode.url/_admin/ping
pong[rce-7880] => 203.0.113.23
.. _Markdown: http://daringfireball.net/projects/markdown/
.. _reStructured Text: http://docutils.sourceforge.net/docs/index.html

114
docs/admin/apache-conf-examples.rst Normal file
View file

@ -0,0 +1,114 @@
.. _apache-conf-eg:
Apache Configuration Examples
-----------------------------
Use the following example to securely configure your Apache HTTP virtual hosts
file.
.. code-block:: apache
<VirtualHost *:80>
ServerName hg.myserver.com
ServerAlias hg.myserver.com
<Proxy *>
Order allow,deny
Allow from all
</Proxy>
# important !
# Directive to properly generate url (clone url) for pylons
ProxyPreserveHost On
#rhodecode instance
ProxyPass / http://127.0.0.1:5000/
ProxyPassReverse / http://127.0.0.1:5000/
# Set strict HTTPS
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
# Set x-frame options
Header always append X-Frame-Options SAMEORIGIN
# To enable https use line below
# SetEnvIf X-Url-Scheme https HTTPS=1
# Secure your Diffie-hellmann deployment
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
SSLHonorCipherOrder on
SSLOpenSSLConfCmd DHParameters "{path to dhparams.pem}"
</VirtualHost>
Use the following example to configure Apache for a multi-node setup. The
timeout setting should be increased if you experience timeouts when working
with large |repos|.
.. code-block:: apache
#
# Timeout: The number of seconds before receives and sends time out.
#
Timeout 600
<VirtualHost *:80>
ProxyRequests off
#important !
#Directive to properly generate url (clone url) for pylons
ProxyPreserveHost On
ServerName your.rce.com
ServerAlias your.rce.com
<Proxy balancer://mycluster>
# WebHead1
BalancerMember http://10.58.1.171:10002 route=1
# WebHead2
BalancerMember http://10.58.1.172:10001 route=2
# Security "technically we aren't blocking
# anyone but this the place to make those
# chages
Order Deny,Allow
Deny from none
Allow from all
# Load Balancer Settings
# We will be configuring a simple Round
# Robin style load balancer. This means
# that all webheads take an equal share of
# of the load.
ProxySet stickysession=ROUTEID
</Proxy>
# balancer-manager
# This tool is built into the mod_proxy_balancer
# module and will allow you to do some simple
# modifications to the balanced group via a gui
# web interface.
<Location /balancer-manager>
SetHandler balancer-manager
# recommend locking this one down to your
# your office
Order deny,allow
Allow from all
</Location>
# Point of Balance
# This setting will allow to explicitly name the
# the location in the site that we want to be
# balanced, in this example we will balance "/"
# or everything in the site.
ProxyPass /balancer-manager !
ProxyPass / balancer://mycluster/
ProxyPassReverse / balancer://mycluster/
</VirtualHost>

15
docs/admin/apache-config.rst Normal file
View file

@ -0,0 +1,15 @@
.. _apache-ws-ref:
Apache HTTP Server Configuration
--------------------------------
To set up your Apache Web Server for optimal performance and security, use
the information in the following sections.
.. toctree::
apache-diffie-hellman
apache-conf-examples
apache-subdirectory
apache-reverse-proxy
apache-wsgi-coding

34
docs/admin/apache-diffie-hellman.rst Normal file
View file

@ -0,0 +1,34 @@
.. _dh-apache:
Diffie-Hellman Security
-----------------------
To secure your web server, the `Guide to Deploying Diffie-Hellman for TLS`_
contains important information worth reading. This link contains some good
`secure Apache configuration`_ examples.
To secure your deployment of Diffie-Hellman, configure the following:
1. Generate a strong Diffie-hellman group, 2048-bit or stronger.
.. code-block:: bash
# to generate your dhparam.pem file, run in the terminal
openssl dhparam -out /etc/apache/ssl/dhparam.pem 2048
2. Configure your server to only use modern, secure cipher suites in the
virtual hosts configuration file.
.. code-block:: apache
# Set the protocol to only use modern, secure cipher suites.
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
# Specify your DH params file as follows
SSLOpenSSLConfCmd DHParameters "{path to dhparams.pem}"
.. _Guide to Deploying Diffie-Hellman for TLS: https://weakdh.org/sysadmin.html
.. _secure Apache configuration: http://www.apache-ssl.org/httpd.conf.example

33
docs/admin/apache-reverse-proxy.rst Normal file
View file

@ -0,0 +1,33 @@
Apache Reverse Proxy
^^^^^^^^^^^^^^^^^^^^
Here is a sample configuration file for using Apache as a reverse proxy.
.. code-block:: apache
<VirtualHost *:80>
ServerName hg.myserver.com
ServerAlias hg.myserver.com
## uncomment root directive if you want to serve static files by nginx
## requires static_files = false in .ini file
DocumentRoot /path/to/installation/rhodecode/public
<Proxy *>
Order allow,deny
Allow from all
</Proxy>
#important !
#Directive to properly generate url (clone url) for pylons
ProxyPreserveHost On
#rhodecode instance
ProxyPass / http://127.0.0.1:5000/
ProxyPassReverse / http://127.0.0.1:5000/
#to enable https use line below
#SetEnvIf X-Url-Scheme https HTTPS=1
</VirtualHost>

32
docs/admin/apache-subdirectory.rst Normal file
View file

@ -0,0 +1,32 @@
.. _apache-sub-ref:
Apache URL Prefix Configuration
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Use the following example to configure Apache to use a URL prefix.
.. code-block:: apache
<Location /<someprefix> > # Change <someprefix> into your chosen prefix
ProxyPass http://127.0.0.1:5000/<someprefix>
ProxyPassReverse http://127.0.0.1:5000/<someprefix>
SetEnvIf X-Url-Scheme https HTTPS=1
</Location>
In addition to the regular Apache setup you will need to add the following
lines into the ``rhodecode.ini`` file.
* In the the ``[app:main]`` section of your ``rhodecode.ini`` file add the
following line.
.. code-block:: ini
filter-with = proxy-prefix
* At the end of the ``rhodecode.ini`` file add the following section.
.. code-block:: ini
[filter:proxy-prefix]
use = egg:PasteDeploy#prefix
prefix = /<someprefix> # Change <someprefix> into your chosen prefix

55
docs/admin/apache-wsgi-coding.rst Normal file
View file

@ -0,0 +1,55 @@
.. _apache-wsgi-ref:
Apache WSGI Configuration
^^^^^^^^^^^^^^^^^^^^^^^^^
|RCM| can also be set up with Apache under ``mod_wsgi``. To configure this
use the following steps.
1. Install ``mod_wsgi`` using the following command:
``aptitude install libapache2-mod-wsgi``.
2. Enable ``mod_wsgi`` using the following command: ``a2enmod wsgi``
3. Create a ``wsgi`` dispatch script, using the following examples.
.. code-block:: bash
WSGIDaemonProcess pylons \
threads=4 \
# check the python virtual env location
python-path=/home/web/rhodecode/pyenv/lib/python2.6/site-packages
# Check the install location
WSGIScriptAlias / /home/web/rhodecode/dispatch.wsgi
WSGIPassAuthorization On
# user=www-data group=www-data # Enable if running Apache as root
.. note::
Do not set ``processes=num`` in this configuration file. Running |RCE| in
multiprocess mode with Apache is not supported.
The following is an example ``wsgi`` dispatch script.
.. code-block:: python
import os
os.environ["HGENCODING"] = "UTF-8"
os.environ['PYTHON_EGG_CACHE'] = '/home/web/rhodecode/.egg-cache'
# Set the current dir
os.chdir('/home/web/rhodecode/')
import site
site.addsitedir("/home/web/rhodecode/pyenv/lib/python2.6/site-packages")
from paste.deploy import loadapp
from paste.script.util.logging_config import fileConfig
fileConfig('/home/web/rhodecode/production.ini')
application = loadapp('config:/home/web/rhodecode/production.ini')
.. note::
When using `mod_wsgi` the same version of |hg| must be running in your
system's |PY| environment and on |RCM|. To check the |RCM| version,
on the interface go to
:menuselection:`Admin --> Settings --> System Info`

127
docs/admin/backup-restore.rst Normal file
View file

@ -0,0 +1,127 @@
.. _backup-ref:
Backup and Restore
==================
*“The condition of any backup is unknown until a restore is attempted.”*
`Schrödinger's Backup`_
To snapshot an instance of |RCE|, and save its settings, you need to backup the
following parts of the system at the same time.
* The |repos| managed by the instance.
* The |RCE| database.
* Any configuration files or extensions that you've configured.
.. important::
Ideally you should script all of these functions so that it creates a
backup snapshot of your system at a particular timestamp and then run that
script regularly.
Backup Details
--------------
To backup the relevant parts of |RCE| required to restore your system, use
the information in this section to identify what is important to you.
Repository Backup
^^^^^^^^^^^^^^^^^
To back up your |repos|, use the API to get a list of all |repos| managed,
and then clone them to your backup location.
Use the ``get_repos`` method to list all your managed |repos|,
and use the ``clone_uri`` information that is returned. See the :ref:`api`
for more information.
.. important::
This will not work for |svn| |repos|. Currently the only way to back up
your |svn| |repos| is to make a copy of them.
It is also important to note, that you can only restore the |svn| |repos|
using the same version as they were saved with.
Database Backup
^^^^^^^^^^^^^^^
The instance database contains all the |RCE| permissions settings,
and user management information. To backup your database,
export it using the following appropriate example, and then move it to your
backup location:
.. code-block:: bash
# For MySQL DBs
$ mysqldump -u <uname> -p <pass> db_name > mysql-db-backup
# For PostgreSQL DBs
$ pg_dump dbname > postgresql-db-backup
# For SQLlite
$ sqlite3 rhodecode.db ‘.dump’ > sqlite-db-backup
The default |RCE| SQLite database location is
:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.db`
If running MySQL or PostgreSQL databases, you will have configured these
separately, for more information see :ref:`rhodecode-database-ref`
Configuration File Backup
^^^^^^^^^^^^^^^^^^^^^^^^^
Depending on your setup, you could have a number of configuration files that
should be backed up. You may have some, or all of the configuration files
listed in the :ref:`config-rce-files` section. Ideally you should back these
up at the same time as the database and |repos|.
Gist Backup
^^^^^^^^^^^
To backup the gists on your |RCE| instance you can use the ``get_users`` and
``get_gists`` API methods to fetch the gists for each user on the instance.
Extension Backups
^^^^^^^^^^^^^^^^^
You should also backup any extensions added in the
:file:`home/{user}/.rccontrol/{instance-id}/rcextensions` directory.
Full-text Search Backup
^^^^^^^^^^^^^^^^^^^^^^^
You may also have full text search set up, but the index can be rebuild from
re-imported |repos| if necessary. You will most likely want to backup your
:file:`mapping.ini` file if you've configured that. For more information, see
the :ref:`indexing-ref` section.
Restoration Steps
-----------------
To restore an instance of |RCE| from its backed up components, use the
following steps.
1. Install a new instance of |RCE|.
2. Once installed, configure the instance to use the backed up
:file:`rhodecode.ini` file. Ensure this file points to the backed up
database, see the :ref:`config-database` section.
3. Restart |RCE| and remap and rescan your |repos|, see the
:ref:`remap-rescan` section.
Post Restoration Steps
^^^^^^^^^^^^^^^^^^^^^^
Once you have restored your |RCE| instance to basic functionality, you can
then work on restoring any specific setup changes you had made.
* To recreate the |RCE| index, use the backed up :file:`mapping.ini` file if
you had made changes and rerun the indexer. See the
:ref:`indexing-ref` section for details.
* To reconfigure any extensions, copy the backed up extensions into the
:file:`/home/{user}/.rccontrol/{instance-id}/rcextensions` and also specify
any custom hooks if necessary. See the :ref:`integrations-ref` section for
details.
.. _Schrödinger's Backup: http://novabackup.novastor.com/blog/schrodingers-backup-good-bad-backup/

23
docs/admin/cleanup-cmds.rst Normal file
View file

@ -0,0 +1,23 @@
.. _clean-up-cmds:
|RCT| Clean Up Commands
=======================
|RCT| comes with a number of functions which can be used to administer your
|RCE| instances. Two of these can be used to automate the cleanup of gists
and |repos|
rhodecode-cleanup-gists
-----------------------
Use this command to delete gists within RhodeCode Enterprise. It takes a
number of options for specifying the kind of gists you want deleted, and it
is possible to run these commands from a cron job or cleanup script. For more
information, see the :ref:`tools-cli`
rhodecode-cleanup-repos
-----------------------
Use this command to delete |repos| from your |RCE| instances. It takes
a number of options specifying the kind of |repos| you want deleted. For more
information, see the :ref:`tools-cli`

74
docs/admin/config-files-overview.rst Normal file
View file

@ -0,0 +1,74 @@
.. _config-files:
Configuration Files Overview
============================
|RCE| and |RCC| have a number of different configuration files. The following
is a brief explanation of each, and links to their associated configuration
sections.
.. rst-class:: dl-horizontal
\- **rhodecode.ini**
Default location:
:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
This is the main |RCE| configuration file and controls much of its
default behaviour. It is also used to configure certain customer
settings. Here are some of the most common reasons to make changes to
this file.
* :ref:`config-database`
* :ref:`set-up-mail`
* :ref:`increase-gunicorn`
* :ref:`x-frame`
\- **mapping.ini**
Default location:
:file:`/home/{user}/.rccontrol/{instance-id}/mapping.ini`
This file is used to control the |RCE| indexer. It comes configured
to index your instance. To change the default configuration, see
:ref:`advanced-indexing`.
\- **vcsserver.ini**
Default location:
:file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini`
The VCS Server handles the connection between your |repos| and |RCE|.
See the :ref:`vcs-server` section for configuration options and more
detailed information.
\- **supervisord.ini**
Default location:
:file:`/home/{user}/.rccontrol/supervisor/supervisord.ini`
|RCC| uses Supervisor to monitor and manage installed instances of
|RCE| and the VCS Server. |RCC| will manage this file completely,
unless you install |RCE| in self-managed mode. For more information,
see the :ref:`Supervisor Setup<control:supervisor-setup>` section.
\- **.rccontrol.ini**
Default location: :file:`/home/{user}/.rccontrol.ini`
This file contains the instances that |RCC| starts at boot, which is all
by default, but for more information, see
the :ref:`Manually Start At Boot <control:set-start-boot>` section.
\- **.rhoderc**
Default location: :file:`/home/{user}/.rhoderc`
This file is used by the |RCE| API when accessing an instance from a
remote machine. The API checks this file for connection and
authentication details. For more details, see the :ref:`config-rhoderc`
section.
\- **MANIFEST**
Default location: :file:`/home/{user}/.rccontrol/cache/MANIFEST`
|RCC| uses this file to source the latest available builds from the
secure |RC| download channels. The only reason to mess with this file
is if you need to do an offline installation,
see the :ref:`Offline Installation<control:offline-installer-ref>`
instructions, otherwise |RCC| will completely manage this file.

32
docs/admin/default-user-perms.rst Normal file
View file

@ -0,0 +1,32 @@
.. _default-perms:
Default User Permissions
------------------------
There are two ways in which the default user settings work:
System-wide Level
^^^^^^^^^^^^^^^^^
On a system-wide level, you can set the default user permissions so that
all new users are given a certain set of permissions unless individually
tailored, or added to a user group. For more information about system-wide
default permissions, see the :ref:`permissions-info-anon-ref` and
:ref:`permissions-default-ref` sections.
User Group Level
^^^^^^^^^^^^^^^^
On a user group level, you can set the default user settings for the user
group, and all users within that group will get those default permissions
unless individually tailored. For more information about setting default
permissions for all the different entities, see the
:ref:`permissions-default-ref` section.
For more detailed information about managing the different permissions
settings, see the following sections:
* :ref:`permissions-info-anon-ref`
* :ref:`permissions-add-user`
* :ref:`permissions-default-ref`
* :ref:`permissions-info-add-group-ref`

136
docs/admin/enable-debug.rst Normal file
View file

@ -0,0 +1,136 @@
.. _debug-mode:
Enabling Debug Mode
-------------------
To enable debug mode on a |RCE| instance you need to set the debug property
in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. To
do this, use the following steps
1. Open the file and set the ``debug`` line to ``true``
2. Restart you instance using the ``rccontrol restart`` command,
see the following example:
You can also set the log level, the follow are the valid options;
``debug``, ``info``, ``warning``, or ``fatal``.
.. code-block:: ini
[DEFAULT]
debug = true
pdebug = false
.. code-block:: bash
# Restart your instance
$ rccontrol restart enterprise-1
Instance "enterprise-1" successfully stopped.
Instance "enterprise-1" successfully started.
Debug and Logging Configuration
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Further debugging and logging settings can also be set in the
:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
In the logging section, the various packages that run with |RCE| can have
different debug levels set. If you want to increase the logging level change
``level = DEBUG`` line to one of the valid options.
You also need to change the log level for handlers. See the example
``##handler`` section below. The ``handler`` level takes the same options as
the ``debug`` level.
.. code-block:: ini
################################
### LOGGING CONFIGURATION ####
################################
[loggers]
keys = root, routes, rhodecode, sqlalchemy, beaker, pyro4, templates, whoosh_indexer
[handlers]
keys = console, console_sql, file, file_rotating
[formatters]
keys = generic, color_formatter, color_formatter_sql
#############
## LOGGERS ##
#############
[logger_root]
level = NOTSET
handlers = console
[logger_routes]
level = DEBUG
handlers =
qualname = routes.middleware
## "level = DEBUG" logs the route matched and routing variables.
propagate = 1
[logger_beaker]
level = DEBUG
handlers =
qualname = beaker.container
propagate = 1
[logger_pyro4]
level = DEBUG
handlers =
qualname = Pyro4
propagate = 1
[logger_templates]
level = INFO
handlers =
qualname = pylons.templating
propagate = 1
[logger_rhodecode]
level = DEBUG
handlers =
qualname = rhodecode
propagate = 1
[logger_sqlalchemy]
level = INFO
handlers = console_sql
qualname = sqlalchemy.engine
propagate = 0
[logger_whoosh_indexer]
level = DEBUG
handlers =
qualname = whoosh_indexer
propagate = 1
##############
## HANDLERS ##
##############
[handler_console]
class = StreamHandler
args = (sys.stderr,)
level = INFO
formatter = generic
[handler_console_sql]
class = StreamHandler
args = (sys.stderr,)
level = WARN
formatter = generic
[handler_file]
class = FileHandler
args = ('rhodecode.log', 'a',)
level = INFO
formatter = generic
[handler_file_rotating]
class = logging.handlers.TimedRotatingFileHandler
# 'D', 5 - rotate every 5days
# you can set 'h', 'midnight'
args = ('rhodecode.log', 'D', 5, 10,)
level = INFO
formatter = generic

50
docs/admin/glossary.rst Normal file
View file

@ -0,0 +1,50 @@
.. _glossary:
Glossary
========
.. glossary::
DVCS
Distributed Version Control System, usually referring to |git| or |hg|.
Extension
An extension extends the capabilities of, or the data available to,
an existing software application.
Full-text Search
Indexing all files and |repos| managed by |RCE| and
making this data searchable from the interface.
Gist
A note that can only be edited by the author and shared using its
link within others. The sharing permissions can be set during
its creation.
Gunicorn
A Python WSGI HTTP Server used by |RCE|.
Hook
A hook intercepts function calls, messages, or events passed between
software components and can be used to trigger plugins, or their
extensions.
Horizontal scaling
Adding more machines or workers into your pool of resources.
Instance
A single installed version of one of the |RC| products. It could
refer to |RCE| or the VCS server depending on the context.
Plugin
A Plugin is software that adds a specific feature to an existing
software application.
tmpfs
Temporary file storage kept in volatile memory instead of persistent
storage.
VCS Server
The VCS Server handles the abstraction layer between the
supported version control systems and RhodeCode Enterprise.

235
docs/admin/indexing.rst Normal file
View file

@ -0,0 +1,235 @@
.. _indexing-ref:
Full-text Search
----------------
By default |RCM| uses `Whoosh`_ to index |repos| and provide full-text search.
To run the indexer you need to use an |authtoken| with admin rights to all
|repos|.
To index new content added, you have the option to set the indexer up in a
number of ways, for example:
* Call the indexer via a cron job. We recommend running this nightly,
unless you need everything indexed immediately.
* Set the indexer to infinitely loop and reindex as soon as it has run its
cycle.
* Hook the indexer up with your CI server to reindex after each push.
The indexer works by indexing new commits added since the last run. If you
wish to build a brand new index from scratch each time,
use the ``force`` option in the configuration file.
.. important::
You need to have |RCT| installed, see :ref:`install-tools`. Since |RCE|
3.5.0 they are installed by default.
To set up indexing, use the following steps:
1. :ref:`config-rhoderc`, if running tools remotely.
2. :ref:`run-index`
3. :ref:`set-index`
4. :ref:`advanced-indexing`
.. _config-rhoderc:
Configure the ``.rhoderc`` File
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|RCT| uses the :file:`/home/{user}/.rhoderc` file for connection details
to |RCM| instances. If this file is not automatically created,
you can configure it using the following example. You need to configure the
details for each instance you want to index.
.. code-block:: bash
# Check the instance details
# of the instance you want to index
$ rccontrol status
- NAME: enterprise-1
- STATUS: RUNNING
- TYPE: Momentum
- VERSION: 1.5.0
- URL: http://127.0.0.1:10000
To get your API Token, on the |RCM| interface go to
:menuselection:`username --> My Account --> Auth tokens`
.. code-block:: ini
# Configure .rhoderc with matching details
# This allows the indexer to connect to the instance
[instance:enterprise-1]
api_host = http://127.0.0.1:10000
api_key = <auth token goes here>
repo_dir = /home/<username>/repos
.. _run-index:
Run the Indexer
^^^^^^^^^^^^^^^
Run the indexer using the following command, and specify the instance you
want to index:
.. code-block:: bash
# From inside a virtualevv
(venv)$ rhodecode-index --instance-name=enterprise-1
# Using default installation
$ /home/user/.rccontrol/enterprise-4/profile/bin/rhodecode-index \
--instance-name=enterprise-4
# Using a custom mapping file
$ /home/user/.rccontrol/enterprise-4/profile/bin/rhodecode-index \
--instance-name=enterprise-4 \
--mapping=/home/user/.rccontrol/enterprise-4/mapping.ini
.. note::
|RCT| require |PY| 2.7 to run.
.. _set-index:
Schedule the Indexer
^^^^^^^^^^^^^^^^^^^^
To schedule the indexer, configure the crontab file to run the indexer inside
your |RCT| virtualenv using the following steps.
1. Open the crontab file, using ``crontab -e``.
2. Add the indexer to the crontab, and schedule it to run as regularly as you
wish.
3. Save the file.
.. code-block:: bash
$ crontab -e
# The virtualenv can be called using its full path, so for example you can
# put this example into the crontab
# Run the indexer daily at 4am using the default mapping settings
* 4 * * * /home/ubuntu/.virtualenv/rhodecode-venv/bin/rhodecode-index \
--instance-name=enterprise-1
# Run the indexer every Sunday at 3am using default mapping
* 3 * * 0 /home/ubuntu/.virtualenv/rhodecode-venv/bin/rhodecode-index \
--instance-name=enterprise-1
# Run the indexer every 15 minutes
# using a specially configured mapping file
*/15 * * * * ~/.rccontrol/enterprise-4/profile/bin/rhodecode-index \
--instance-name=enterprise-4 \
--mapping=/home/user/.rccontrol/enterprise-4/mapping.ini
.. _advanced-indexing:
Advanced Indexing
^^^^^^^^^^^^^^^^^
|RCT| indexes based on the :file:`mapping.ini` file. To configure your index,
you can specify different options in this file. The default location is:
* :file:`/home/{user}/.rccontrol/{instance-id}/mapping.ini`, using default
|RCT|.
* :file:`~/venv/lib/python2.7/site-packages/rhodecode_tools/templates/mapping.ini`,
when using ``virtualenv``.
.. note::
If you need to create the :file:`mapping.ini` file, use the |RCT|
``rhodecode-index --create-mapping path/to/file`` API call. For details,
see the :ref:`tools-cli` section.
The indexer runs in a random order to prevent a failing |repo| from stopping
a build. To configure different indexing scenarios, set the following options
inside the :file:`mapping.ini` and specify the altered file using the
``--mapping`` option.
* ``index_files`` : Index the specified file types.
* ``skip_files`` : Do not index the specified file types.
* ``index_files_content`` : Index the content of the specified file types.
* ``skip_files_content`` : Do not index the content of the specified files.
* ``force`` : Create a fresh index on each run.
* ``max_filesize`` : Files larger than the set size will not be indexed.
* ``commit_parse_limit`` : Set the batch size when indexing commit messages.
Set to a lower number to lessen memory load.
* ``repo_limit`` : Set the maximum number or |repos| indexed per run.
* ``[INCLUDE]`` : Set |repos| you want indexed. This takes precedent over
``[EXCLUDE]``.
* ``[EXCLUDE]`` : Set |repos| you do not want indexed. Exclude can be used to
not index branches, forks, or log |repos|.
At the end of the file you can specify conditions for specific |repos| that
will override the default values. To configure your indexer,
use the following example :file:`mapping.ini` file.
.. code-block:: ini
[__DEFAULT__]
# default patterns for indexing files and content of files.
# Binary files are skipped by default.
# Index python and markdown files
index_files = *.py, *.md
# Do not index these file types
skip_files = *.svg, *.log, *.dump, *.txt
# Index both file types and their content
index_files_content = *.cpp, *.ini, *.py
# Index file names, but not file content
skip_files_content = *.svg,
# Force rebuilding an index from scratch. Each repository will be rebuild
# from scratch with a global flag. Use local flag to rebuild single repos
force = false
# Do not index files larger than 385KB
max_filesize = 385KB
# Limit commit indexing to 500 per batch
commit_parse_limit = 500
# Limit each index run to 25 repos
repo_limit = 25
# __INCLUDE__ is more important that __EXCLUDE__.
[__INCLUDE__]
# Include all repos with these names
docs/* = 1
lib/* = 1
[__EXCLUDE__]
# Do not include the following repo in index
dev-docs/* = 1
legacy-repos/* = 1
*-dev/* = 1
# Each repo that needs special indexing is a separate section below.
# In each section set the options to override the global configuration
# parameters above.
# If special settings are not configured, the global configuration values
# above are inherited. If no special repositories are
# defined here RhodeCode will use the API to ask for all repositories
# For this repo use different settings
[special-repo]
commit_parse_limit = 20,
skip_files = *.idea, *.xml,
# For another repo use different settings
[another-special-repo]
index_files = *,
max_filesize = 800MB
commit_parse_limit = 20000
.. _Whoosh: https://pypi.python.org/pypi/Whoosh/

41
docs/admin/lab-settings.rst Normal file
View file

@ -0,0 +1,41 @@
.. _lab-settings:
Lab Settings
============
|RCE| Lab Settings is for delivering features which may require an additional
level of support to optimize for production scenarios. To enable lab settings,
use the following instructions:
1. Open the |RCE| configuration file,
:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
2. Add the following configuration option in the ``[app:main]`` section.
.. code-block:: bash
[app:main]
## Display extended labs settings
labs_settings_active = true
3. Restart your |RCE| instance
.. code-block:: bash
$ rccontrol restart enterprise-1
4. You will see the labs setting on the
:menuselection:`Admin --> Settings --> labs` page.
.. image:: ../images/lab-setting.png
Available Lab Extras
--------------------
Once lab settings are enabled, the following features are available.
.. toctree::
:maxdepth: 1
svn-http

71
docs/admin/nginx-config-example.rst Normal file
View file

@ -0,0 +1,71 @@
Nginx Configuration Example
---------------------------
Use the following example to configure Nginx as a your web server.
.. code-block:: nginx
upstream rc {
server 127.0.0.1:5000;
# add more instances for load balancing
# server 127.0.0.1:5001;
# server 127.0.0.1:5002;
}
## gist alias
server {
listen 443;
server_name gist.myserver.com;
access_log /var/log/nginx/gist.access.log;
error_log /var/log/nginx/gist.error.log;
ssl on;
ssl_certificate gist.rhodecode.myserver.com.crt;
ssl_certificate_key gist.rhodecode.myserver.com.key;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1;
ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5;
ssl_prefer_server_ciphers on;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
rewrite ^/(.+)$ https://rhodecode.myserver.com/_admin/gists/$1;
rewrite (.*) https://rhodecode.myserver.com/_admin/gists;
}
server {
listen 443;
server_name rhodecode.myserver.com;
access_log /var/log/nginx/rhodecode.access.log;
error_log /var/log/nginx/rhodecode.error.log;
ssl on;
ssl_certificate rhodecode.myserver.com.crt;
ssl_certificate_key rhodecode.myserver.com.key;
ssl_session_timeout 5m;
ssl_protocols SSLv3 TLSv1;
ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5;
ssl_prefer_server_ciphers on;
## uncomment root directive if you want to serve static files by nginx
## requires static_files = false in .ini file
# root /path/to/installation/rhodecode/public;
include /etc/nginx/proxy.conf;
location / {
try_files $uri @rhode;
}
location @rhode {
proxy_pass http://rc;
}
}

14
docs/admin/nginx-config.rst Normal file
View file

@ -0,0 +1,14 @@
.. _nginx-ws-ref:
Nginx Configuration
===================
To set up your Nginx Web Server for optimal performance and security, use
the information in the following sections.
.. toctree::
nginx-diffie-hellman
nginx-config-example
nginx-tuning
nginx-url-prefix

34
docs/admin/nginx-diffie-hellman.rst Normal file
View file

@ -0,0 +1,34 @@
.. _dh-nginx:
Diffie-Hellman Security
-----------------------
To secure your web server, the `Guide to Deploying Diffie-Hellman for TLS`_
contains important information worth reading. This link contains a good
`nginx secure configuration`_ example. The documentation below also contains
good security settings with some additional |RCE| specific examples.
To secure your deployment of Diffie-Hellman, configure the following:
* Generate a strong Diffie-hellman group, 2048-bit or stronger.
.. code-block:: bash
# to generate your dhparam.pem file, run in the terminal
openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
* Configure your server to only use modern, secure cipher suites in the
virtual hosts configuration file.
.. code-block:: nginx
# Set the TLS protocols and to only use modern, secure cipher suites.
ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
# Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
ssl_dhparam /etc/nginx/ssl/dhparam.pem;
.. _Guide to Deploying Diffie-Hellman for TLS: https://weakdh.org/sysadmin.html
.. _nginx secure configuration: https://gist.github.com/plentz/6737338

33
docs/admin/nginx-tuning.rst Normal file
View file

@ -0,0 +1,33 @@
.. _nginx-tuning:
Nginx Tuning
------------
Set the following properties in your ``/etc/nginx/proxy.conf`` so it does not
timeout during large pushes.
.. code-block:: nginx
proxy_redirect off;
proxy_set_header Host $host;
## needed for container auth
# proxy_set_header REMOTE_USER $remote_user;
# proxy_set_header X-Forwarded-User $remote_user;
proxy_set_header X-Url-Scheme $scheme;
proxy_set_header X-Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Proxy-host $proxy_host;
proxy_buffering off;
proxy_connect_timeout 7200;
proxy_send_timeout 7200;
proxy_read_timeout 7200;
proxy_buffers 8 32k;
# Set this to a larger number if you experience timeouts
client_max_body_size 1024m;
client_body_buffer_size 128k;
large_client_header_buffers 8 64k;
add_header X-Frame-Options SAMEORIGIN;
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

33
docs/admin/nginx-url-prefix.rst Normal file
View file

@ -0,0 +1,33 @@
.. _nginx_url-pre:
Nginx URL Prefix Configuration
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Use the following example to configure Nginx to use a URL prefix.
.. code-block:: nginx
location /foo {
rewrite /foo(.*) /$1 break;
proxy_pass http://localhost:3200;
proxy_redirect off;
proxy_set_header Host $host;
}
In addition to the Nginx configuration you will need to add the following
lines into the ``rhodecode.ini`` file.
* In the the ``[app:main]`` section of your ``rhodecode.ini`` file add the
following line.
.. code-block:: ini
filter-with = proxy-prefix
* At the end of the ``rhodecode.ini`` file add the following section.
.. code-block:: ini
[filter:proxy-prefix]
use = egg:PasteDeploy#prefix
prefix = /<someprefix> # Change <someprefix> into your chosen prefix

12
docs/admin/public-access.rst Normal file
View file

@ -0,0 +1,12 @@
.. _public-access:
Public Access
-------------
By default |RCM| allows users to read all **public** |repos|. User
permissions and |repo| access can be configured explicitly,
and those permissions will override any default settings. The default
settings can be found under the following section:
* :menuselection:`Admin --> Permissions --> Object`
* :menuselection:`Admin --> Permissions --> Global`

68
docs/admin/repo-extra-fields.rst Normal file
View file

@ -0,0 +1,68 @@
.. _repo-xtra:
Repository Extra Fields
=======================
Extra fields attached to a |repo| allow you to configure additional actions for
|RCX|. To install and read more about |RCX|, see the :ref:`install-rcx` section.
Enabling Extra Fields
---------------------
To enable extra fields on |repos|, use the following steps:
1. Go to the :menuselection:`Admin --> Settings --> Visual` page.
2. Check the :guilabel:`Use repository extra fields` box.
3. Save your changes.
Configuring Extra Fields
------------------------
To configure extra fields per repository, use the following steps:
1. Go to :menuselection:`Admin --> Repositories` and select :guilabel:`Edit`
beside the |repo| to which you wish to add extra fields.
2. On the |repo| settings page, select the :guilabel:`Extra fields` tab.
.. image:: ../images/extra-repo-fields.png
Example Usage
-------------
To use the extra fields in an extension, see the example below. For more
information and examples, see the :ref:`integrations-ref` section.
.. code-block:: python
call = load_extension('http_notify.py')
if call:
url = 'http://default.url' # <url for post data>
# possibly extract the URL from extra fields
call = load_extension('extra_fields.py')
if call:
repo_extra_fields = call(**kwargs)
# now update if we have extra fields, they have precedence
# this way users can store any configuration inside the database per
# repo
for key, data in repo_extra_fields.items():
kwargs[key] = data['field_value']
# an endpoint url data will be sent to, fetched from extra fields
# if exists, or fallback to default
kwargs['URL'] = kwargs.pop('webhook_url', None) or url
# fetch pushed commits, from commit_ids list
call = load_extension('extract_commits.py')
extracted_commits = {}
if call:
extracted_commits = call(**kwargs)
# store the commits for the next call chain
kwargs['COMMITS'] = extracted_commits
# set additional keys and values to be sent via POST to given URL
kwargs['caller_type'] = 'rhodecode'
kwargs['date'] = time.time() # import time before
call(**kwargs)

56
docs/admin/repo-hooks.rst Normal file
View file

@ -0,0 +1,56 @@
.. _repo-hooks:
|RCE| Repository Hooks
======================
|RCE| installs hooks inside each of the |repos| that it manages. These
hooks enable users to execute custom actions based on certain events.
This is the complete list of |repos| hooks and the events which trigger them:
.. rst-class:: dl-horizontal
\--CREATE_REPO_HOOK
Any time a |repo| is created.
\--CREATE_REPO_GROUP_HOOK
Any time a |repo| group is created.
\--CREATE_USER_HOOK
Any time a user is created.
\--DELETE_REPO_HOOK
Any time a |repo| is created.
\--DELETE_USER_HOOK
Any time a user is deleted.
\--PRE_CREATE_USER_HOOK
Any time a user is created but before the action is executed by |RCE|.
\--PRE_PULL
Any pull from a |repo| but before the action is executed by |RCE|.
\--PRE_PUSH
Any push to a |repo| but before the action is executed by |RCE|.
\--POST_PUSH
After any push to a |repo|.
\--PUSH_HOOK
Any push to a |repo|, including editing tags or branches.
Commits via API actions that update references are also counted.
\--PULL_HOOK
Any pull from a Repository.
Using Repository Hooks
----------------------
To use these hooks you need to install |RCX|. For more information, see the
:ref:`install-rcx` section.
Creating Extensions
-------------------
To create your own extensions using these hooks, see the :ref:`dev-plug`
section.

30
docs/admin/repo-issue-tracker.rst Normal file
View file

@ -0,0 +1,30 @@
.. _repo-it:
Repository Issue Tracker
========================
You can set an issue tracker connection in two ways with |RCE|.
* At instance level, for more information see the
:ref:`rhodecode-issue-trackers-ref` section.
* At |repo| level. This allows you to configure a |repo| to use a different
issue tracker to the default one.
Set an Issue Tracker per Repository
-----------------------------------
To configure a |repo| to work with a different issue tracker to the default one,
use the following steps:
1. Open :menuselection:`Admin --> Repositories --> repo name --> Edit --> Issue Tracker`
2. Uncheck the :guilabel:`Inherit from default settings` box.
3. Click :guilabel:`Add New`.
4. Fill in the following settings:
* :guilabel:`Description`: A name for this set of rules.
* :guilabel:`Pattern`: The regular expression that will match issues
tagged in commit messages, or more see :ref:`issue-tr-eg-ref`.
* :guilabel:`URL`: The URL to your issue tracker.
* :guilabel:`Prefix`: The prefix with which you want to mark issues.
5. Click :guilabel:`Save`.

45
docs/admin/repo-perm-steps.rst Normal file
View file

@ -0,0 +1,45 @@
.. _set-repo-perms:
Setting Repository Permissions
------------------------------
To set the permissions on an individual |repo|, use the following steps:
1. Open :menuselection:`Admin --> Repositories` and select
:guilabel:`edit` beside the |repo| you wish to configure.
2. On the |repo| settings page you will see a number of tabs. Exploring these
you will find the following main configuration options for a |repo|.
3. Once you make changes, select :guilabel:`Save`
* :guilabel:`Repository group`: Lets you to add a |repo| to a |repo| group.
* :guilabel:`Owner`: Lets you change the |repo| owner. Useful when users are
moving roles within an organisation.
* :guilabel:`Enable automatic locking`: For more information,
see :ref:`repo-locking`
* :guilabel:`User Access`: On the permissions tab you can add users,
or user groups, and set the permissions each has for that |repo|.
* :guilabel:`Invalidate repository cache`: On the Caches tab you can delete
the |repo| cache, sometimes needed when mirroring.
.. _set-repo-group-perms:
Setting Repository Group Permissions
------------------------------------
To set the permissions on a Repository Group, use the following steps:
1. Open :menuselection:`Admin --> Repository groups` and select
:guilabel:`edit` beside the |repo| you wish to configure.
2. On the |repo| group settings page you will see a number of tabs. Exploring
these you will find the following main configuration options:
* :guilabel:`Owner`: Lets you change the group owner. Useful when users are
moving roles within an organisation.
* :guilabel:`Group parent`: Lets you add the |repo| group as a sub-group
of a larger group, i.e. :guilabel:`QA-Repos >> QA-Repos-Berlin`
* :guilabel:`Enable automatic locking`: For more information,
see :ref:`repo-locking`
* :guilabel:`User Access`: On the permissions tab you can add users,
or user groups, and set the permissions each has for that |repo| group.
* :guilabel:`Add Child Group`: Allows you to add sub-repository-groups
that will all share the same permissions.

48
docs/admin/repo-vcs.rst Normal file
View file

@ -0,0 +1,48 @@
.. _per-repo-vcs:
Repository VCS Settings
=======================
You can configure |repo| VCS (Version Control System) settings at a global
level, and individually per |repo|. Global settings are applied by default.
If you configure individual settings per |repo|, these will remain unaffected
by any subsequent global changes.
Set Global Repository Settings
------------------------------
To configure |repo| settings across your |RCE| instance use the following steps:
1. Go to to the :menuselection:`Admin --> Settings --> VCS` page.
2. Configure the following |repo| options:
* :guilabel:`Web`: Require SSL if necessary.
* :guilabel:`Hooks`: Enable built in hooks.
* :guilabel:`Mercurial Settings`: Configure |hg| specific settings.
* :guilabel:`Repositories Location`: Set the file system |repos| location.
* :guilabel:`Subversion Settings`: Configure |svn| specific settings.
* :guilabel:`Pull Request Settings`: Enable the listed additional |pr|
features.
3. Click :guilabel:`Save`.
Set Individual Repository Settings
----------------------------------
To configure specific VCS settings for an individual |repo|, use the following
steps:
1. Go to to the :menuselection:`Admin --> Repositories --> Edit --> VCS` page.
2. Uncheck the :guilabel:`Inherit from global settings` box.
3. Configure the following |repo| options:
* :guilabel:`Hooks`: Enable built in hooks.
* :guilabel:`Mercurial Settings` (|hg| Only): Configure |hg| specific
settings.
* :guilabel:`Subversion Settings` (|svn| Only): Configure |svn| specific
settings.
* :guilabel:`Pull Request Settings` (|git| and |hg| Only): Enable the
listed additional |pr| features.
3. Click :guilabel:`Save`.

95
docs/admin/reset-information.rst Normal file
View file

@ -0,0 +1,95 @@
.. _rhodecode-reset-ref:
Settings Management
-------------------
All |RCE| settings can be set from the user interface, but in the event that
it somehow becomes unavailable you can use ``ishell`` inside your |RCE|
``virtualenv`` to carry out emergency measures.
.. warning::
Logging into the |RCE| database with ``iShell`` should only be done by an
experienced and knowledgeable database administrator.
Reset Admin Account Privileges
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
If you accidentally remove your admin privileges from the admin account you
can restore them using ``ishell``. Use the following example to reset your
account permissions.
.. code-block:: bash
# Open iShell from the terminal
$ .rccontrol/enterprise-5/profile/bin/paster \
ishell .rccontrol/enterprise-5/rhodecode.ini
.. code-block:: mysql
# Use this example to change user permissions
In [1]: adminuser = User.get_by_username('username')
In [2]: adminuser.admin = True
In [3]: Session.add(adminuser);Session().commit()
In [4]: exit()
Set to read global ``.hgrc`` file
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
By default, |RCE| does not read global ``hgrc`` files in
``/etc/mercurial/hgrc`` or ``/etc/mercurial/hgrc.d`` because it
can lead to issues. This is set in the ``rhodecode_ui`` table for which
there is no UI. If you need to edit this you can
manually change the settings using SQL statements with ``ishell``. Use the
following example to make changes to this table.
.. code-block:: bash
# Open iShell from the terminal
$ .rccontrol/enterprise-5/profile/bin/paster \
ishell.rccontrol/enterprise-5/rhodecode.ini
.. code-block:: mysql
# Use this example to enable global .hgrc access
In [4]: new_option = RhodeCodeUi()
In [5]: new_option.ui_section='web'
In [6]: new_option.ui_key='allow_push'
In [7]: new_option.ui_value='*'
In [8]: Session().add(new_option);Session().commit()
Manually Reset Password
^^^^^^^^^^^^^^^^^^^^^^^
If you need to manually reset a user password, use the following steps.
1. Navigate to your |RCE| install location.
2. Run the interactive ``ishell`` prompt.
3. Set a new password.
Use the following code example to carry out these steps.
.. code-block:: bash
# starts the ishell interactive prompt
$ .rccontrol/enterprise-5/profile/bin/paster \
ishell .rccontrol/enterprise-5/rhodecode.ini
.. code-block:: mysql
from rhodecode.lib.auth import generate_auth_token
from rhodecode.lib.auth import get_crypt_password
# Enter the user name whose password you wish to change
my_user = 'USERNAME'
u = User.get_by_username(my_user)
# If this fails then the user does not exist
u.auth_token = generate_auth_token(my_user)
# Set the new password
u.password = get_crypt_password('PASSWORD')
Session().add(u)
Session().commit()
exit

26
docs/admin/rhodecode-backup.rst Normal file
View file

@ -0,0 +1,26 @@
.. _backup:
====================
Backing up RhodeCode
====================
Settings
--------
Just copy your .ini file, it contains all RhodeCode settings.
Whoosh index
------------
Whoosh index is located in **/data/index** directory where you installed
RhodeCode ie. the same place where the ini file is located
Database
--------
When using sqlite just copy rhodecode.db.
Any other database engine requires a manual backup operation.
Database backup will contain all gathered statistics

31
docs/admin/sec-instance-basics.rst Normal file
View file

@ -0,0 +1,31 @@
.. _instance-basics:
3 Basic User Security Steps
===========================
By implementing the following user configuration tasks, you will help to
secure your |RCE| instances.
Define the Instance Wide Default User
-------------------------------------
The default user settings are applied across the whole instance. You should
define the default user so that newly created users immediately have
permission settings attached to their profile. For more information about
defining the default user settings, see the :ref:`default-perms` section.
Configure Specific User Groups
------------------------------
By defining user groups, it allows you to put users into them and
have the group permissions applied to their profile. For more information about
defining the default user settings, see the :ref:`user-admin-set` section.
Define the Default User in Each Group
-------------------------------------
Apart from the system wide user permissions, each user group can apply its
settings to the default user permissions within the scope of the group. To
set the default user's permissions inside a user group, see the
:ref:`permissions-info-repo-group-access` section.

19
docs/admin/sec-ip-white.rst Normal file
View file

@ -0,0 +1,19 @@
.. _settip-ip-white:
Setting IP Restrictions
=======================
To restrict access to your |RCE| instance you can set an IP Whitelist that
will only allow access from specific IP Addresses. This is useful for
ensuring only users on the company VPN can access the instance.
To set this, go to
:menuselection:`Username --> Permissions --> IP Whitelist`, and add the safe
range of IP Addresses to the list.
.. important::
Add the IP Address that you are currently using first,
otherwise you'll lock yourself out of the instance.
.. image:: ../images/ip-whitey.png

57
docs/admin/sec-x-frame.rst Normal file
View file

@ -0,0 +1,57 @@
.. _x-frame:
Securing HTTPS Connections
--------------------------
* To secure your |RCE| instance against `Cross Frame Scripting`_ exploits, you
should configure your webserver ``x-frame-options`` setting.
* To configure your instance for `HTTP Strict Transport Security`_, you need to
configure the ``Strict-Transport-Security`` setting.
Nginx
^^^^^
In your nginx configuration, add the following lines in the correct files. For
more detailed information see the :ref:`nginx-ws-ref` section.
.. code-block:: nginx
# Add this line to the nginx.conf file
add_header X-Frame-Options SAMEORIGIN;
# This line needs to be added inside your virtual hosts block/file
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
Apache
^^^^^^
In your :file:`apache2.conf` file, add the following line. For more detailed
information see the :ref:`apache-ws-ref` section.
.. code-block:: apache
# Add this to your virtual hosts file
Header always append X-Frame-Options SAMEORIGIN
# Add this line in your virtual hosts file
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
|RCE| Configuration
^^^^^^^^^^^^^^^^^^^
|RCE| can also be configured to force strict *https* connections and Strict
Transport Security. To set this, configure the following options to ``true``
in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
.. code-block:: ini
## force https in RhodeCode, fixes https redirects, assumes it's always https
force_https = false
## use Strict-Transport-Security headers
use_htsts = false
.. _Cross Frame Scripting: https://www.owasp.org/index.php/Cross_Frame_Scripting
.. _HTTP Strict Transport Security: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security

179
docs/admin/sec-your-server.rst Normal file
View file

@ -0,0 +1,179 @@
.. _sec-your-server:
Securing Your Server
--------------------
|RCE| runs on your hardware, and while it is developed with security in mind
it is also important that you ensure your servers are well secured. In this
section we will cover some basic security practices that are best to
configure when setting up your |RCE| instances.
SSH Keys
^^^^^^^^
Using SSH keys to access your server provides more security than using the
standard username and password combination. To set up your SSH Keys, use the
following steps:
1. On your local machine create the public/private key combination. The
private key you will keep, and the matching public key is copied to the
server. Setting a passphrase here is optional, if you set one you will
always be prompted for it when logging in.
.. code-block:: bash
# Generate SSH Keys
user@ubuntu:~$ ssh-keygen -t rsa
.. code-block:: bash
Generating public/private rsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_rsa):
Created directory '/home/user/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_rsa.
Your public key has been saved in /home/user/.ssh/id_rsa.pub.
The key fingerprint is:
02:82:38:95:e5:30:d2:ad:17:60:15:7f:94:17:9f:30 user@ubuntu
The key's randomart image is:
+--[ RSA 2048]----+
2. SFTP to your server, and copy the public key to the ``~/.ssh`` folder.
.. code-block:: bash
# SFTP to your server
$ sftp user@hostname
# copy your public key
sftp> mput /home/user/.ssh/id_rsa.pub /home/user/.ssh
Uploading /home/user/.ssh/id_rsa.pub to /home/user/.ssh/id_rsa.pub
/home/user/.ssh/id_rsa.pub 100% 394 0.4KB/s 00:00
3. On your server, add the public key to the :file:`~/.ssh/authorized_keys`
file.
.. code-block:: bash
$ cat /home/user/.ssh/id_rsa.pub > /home/user/.ssh/authorized_keys
You should now be able to log into your server using your SSH
Keys. If you've added a passphrase you'll be asked for it. For more
information about using SSH keys with |RCE| |repos|, see the
:ref:`ssh-connection` section.
VPN Whitelist
^^^^^^^^^^^^^
Most company networks will have a VPN. If you need to set one up, there are
many tutorials online for how to do that. Getting it right requires good
knowledge and attention to detail. Once set up, you can configure your
|RCE| instances to only allow user access from the VPN, to do this see the
:ref:`settip-ip-white` section.
Public Key Infrastructure and SSL/TLS Encryption
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Public key infrastructure (PKI) is a system that creates, manages, and
validates certificates for identifying nodes on a network and encrypting
communication between them. SSL or TLS certificates can be used to
authenticate different entities with one another. To read more about PKIs,
see the `OpenSSL PKI tutorial`_ site, or this `Cloudflare PKI post`_.
If the network you are running is SSL/TLS encrypted, you can configure |RCE|
to always use secure connections using the ``force_https`` and ``use_htsts``
options in the :file:`/home/user/.rccontrol/instance-id/rhodecode.ini` file.
For more details, see the :ref:`x-frame` section.
FireWalls and Ports
^^^^^^^^^^^^^^^^^^^
Setting up a network firewall for your internal traffic is a good way
of keeping it secure by blocking off any ports that should not be used.
Additionally, you can set non-default ports for certain functions which adds
an extra layer of security to your setup.
A well configured firewall will restrict access to everything except the
services you need to remain open. By exposing fewer services you reduce the
number of potential vulnerabilities.
There are a number of different firewall solutions, but for most Linux systems
using the built in `IpTables`_ firewall should suffice. On BSD systems you
can use `IPFILTER`_ or `IPFW`_. Use the following examples, and the IpTables
documentation to configure your IP Tables on Ubuntu.
Changing the default SSH port.
.. code-block:: bash
# Open SSH config file and change to port 10022
vi /etc/ssh/sshd_config
# What ports, IPs and protocols we listen for
Port 10022
Setting IP Table rules for SSH traffic. It is important to note that the
default policy of your IpTables can differ and it is worth checking how each
is configured. The options are *ACCEPT*, *REJECT*, *DROP*, or *LOG*. The
usual practice is to block access on all ports and then enable access only on
the ports you with to expose.
.. code-block:: bash
# Check iptables policy
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
# Close all ports by default
$ sudo iptables -P INPUT DROP
$ sudo iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
.. code-block:: bash
# Deny outbound SSH traffic
sudo iptables -A OUTPUT -p tcp --dport 10022 -j DROP
# Allow incoming SSH traffic on port 10022
sudo iptables -A INPUT -p tcp --dport 10022 -j ACCEPT
# Allow incoming HTML traffic on port 80 and 443
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
Saving your IP Table rules, and restoring them from file.
.. code-block:: bash
# Save you IP Table Rules
iptables-save
# Save your IP Table Rules to a file
sudo sh -c "iptables-save > /etc/iptables.rules"
# Restore your IP Table rules from file
iptables-restore < /etc/iptables.rules
.. _OpenSSL PKI tutorial: https://pki-tutorial.readthedocs.org/en/latest/#
.. _Cloudflare PKI post: https://blog.cloudflare.com/how-to-build-your-own-public-key-infrastructure/
.. _IpTables: https://help.ubuntu.com/community/IptablesHowTo
.. _IPFW: https://www.freebsd.org/doc/handbook/firewalls-ipfw.html
.. _IPFILTER: https://www.freebsd.org/doc/handbook/firewalls-ipf.html

15
docs/admin/security-tips.rst Normal file
View file

@ -0,0 +1,15 @@
.. _sec-tips:
=============
Security Tips
=============
The following section contains security tips for ensuring your |RCE|
instances are configured in as secure a manner as possible.
.. toctree::
sec-your-server
sec-x-frame
sec-instance-basics
sec-ip-white

69
docs/admin/setting-default-permissions.rst Normal file
View file

@ -0,0 +1,69 @@
.. _permissions-default-ref:
Setting Default Permissions
---------------------------
Default permissions allow you to configure |RCM| so that when a new |repo|, user group,
or user is created their permissions are already defined. To set default permissions you need administrator
privileges. See the following sections for setting up your permissions system:
* :ref:`user-default-ref`
* :ref:`user-group-default-ref`
* :ref:`repo-default-ref`
* :ref:`repo-group-default-ref`
.. _user-default-ref:
Setting User defaults
^^^^^^^^^^^^^^^^^^^^^
To set default user permissions, use the following steps.
1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`
2. Select the :guilabel:`Global` tab from the left-hand menu. The permissions
set on this screen apply to users and user-groups across the whole instance.
3. Save your changes
.. _user-group-default-ref:
Setting User Group defaults
^^^^^^^^^^^^^^^^^^^^^^^^^^^
To set default user group permissions, use the following steps.
1. From the |RCM| interface, select :menuselection:`Admin --> User groups`
2. Select :guilabel:`Permissions`, and configure the default user
permissions. All users will get these permissions unless
individually set.
3. Select :guilabel:`Global permissions`, and if you wish to configure
non-standard behaviour, uncheck the
:guilabel:`inherit from default settings` box and configure the desired
permissions
4. Save your changes
.. _repo-default-ref:
Setting Repository defaults
^^^^^^^^^^^^^^^^^^^^^^^^^^^
To set default |repo| permissions, use the following steps.
1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`
2. Select the :guilabel:`Object` tab from the left-hand menu and set the
|perm| permissions
3. Save your changes
.. _repo-group-default-ref:
Setting Repository Group defaults
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To set default Repository Group permissions, use the following steps.
1. From the |RCM| interface, select :menuselection:`Admin --> Repository Groups`
2. Select :guilabel:`Edit` beside the |repo| group you wish to configure
3. On the left-hand pane select :guilabel:`Permissions`
4. Set the default permissions for all |repos| created in this group
5. Save your changes
.. |perm| replace:: :guilabel:`None, Read, Write, or Admin`

26
docs/admin/setting-repo-perms.rst Normal file
View file

@ -0,0 +1,26 @@
.. _permissions-info-add-group-ref:
Repository Administration
=========================
Repository permissions in |RCM| can be managed in a number of different ways.
This overview should give you an insight into how you could adopt particular
settings for your needs:
* Global |repo| permissions: This allows you to set the default permissions
for each new |repo| created within |RCM|, see :ref:`repo-default-ref`. All
|repos| created will inherit these permissions unless explicitly configured.
* Individual |repo| permissions: To set individual |repo| permissions,
see :ref:`set-repo-perms`.
* Repository Group permissions: This allows you to define the permissions for
a group, and all |repos| created within that group will inherit the same
permissions.
.. toctree::
repo-perm-steps
repo-extra-fields
repo-hooks
repo-issue-tracker
repo-vcs

25
docs/admin/setting-usergroup-permissions.rst Normal file
View file

@ -0,0 +1,25 @@
.. _permissions-info-repo-group-access:
Setting User Group Permissions
------------------------------
To set User Group |repo| permissions, use follow these steps:
1. From the |RCE| interface, select
:menuselection:`Admin --> User Group --> Add User Group`
2. Enter a group name and description, and select :guilabel:`Save`
3. Select :guilabel:`edit` beside the new User Group. On the following
screen you will see a number of tabs. Exploring these
you will find the following most used options:
* :guilabel:`Owner`: This allows you to change the User Group owner. As
super-admin you will still have access to this, but changing the owner lets
you delegate the user group management to another manager.
* :guilabel:`Members`: This allows you to added or remove users from the
group.
* :guilabel:`User Permissions`: On the permissions tab you can set the
permissions for each member. If not individually set, the members will
inherit the default user permissions.
* :guilabel:`Inherit from default settings`: On the Global Permissions tab
you can uncheck this option and explicitly configure the permissions for
the group.

84
docs/admin/svn-http.rst Normal file
View file

@ -0,0 +1,84 @@
.. _svn-http:
|svn| With Write Over HTTP
--------------------------
To use |svn| with write access, the currently supported method is over HTTP.
This requires you to configure your local machine so that it can access your
|RCE| instance.
Prerequisites
^^^^^^^^^^^^^
- Enable lab setting on your |RCE| instance, see :ref:`lab-settings`.
- You need to install the following tools on your local machine: ``Apache`` and
``mod_dav_svn``. Use the following Ubuntu as an example.
.. code-block:: bash
$ sudo apt-get install apache2 libapache2-mod-svn
Once installed you need to enable ``dav_svn``:
.. code-block:: bash
$ sudo a2enmod dav_svn
Configuring Apache Setup
^^^^^^^^^^^^^^^^^^^^^^^^
.. tip::
It is recommended to run Apache on a port other than 80, due to possible
conflicts with other HTTP servers like nginx. To do this, set the
``Listen`` parameter in the ``/etc/apache2/ports.conf`` file, for example
``Listen 8090``
It is also recommended to run apache as the same user as |RCE|, otherwise
permission issues could occur. To do this edit the ``/etc/apache2/envvars``
.. code-block:: apache
export APACHE_RUN_USER=ubuntu
export APACHE_RUN_GROUP=ubuntu
1. To configure Apache, create and edit a virtual hosts file, for example
:file:`/etc/apache2/sites-available/default.conf`, or create another
virtual hosts file and add a location section inside the
``<VirtualHost>`` section.
.. code-block:: apache
<Location />
DAV svn
# Must be explicit path, relative not supported
SVNParentPath /PATH/TO/REPOSITORIES
SVNListParentPath On
Allow from all
Order allow,deny
</Location>
.. note::
Once configured, check that you can see the list of repositories on your
|RCE| instance.
2. Go to the :menuselection:`Admin --> Settings --> Labs` page, and
enable :guilabel:`Proxy Subversion HTTP requests`, and specify the
:guilabel:`Subversion HTTP Server URL`.
Using |svn|
^^^^^^^^^^^
Once |svn| has been enabled on your instance, you can use it using the
following examples. For more |svn| information, see the `Subversion Red Book`_
.. code-block:: bash
# To clone a repository
svn clone http://my-svn-server.example.com/my-svn-repo
# svn commit
svn commit
.. _Subversion Red Book: http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.ref.svn

29
docs/admin/system-admin.rst Normal file
View file

@ -0,0 +1,29 @@
.. _rhodecode-admin-ref:
System Administration
=====================
The following are the most common system administration tasks.
.. only:: latex
* :ref:`vcs-server`
* :ref:`apache-ws-ref`
* :ref:`nginx-ws-ref`
* :ref:`rhodecode-tuning-ref`
* :ref:`indexing-ref`
* :ref:`rhodecode-reset-ref`
.. toctree::
config-files-overview
vcs-server
apache-config
nginx-config
backup-restore
tuning-rhodecode
indexing
reset-information
enable-debug
admin-tricks
cleanup-cmds

163
docs/admin/system-overview.rst Normal file
View file

@ -0,0 +1,163 @@
.. _system-overview-ref:
System Overview
===============
Latest Version
--------------
* |release| on Unix and Windows systems.
System Architecture
-------------------
The following diagram shows a typical production architecture.
.. image:: ../images/architecture-diagram.png
:align: center
Supported Operating Systems
---------------------------
Linux
^^^^^
* Ubuntu 14.04
* CentOS 6.2 and 7
* Debian 7.8
* RedHat Fedora
* Arch Linux
* SUSE Linux
Windows
^^^^^^^
* Windows Vista Ultimate 64bit
* Windows 7 Ultimate 64bit
* Windows 8 Professional 64bit
* Windows 8.1 Enterprise 64bit
* Windows Server 2008 64bit
* Windows Server 2008-R2 64bit
* Windows Server 2012 64bit
Supported Databases
-------------------
* SQLite
* MySQL
* MariaDB
* PostgreSQL
Supported Browsers
------------------
* Chrome
* Safari
* Firefox
* Internet Explorer 10 & 11
System Requirements
-------------------
|RCM| performs best on machines with ultra-fast hard disks. Generally disk
performance is more important than CPU performance. In a corporate production
environment handling 1000s of users and |repos| you should deploy on a 12+
core 64GB RAM server. In short, the more RAM the better.
.. _config-rce-files:
Configuration Files
-------------------
* :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
* :file:`/home/{user}/.rccontrol/{instance-id}/mapping.ini`
* :file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini`
* :file:`/home/{user}/.rccontrol/supervisor/supervisord.ini`
* :file:`/home/{user}/.rccontrol.ini`
* :file:`/home/{user}/.rhoderc`
* :file:`/home/{user}/.rccontrol/cache/MANIFEST`
For more information, see the :ref:`config-files` section.
Log Files
---------
* :file:`/home/{user}/.rccontrol/{instance-id}/enterprise.log`
* :file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.log`
* :file:`/home/{user}/.rccontrol/supervisor/supervisord.log`
* :file:`/tmp/rccontrol.log`
* :file:`/tmp/rhodecode_tools.log`
Storage Files
-------------
* :file:`/home/{user}/.rccontrol/{instance-id}/data/index/{index-file.toc}`
* :file:`/home/{user}/repos/.rc_gist_store`
* :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.db`
* :file:`/opt/rhodecode/store/{unique-hash}`
Default Repositories Location
-----------------------------
* :file:`/home/{user}/repos`
Connection Methods
------------------
* HTTPS
* SSH
* |RCM| API
Internationalization Support
----------------------------
Currently available in the following languages, see `Transifex`_ for the
latest details. If you want a new language added, please contact us. To
configure your language settings, see the :ref:`set-lang` section.
.. hlist::
* Belorussian
* Chinese
* French
* German
* Italian
* Japanese
* Portuguese
* Polish
* Russian
* Spanish
Licencing Information
---------------------
* See licencing information `here`_
Peer-to-peer Failover Support
-----------------------------
* Yes
Additional Binaries
-------------------
* Yes, see :ref:`rhodecode-nix-ref` for full details.
Remote Connectivity
-------------------
* Available
Executable Files
----------------
Windows: :file:`RhodeCode-installer-{version}.exe`
Deprecated Support
------------------
- Internet Explorer 8 support deprecated since version 3.7.0.
- Internet Explorer 9 support deprecated since version 3.8.0.
.. _here: https://rhodecode.com/licenses/
.. _Transifex: https://www.transifex.com/projects/p/RhodeCode/

22
docs/admin/tuning-change-encoding.rst Normal file
View file

@ -0,0 +1,22 @@
.. _change-encoding:
Change Default Encoding
-----------------------
|RCE| uses ``utf8`` encoding by default. You can change the default encoding
in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. To
change the default encoding used by |RCE|, set a new value for the
``default_encoding``.
.. code-block:: ini
# default encoding used to convert from and to unicode
# can be also a comma separated list of encoding in case of mixed
# encodings
default_encoding = utf8
.. note::
Changing the default encoding will affect many parts of your |RCE|
installation, including committers names,
file names, and the encoding of commit messages.

32
docs/admin/tuning-change-large-file-dir.rst Normal file
View file

@ -0,0 +1,32 @@
.. _hg-lrg-loc:
Change the |hg| Large Files Location
------------------------------------
|RCE| manages |hg| larges files from the following default location
:file:`/home/{user}/repos/.cache/largefiles`. If you wish to change this, use
the following steps:
1. Open ishell from the terminal and use it to log into the |RCE| database by
specifying the instance :file:`rhodecode.ini` file.
.. code-block:: bash
# Open iShell from the terminal and set ini file
$ .rccontrol/enterprise-1/profile/bin/paster ishell .rccontrol/enterprise-1/rhodecode.ini
2. Run the following commands, and ensure that |RCE| has write access to the
new directory:
.. code-block:: mysql
# Once logged into the database, use SQL to redirect
# the large files location
In [1]: from rhodecode.model.settings import SettingsModel
In [2]: SettingsModel().get_ui_by_key('usercache')
Out[2]: <RhodeCodeUi[largefiles]usercache=>/mnt/hgfs/shared/workspace/xxxx/.cache/largefiles]>
In [3]: largefiles_cache = SettingsModel().get_ui_by_key('usercache')
In [4]: largefiles_cache.ui_value = '/new/path’
In [5]: Session().add(largefiles_cache);Session().commit()

111
docs/admin/tuning-gunicorn.rst Normal file
View file

@ -0,0 +1,111 @@
.. _increase-gunicorn:
Increase Gunicorn Workers
-------------------------
.. important::
If you increase the number of :term:`Gunicorn` workers, you also need to
increase the threadpool size of the VCS Server. The recommended size is
6 times the number of Gunicorn workers. To set this, see
:ref:`vcs-server-config-file`.
|RCE| comes with `Gunicorn`_ packaged in its Nix environment. To improve
performance you can increase the number of workers. To do this, use the
following steps:
1. Open the :file:`home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
2. In the ``[server:main]`` section, increase the number of Gunicorn
``workers`` using the following formula :math:`(2 * Cores) + 1`.
.. code-block:: ini
[server:main]
host = 127.0.0.1
port = 10002
use = egg:gunicorn#main
workers = 1
threads = 1
proc_name = RhodeCodeEnterprise
worker_class = sync
max_requests = 1000
timeout = 3600
3. In the ``[app:main]`` section, set the ``instance_id`` property to ``*``.
.. code-block:: ini
# In the [app:main] section
[app:main]
# You must set `instance_id = *`
instance_id = *
4. Save your changes.
5. Restart your |RCE| instance, using the following command:
.. code-block:: bash
$ rccontrol restart enterprise-1
If you scale across different machines, each |RCM| instance
needs to store its data on a shared disk, preferably together with your
|repos|. This data directory contains template caches, a whoosh index,
and is used for task locking to ensure safety across multiple instances.
To do this, set the following properties in the :file:`rhodecode.ini` file to
set the shared location across all |RCM| instances.
.. code-block:: ini
cache_dir = /file/path # set to shared location
search.location = /file/path # set to shared location
####################################
### BEAKER CACHE ####
####################################
beaker.cache.data_dir = /file/path # set to shared location
beaker.cache.lock_dir = /file/path # set to shared location
Gunicorn SSL support
--------------------
:term:`Gunicorn` wsgi server allows users to use HTTPS connection directly
without a need to use HTTP server like Nginx or Apache. To Configure
SSL support directly with :term:`Gunicorn` you need to simply add the key
and certificate paths to your configuration file.
1. Open the :file:`home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
2. In the ``[server:main]`` section, add two new variables
called `certfile` and `keyfile`.
.. code-block:: ini
[server:main]
host = 127.0.0.1
port = 10002
use = egg:gunicorn#main
workers = 1
threads = 1
proc_name = RhodeCodeEnterprise
worker_class = sync
max_requests = 1000
timeout = 3600
# adding ssl support
certfile = /home/ssl/my_server_com.pem
keyfile = /home/ssl/my_server_com.key
4. Save your changes.
5. Restart your |RCE| instance, using the following command:
.. code-block:: bash
$ rccontrol restart enterprise-1
After this is enabled you can *only* access your instances via https://
protocol. Check out more docs here `Gunicorn SSL Docs`_
.. _Gunicorn: http://gunicorn.org/
.. _Gunicorn SSL Docs: http://docs.gunicorn.org/en/stable/settings.html#ssl

17
docs/admin/tuning-hg-auth-loop.rst Normal file
View file

@ -0,0 +1,17 @@
.. _hg-auth-loop:
|hg| Authentication Tuning
--------------------------
When using external authentication tools such as LDAP with |hg|, a
password retry loop in |hg| can result in users being locked out due to too
many failed password attempts. To prevent this from happening, add the
following setting to your
:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file, in the
``[app:main]`` section.
.. code-block:: ini
[app:main]
auth_ret_code_detection = true

17
docs/admin/tuning-increase-cache-size.rst Normal file
View file

@ -0,0 +1,17 @@
.. _cache-size:
Increase Cache Size
-------------------
When managing hundreds of |repos| from the main |RCE| interface the system
can become slow when the cache expires. Increasing the cache expiration
option improves the response times of the main user interface.
To increase your cache size, change the following default value in the
:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. The value
is specified in seconds.
.. code-block:: ini
beaker.cache.long_term.expire=3600 # day (86400) week (604800)
.. note:: The |RCE| cache automatically expires for changed |repos|.

23
docs/admin/tuning-increase-db-performance.rst Normal file
View file

@ -0,0 +1,23 @@
.. _db-session-ref:
Increase Database Performance
-----------------------------
To increase database performance switch to database-based user sessions.
File-based sessions are only suitable for smaller setups. The most common
issue being file limit errors which occur if there are lots of session files.
Therefore, in a large scale deployment, to give better performance,
scalability, and maintainability we recommend switching from file-based
sessions to database-based user sessions.
To switch to database-based user sessions uncomment the following section in
your :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
.. code-block:: ini
# db session
beaker.session.type = ext:database
# adjust this property to include your database credentials
beaker.session.sa.url = postgresql://postgres:<pass>@localhost/rhodecode
beaker.session.table_name = db_session

42
docs/admin/tuning-mount-cache-memory.rst Normal file
View file

@ -0,0 +1,42 @@
.. _data-mem:
Mount Cache Folders To Memory
-----------------------------
To increase the performance of folders containing cache data, you can mount
them to memory. The following folders specified in the :file:`rhodecode.ini`
file would benefit from this.
.. code-block:: ini
cache_dir = %(here)s/data
search.location = %(here)s/data/index
Use the following Ubuntu example to mount these to memory, or see your
particular |os| instructions. The expected performance benefit is
approximately 5%. You should ensure you allocate an adequate amount of memory
depending on your available resources.
.. code-block:: bash
# mount to memory with 2GB limit and 755 write permissions
mount -t tmpfs -o size=2G,mode=0755 tmpfs /home/user/.rccontrol/enterprise-1/data
mount -t tmpfs -o size=2G,mode=0755 tmpfs /home/user/.rccontrol/enterprise-1/data/index
.. _move-tmp:
Move ``tmp`` to TMPFS
---------------------
|RCE| components heavily use the :file:`/tmp` folder, so moving your
:file:`/tmp` folder into to a RAM-based TMPS can lead to a noticeable
performance boost.
.. code-block:: bash
# mount tmp to memory with 2GB limit and 755 write permissions
mount -t tmpfs -o size=2G,mode=0755 tmpfs /tmp
For more information about TMPFS, see the documentation `here`_.
.. _here: https://wiki.archlinux.org/index.php/Tmpfs

20
docs/admin/tuning-rhodecode.rst Normal file
View file

@ -0,0 +1,20 @@
.. _rhodecode-tuning-ref:
Tuning |RCE|
============
To customize your |RCE| |version| installation for maximum performance you
may find some of the following methods useful.
.. toctree::
tuning-gunicorn
tuning-vcs-memory-cache
tuning-increase-db-performance
tuning-scale-horizontally
tuning-increase-cache-size
tuning-mount-cache-memory
tuning-change-encoding
tuning-change-large-file-dir
tuning-hg-auth-loop

51
docs/admin/tuning-scale-horizontally.rst Normal file
View file

@ -0,0 +1,51 @@
.. _scale-horizontal:
Scale Horizontally
------------------
Horizontal scaling means adding more machines or workers into your pool of
resources. Horizontally scaling |RCE| gives a huge performance increase,
especially under large traffic scenarios with a high number of requests. This
is very beneficial when |RCE| is serving many users simultaneously,
or if continuous integration servers are automatically pulling and pushing code.
To horizontally scale |RCE| you should use the following steps:
1. In the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file,
set ``instance_id = *``. This enables |RCE| to use multiple nodes.
2. Define the number of worker threads using the formula
:math:`(2 * Cores) + 1`. For example 4 CPU cores would lead to
:math:`(2 * 4) + 1 = 9` workers. In some cases it's ok to increase number of
workers even beyond this formula. Generally the more workers, the more
simultaneous connections the system can handle.
It is recommended to create another dedicated |RCE| instance to handle
traffic from build farms or continuous integration servers.
.. note::
You should configure your load balancing accordingly. We recommend writing
load balancing rules that will separate regular user traffic from
automated process traffic like continuous servers or build bots.
If you scale across different machines, each |RCE| instance needs to store
its data on a shared disk, preferably together with your repositories. This
data directory contains template caches, a whoosh index,
and is used for task locking to ensure safety across multiple instances. To
do this, set the following properties in the
:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file to set
the shared location across all |RCE| instances.
.. code-block:: ini
cache_dir = /file/path # set to shared directory location
search.location = /file/path # set to shared directory location
beaker.cache.data_dir = /file/path # set to shared directory location
beaker.cache.lock_dir = /file/path # set to shared directory location
.. note::
If Celery is used on each instance then you should run separate Celery
instances, but the message broker should be the same for all of them.
This excludes one RabbitMQ shared server.

8
docs/admin/tuning-vcs-memory-cache.rst Normal file
View file

@ -0,0 +1,8 @@
.. _adjust-vcs-mem-cache:
Adjusting VCS Memory Cache
--------------------------
The VCS Server mamory cache can be adjusted to work best with the resources
available to your |RCE| instance. If you find that memory resources are under
pressure, see the :ref:`vcs-server-maintain` section for details.

23
docs/admin/user-admin.rst Normal file
View file

@ -0,0 +1,23 @@
.. _user-admin-set:
User Administration
===================
|RCM| enables you to define permissions for the following entities within the
system; **users**, **user groups**, **repositories**, **repository groups**.
Within each one of these entities you can set default settings,
and then all users or |repos| inherit those default permission settings
unless individually defined. Each of these entities can have the following
permissions applied to it; |perm|.
.. toctree::
public-access
default-user-perms
adding-anonymous-user
adding-new-user
setting-default-permissions
setting-usergroup-permissions
.. |perm| replace:: **None**, **Read**, **Write**, or **Admin**

301
docs/admin/vcs-server.rst Normal file
View file

@ -0,0 +1,301 @@
.. _vcs-server:
VCS Server Management
---------------------
The VCS Server handles |RCM| backend functionality. You need to configure
a VCS Server to run with a |RCM| instance. If you do not, you will be missing
the connection between |RCM| and its |repos|. This will cause error messages
on the web interface. You can run your setup in the following configurations,
currently the best performance is one VCS Server per |RCM| instance:
* One VCS Server per |RCM| instance.
* One VCS Server handling multiple instances.
.. important::
If your server locale settings are not correctly configured,
|RCE| and the VCS Server can run into issues. See this `Ask Ubuntu`_ post
which explains the problem and gives a solution.
For more information, see the following sections:
* :ref:`install-vcs`
* :ref:`config-vcs`
* :ref:`vcs-server-options`
* :ref:`vcs-server-versions`
* :ref:`vcs-server-maintain`
* :ref:`vcs-server-config-file`
.. _install-vcs:
VCS Server Installation
^^^^^^^^^^^^^^^^^^^^^^^
To install a VCS Server, see
:ref:`Installing a VCS server <control:install-vcsserver>`.
.. _config-vcs:
Hooking |RCE| to its VCS Server
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To configure a |RCE| instance to use a VCS server, see
:ref:`Configuring the VCS Server connection <control:manually-vcsserver-ini>`.
.. _vcs-server-options:
|RCE| VCS Server Options
^^^^^^^^^^^^^^^^^^^^^^^^
The following list shows the available options on the |RCM| side of the
connection to the VCS Server. The settings are configured per
instance in the
:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
.. rst-class:: dl-horizontal
\vcs.backends <available-vcs-systems>
Set a comma-separated list of the |repo| options available from the
web interface. The default is ``hg, git, svn``,
which is all |repo| types available.
\vcs.connection_timeout <seconds>
Set the length of time in seconds that the VCS Server waits for
requests to process. After the timeout expires,
the request is closed. The default is ``3600``. Set to a higher
number if you experience network latency, or timeout issues with very
large push/pull requests.
\vcs.server.enable <boolean>
Enable or disable the VCS Server. The available options are ``true`` or
``false``. The default is ``true``.
\vcs.server <host:port>
Set the host, either hostname or IP Address, and port of the VCS server
you wish to run with your |RCM| instance.
.. code-block:: ini
##################
### VCS CONFIG ###
##################
# set this line to match your VCS Server
vcs.server = 127.0.0.1:10004
# Set to False to disable the VCS Server
vcs.server.enable = True
vcs.backends = hg, git, svn
vcs.connection_timeout = 3600
.. _vcs-server-versions:
VCS Server Versions
^^^^^^^^^^^^^^^^^^^
An updated version of the VCS Server is released with each |RCE| version. Use
the VCS Server number that matches with the |RCE| version to pair the
appropriate ones together. For |RCE| versions pre 3.3.0,
VCS Server 1.X.Y works with |RCE| 3.X.Y, for example:
* VCS Server 1.0.0 works with |RCE| 3.0.0
* VCS Server 1.2.2 works with |RCE| 3.2.2
For |RCE| versions post 3.3.0, the VCS Server and |RCE| version numbers
match, for example:
* VCS Server |release| works with |RCE| |release|
.. _vcs-server-maintain:
VCS Server Memory Optimization
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
To configure the VCS server to manage the cache efficiently, you need to
configure the following options in the
:file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini` file. Once
configured, restart the VCS Server.
.. rst-class:: dl-horizontal
\beaker.cache.repo_object.type = memorylru
Configures the cache to discard the least recently used items.
This setting takes the following valid options:
* ``memorylru``: The default setting, which removes the least recently
used items from the cache.
* ``memory``: Runs the VCS Server without clearing the cache.
* ``nocache``: Runs the VCS Server without a cache. This will
dramatically reduce the VCS Server performance.
\beaker.cache.repo_object.max_items = 100
Sets the maximum number of items stored in the cache, before the cache
starts to be cleared.
As a general rule of thumb, running this value at 120 resulted in a
5GB cache. Running it at 240 resulted in a 9GB cache. Your results
will differ based on usage patterns and |repo| sizes.
Tweaking this value to run at a fairly constant memory load on your
server will help performance.
To clear the cache completely, you can restart the VCS Server.
.. important::
While the VCS Server handles a restart gracefully on the web interface,
it will drop connections during push/pull requests. So it is recommended
you only perform this when there is very little traffic on the instance.
Use the following example to restart your VCS Server,
for full details see the :ref:`RhodeCode Control CLI <control:rcc-cli>`.
.. code-block:: bash
$ rccontrol status
.. code-block:: vim
- NAME: vcsserver-1
- STATUS: RUNNING
- TYPE: VCSServer
- VERSION: 1.0.0
- URL: http://127.0.0.1:10001
$ rccontrol restart vcsserver-1
Instance "vcsserver-1" successfully stopped.
Instance "vcsserver-1" successfully started.
.. _vcs-server-config-file:
VCS Server Configuration
^^^^^^^^^^^^^^^^^^^^^^^^
You can configure settings for multiple VCS Servers on your
system using their individual configuration files. Use the following
properties inside the configuration file to set up your system. The default
location is :file:`home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini`.
For a more detailed explanation of the logger levers, see :ref:`debug-mode`.
.. rst-class:: dl-horizontal
\host <ip-address>
Set the host on which the VCS Server will run.
\port <int>
Set the port number on which the VCS Server will be available.
\locale <locale_utf>
Set the locale the VCS Server expects.
\threadpool_size <int>
Set the size of the threadpool used to communicate
with the WSGI workers. This should be at least 6 times the number of
WSGI worker processes.
\timeout <seconds>
Set the timeout for RPC communication in seconds.
.. note::
After making changes, you need to restart your VCS Server to pick them up.
.. code-block:: ini
################################################################################
# RhodeCode VCSServer - configuration #
# #
################################################################################
[DEFAULT]
host = 127.0.0.1
port = 9900
locale = en_US.UTF-8
# number of worker threads, this should be set based on a formula threadpool=N*6
# where N is number of RhodeCode Enterprise workers, eg. running 2 instances
# 8 gunicorn workers each would be 2 * 8 * 6 = 96, threadpool_size = 96
threadpool_size = 16
timeout = 0
# cache regions, please don't change
beaker.cache.regions = repo_object
beaker.cache.repo_object.type = memorylru
beaker.cache.repo_object.max_items = 1000
# cache auto-expires after N seconds
beaker.cache.repo_object.expire = 10
beaker.cache.repo_object.enabled = true
################################
### LOGGING CONFIGURATION ####
################################
[loggers]
keys = root, vcsserver, pyro4, beaker
[handlers]
keys = console
[formatters]
keys = generic
#############
## LOGGERS ##
#############
[logger_root]
level = NOTSET
handlers = console
[logger_vcsserver]
level = DEBUG
handlers =
qualname = vcsserver
propagate = 1
[logger_beaker]
level = DEBUG
handlers =
qualname = beaker
propagate = 1
[logger_pyro4]
level = DEBUG
handlers =
qualname = Pyro4
propagate = 1
##############
## HANDLERS ##
##############
[handler_console]
class = StreamHandler
args = (sys.stderr,)
level = DEBUG
formatter = generic
[handler_file]
class = FileHandler
args = ('vcsserver.log', 'a',)
level = DEBUG
formatter = generic
[handler_file_rotating]
class = logging.handlers.TimedRotatingFileHandler
# 'D', 5 - rotate every 5days
# you can set 'h', 'midnight'
args = ('vcsserver.log', 'D', 5, 10,)
level = DEBUG
formatter = generic
################
## FORMATTERS ##
################
[formatter_generic]
format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
datefmt = %Y-%m-%d %H:%M:%S
.. _Ask Ubuntu: http://askubuntu.com/questions/162391/how-do-i-fix-my-locale-issue

2824
docs/api/api.rst Normal file
View file

File diff suppressed because it is too large Load diff

37
docs/auth/auth.rst Normal file
View file

@ -0,0 +1,37 @@
.. _authentication-ref:
Authentication Options
======================
|RCE| provides a built in authentication plugin
``rhodecode.lib.auth_rhodecode``. This is enabled by default and accessed
through the administrative interface. Additionally,
|RCE| provides a Pluggable Authentication System (PAS). This gives the
administrator greater control over how users authenticate with the system.
.. important::
You can disable the built in |RCM| authentication plugin
``rhodecode.lib.auth_rhodecode`` and force all authentication to go
through your authentication plugin. However, if you do this,
and your external authentication tools fails, you will be unable to
access |RCM|.
|RCM| comes with the following user authentication management plugins:
.. only:: latex
* :ref:`config-ldap-ref`
* :ref:`config-pam-ref`
* :ref:`config-crowd-ref`
* :ref:`config-token-ref`
.. toctree::
ldap-config-steps
crowd-auth
pam-auth
token-auth
ssh-connection

15
docs/auth/crowd-auth.rst Normal file
View file

@ -0,0 +1,15 @@
.. _config-crowd-ref:
Crowd
-----
To enable Crowd authentication, use the following steps:
1. From the |RCM| interface, go to :menuselection:`Admin --> Authentication`
2. Enable the ``rhodecode.lib.auth_modules.auth_crowd`` library and select
:guilabel:`Save`
3. On the Crowd plugin settings section, do the following:
* Check the :guilabel:`Enable` checkbox
* Enter your Crowd server settings
* Select :guilabel:`Save`

22
docs/auth/ldap-active-directory.rst Normal file
View file

@ -0,0 +1,22 @@
.. _ldap-act-dir-ref:
Active Directory
----------------
|RCM| can use Microsoft Active Directory for user authentication. This is
done through an LDAP or LDAPS connection to Active Directory. Use the
following example LDAP configuration setting to set your Active Directory
authentication.
.. code-block:: ini
# Set the Base DN
Base DN = OU=SBSUsers,OU=Users,OU=MyBusiness,DC=v3sys,DC=local
# Set the Active Directory SAM-Account-Name
Login Attribute = sAMAccountName
# Set the Active Directory user name
First Name Attribute = usernameame
# Set the Active Directory user surname
Last Name Attribute = user_surname
# Set the Active Directory user email
E-mail Attribute = userEmail

107
docs/auth/ldap-authentication.rst Normal file
View file

@ -0,0 +1,107 @@
.. _ldap-gloss-ref:
|LDAP| Glossary
---------------
This topic aims to give you a concise overview of the different settings and
requirements that enabling |LDAP| on |RCE| requires.
Required settings
^^^^^^^^^^^^^^^^^
The following LDAP attributes are required when enabling |LDAP| on |RCE|.
* **Hostname** or **IP Address**: Use a comma separated list for failover
support.
* **First Name**
* **Surname**
* **Email**
* **Port**: Port `389` for unencrypted LDAP or port `636` for SSL-encrypted
LDAP (LDAPS).
* **Base DN (Distinguished Name)**: The Distinguished Name (DN)
is how searches for users will be performed, and these searches can be
controlled by using an LDAP Filter or LDAP Search Scope. A DN is a sequence of
relative distinguished names (RDN) connected by commas. For example,
.. code-block:: vim
DN: cn='Monty Python',ou='people',dc='example',dc='com'
* **Connection security level**: The following are the valid types:
* *No encryption*: This connection type uses a plain non-encrypted connection.
* *LDAPS connection*: This connection type uses end-to-end SSL. To enable
an LDAPS connection you must set the following requirements:
* You must specify port `636`
* Certificate checks are required.
* To enable ``START_TLS`` on LDAP connection, set the path to the SSL
certificate in the default LDAP configuration file. The default
`ldap.conf` file is located in `/etc/openldap/ldap.conf`.
.. code-block:: vim
TLS_CACERT /etc/ssl/certs/ca.crt
* The LDAP username or account used to connect to |RCE|. This will be added
to the LDAP filter for locating the user object.
* For example, if an LDAP filter is specified as `LDAPFILTER`,
the login attribute is specified as `uid`, and the user connects as
`jsmith`, then the LDAP Filter will be like the following example.
.. code-block:: vim
(&(LDAPFILTER)(uid=jsmith))
* The LDAP search scope must be set. This limits how far LDAP will search for
a matching object.
* ``BASE`` Only allows searching of the Base DN.
* ``ONELEVEL`` Searches all entries under the Base DN,
but not the Base DN itself.
* ``SUBTREE`` Searches all entries below the Base DN, but not Base DN itself.
.. note::
When using ``SUBTREE`` LDAP filtering it is useful to limit object location.
Optional settings
^^^^^^^^^^^^^^^^^
The following are optional when enabling LDAP on |RCM|
* An LDAP account is only required if the LDAP server does not allow
anonymous browsing of records.
* An LDAP password is only required if the LDAP server does not allow
anonymous browsing of records
* Using an LDAP filter is optional. An LDAP filter defined by `RFC 2254`_. This
is more useful that the LDAP Search Scope if set to `SUBTREE`. The filter
is useful for limiting which LDAP objects are identified as representing
Users for authentication. The filter is augmented by Login Attribute
below. This can commonly be left blank.
* Certificate Checks are only required if you need to use LDAPS.
You can use the following levels of LDAP service with RhodeCode Enterprise:
* **NEVER** : A serve certificate will never be requested or checked.
* **ALLOW** : A server certificate is requested. Failure to provide a
certificate or providing a bad certificate will not terminate the session.
* **TRY** : A server certificate is requested. Failure to provide a
certificate does not halt the session; providing a bad certificate
halts the session.
* **DEMAND** : A server certificate is requested and must be provided
and authenticated for the session to proceed.
* **HARD** : The same as DEMAND.
.. note::
Only **DEMAND** or **HARD** offer full SSL security while the other
options are vulnerable to man-in-the-middle attacks.
|RCE| uses ``OPENLDAP`` libraries. This allows **DEMAND** or
**HARD** LDAPS connections to use self-signed certificates or
certificates that do not have traceable certificates of authority.
To enable this functionality install the SSL certificates in the
following directory: `/etc/openldap/cacerts`
.. _RFC 2254: http://www.rfc-base.org/rfc-2254.html

88
docs/auth/ldap-config-steps.rst Normal file
View file

@ -0,0 +1,88 @@
.. _config-ldap-ref:
LDAP
----
|RCM| supports LDAP (Lightweight Directory Access Protocol) authentication.
All LDAP versions are supported, with the following |RCM| plugins managing each:
* For LDAPv3 use ``rhodecode.lib.auth_modules.auth_ldap_group``
* For older LDAP versions use ``rhodecode.lib.auth_modules.auth_ldap``
.. important::
The email used with your |RCE| super-admin account needs to match the email
address attached to your admin profile in LDAP. This is because
within |RCE| the user email needs to be unique, and multiple users
cannot share an email account.
Likewise, if as an admin you also have a user account, the email address
attached to the user account needs to be different.
LDAP Configuration Steps
^^^^^^^^^^^^^^^^^^^^^^^^
To configure |LDAP|, use the following steps:
1. From the |RCM| interface, select
:menuselection:`Admin --> Authentication`
2. Enable the required plugin and select :guilabel:`Save`
3. Select the :guilabel:`Enabled` check box in the plugin configuration section
4. Add the required LDAP information and :guilabel:`Save`, for more details,
see :ref:`config-ldap-examples`
For a more detailed description of LDAP objects, see :ref:`ldap-gloss-ref`:
.. _config-ldap-examples:
Example LDAP configuration
^^^^^^^^^^^^^^^^^^^^^^^^^^
.. code-block:: bash
# Auth Cache TTL
3600
# Host
https://ldap1.server.com/ldap-admin/,https://ldap2.server.com/ldap-admin/
# Port
389
# Account
cn=admin,dc=rhodecode,dc=com
# Password
ldap-user-password
# LDAP connection security
LDAPS
# Certificate checks level
DEMAND
# Base DN
cn=Rufus Magillacuddy,ou=users,dc=rhodecode,dc=com
# User Search Base
ou=groups,ou=users
# LDAP search filter
(objectClass=person)
# LDAP search scope
SUBTREE
# Login attribute
rmagillacuddy
# First Name Attribute
Rufus
# Last Name Attribute
Magillacuddy
# Email Attribute
LDAP-Registered@email.ac
# User Member of Attribute
Organizational Role
# Group search base
cn=users,ou=groups,dc=rhodecode,dc=com
# LDAP Group Search Filter
(objectclass=posixGroup)
# Group Name Attribute
users
# Group Member Of Attribute
cn
# Admin Groups
admin,devops,qa
.. toctree::
ldap-active-directory
ldap-authentication

13
docs/auth/ldap-configuration-example.rst Normal file
View file

@ -0,0 +1,13 @@
LDAP Host hostname1,hostname2 # testing here
Port port
Account: `uid=admin,cn=users,cn=accounts,dc=localdomain,dc=tld`
Password: userpassword #Testing this here
Connection Security LDAPS
Certificate Checks ``NEVER``
Base DN cn=users,cn=accounts,dc=localdomain,dc=tld
LDAP Search Filter (objectClass=person)
LDAP Search Scope SUBTREE
Login Attribute uid
First Name Attribute givenname
Last Name Attribute sn
Email Attribute mail

14
docs/auth/pam-auth.rst Normal file
View file

@ -0,0 +1,14 @@
.. _config-pam-ref:
PAM
---
To enable PAM authentication, use the following steps:
1. From the |RCM| interface, go to :menuselection:`Admin --> Authentication`
2. Enable the ``rhodecode.lib.auth_modules.auth_pam`` library and select save
3. On the PAM plugin settings section, do the following:
* Check the :guilabel:`Enable` checkbox
* Enter your PAM server settings
* Select :guilabel:`Save`

129
docs/auth/ssh-connection.rst Normal file
View file

@ -0,0 +1,129 @@
.. _ssh-connection:
SSH Connection
--------------
If you wish to connect to your Git or Mercurial |repos| using SSH, use the
following instructions.
.. note::
SSH access with full |RCE| permissions will require an Admin |authtoken|.
You need to install the |RC| SSH tool on the server which is running
the |RCE| instance.
1. Gather the following information about the instance you wish to connect to:
* *Hostname*: Use the ``rccontrol status`` command to view instance details.
* *API key*: From the |RCE|, go to
:menuselection:`username --> My Account --> Auth Tokens`
* *Configuration file*: Identify the configuration file for that instance,
the default is :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
* Identify which |git| and |hg| packages your |RCM| instance is using.
* For |git|, see
:menuselection:`Admin --> Settings --> System Info`
* For |hg|, use the ``which hg`` command.
2. Clone the |RC| SSH script,
``hg clone https://code.rhodecode.com/rhodecode-ssh``
3. Copy the ``sshwrapper.sample.ini``, and save it as ``sshwrapper.ini``
4. Configure the :file:`sshwrapper.ini` file using the following example:
.. code-block:: ini
[api]
host=http://localhost:10005
key=24a67076d69c84670132f55166ac79d1faafd660
[shell]
shell=/bin/bash -l
[vcs]
root=/path/to/repos/
[rhodecode]
config=/home/user/.rccontrol/enterprise-3/rhodecode.ini
[vcs:hg]
path=/usr/bin/hg
# should be a base dir for all git binaries, i.e. not ../bin/git
[vcs:git]
path=/usr/bin
[keys]
path=/home/user/.ssh/authorized_keys
5. Add the public key to your |RCE| instance server using the
:file:`addkey.py` script. This script automatically creates
the :file:`authorized_keys` file which was specified in your
:file:`sshwrapper.ini` configuration. Use the following example:
.. code-block:: bash
$ ./addkey.py --user username --shell --key /home/username/.ssh/id_rsa.pub
.. important::
To give SSH access to all users, you will need to maintain
each users |authtoken| in the :file:`authorized_keys` file.
6. Connect to your server using SSH from your local machine.
.. code-block:: bash
$ ssh user@localhost
Enter passphrase for key '/home/username/.ssh/id_rsa':
If you need to manually configure the ``authorized_keys`` file,
add a line for each key using the following example:
.. code-block:: vim
command="/home/user/.rhodecode-ssh/sshwrapper.py --user username --shell",
no-port-forwarding,no-X11-forwarding,no-agent-forwarding ssh-rsa yourpublickey
.. tip::
Best practice would be to create a special SSH user account with each
users |authtoken| attached.
|RCE| will manage the user permissions based on the |authtoken| supplied.
This would allow you to immediately revoke all SSH access by removing one
user from your server if you needed to.
See the following command line example of setting this up. These steps
take place on the server.
.. code-block:: bash
# On the RhodeCode Enterprise server
# set up user and clone SSH tool
$ sudo adduser testuser
$ sudo su - testuser
$ hg clone https://code.rhodecode.com/rhodecode-ssh
$ cd rhodecode-ssh
# Copy and modify the sshwrapper.ini as explained in step 4
$ cp sshwrapper.sample.ini sshwrapper.ini
$ cd ~
$ mkdir .ssh
$ touch .ssh/authorized_keys
# copy your ssh public key, id_rsa.pub, from your local machine
# to the server. We’ll use it in the next step
$ python addkey.py --user testuser --shell --key /path/to/id_rsa.pub
# Note: testssh - user on the rhodecode instance
$ chmod 755 sshwrapper.py
Test the connection from your local machine using the following example:
.. code-block:: bash
# Test connection using the ssh command from the local machine
$ ssh testuser@my-server.example.com

76
docs/auth/token-auth.rst Normal file
View file

@ -0,0 +1,76 @@
.. _config-token-ref:
Authentication Tokens
---------------------
|RCE| has 4 different kinds of authentication tokens.
* *API tokens*: API tokens can only be used to execute |RCE| API operations.
You can store your API token and assign it to each instance in
the :file:`/home/{user}/.rhoderc` file. See the
example in :ref:`indexing-ref` section for more details.
* *Feed tokens*: The feed token can only be used to access the RSS feed.
Usually those are safe to store inside your RSS feed reader.
* *VCS tokens*: You can use these to authenticate with |git|, |hg| and |svn|
operations instead of a password. They are designed to be used with
CI Servers or other third party tools that require |repo| access.
They are also a good replacement for SSH based access.
To use these tokens you need be enabled special authentication method on
|RCE|, as they are disabled by default.
See :ref:`enable-vcs-tokens`.
* *Web Interface tokens*: These token allows users to access the web
interface of |RCE| without logging in.
You can add these tokens to an |RCE| server url, to expose the page content
based on the given token.
This is useful to integrate 3rd party systems, good example is to expose
raw diffs to another code-review system without having to worry about
authentication.
These tokens only work if a certain view is whitelisted
under `api_access_controllers_whitelist` inside
the :file:`rhodecode.ini` file.
.. code-block:: bash
# To download a repo without logging into Web UI
https://rhodecode.com/repo/archive/tip.zip?auth_token=<web-api-token>
# To show commit diff without logging into Web UI
https://rhodecode.com/repo/changeset-diff/<sha>?auth_token=<web-api-token>
.. _enable-vcs-tokens:
Enabling VCS Tokens
^^^^^^^^^^^^^^^^^^^
To enable VCS Tokens, use the following steps:
1. Go to :menuselection:`Admin --> Authentication`.
2. Enable the ``rhodecode.lib.auth_modules.auth_token`` plugin.
3. Click :guilabel:`Save`.
Authentication Token Tips
^^^^^^^^^^^^^^^^^^^^^^^^^
* Use Authentication Tokens instead of your password with external services.
* Create multiple Authentication Tokens on your account to enable
access to your |repos| with a different |authtoken| per method used.
* Set an expiry limit on certain tokens if you think it would be a good idea.
Creating Tokens
^^^^^^^^^^^^^^^
To create authentication tokens for an user, use the following steps:
1. From the |RCM| interface go to
:menuselection:`Username --> My Account --> Auth tokens`.
2. Label and Add the tokens you wish to use with |RCE|.
.. image:: ../images/tokens.png

13
docs/code-review/approve-changes.rst Normal file
View file

@ -0,0 +1,13 @@
.. _code-approve-changes-ref:
Approve Code Changes
--------------------
To approve commits, use the following steps:
1. Open the commit for review
2. Leave your comments inline or in the message box.
3. Set the review status from the drop-down menu and select :guilabel:`Comment`
.. image:: ../images/set-ci-status.png
:alt: Setting Commit Status

27
docs/code-review/code-review.rst Normal file
View file

@ -0,0 +1,27 @@
.. _code-review-ref:
Code Review
===========
|RCM| provides two ways in which you can review code. You can review |prs| or
commits. To better understand |prs|, see the :ref:`pull-requests-ref`
and :ref:`collaborate-ref` sections. For more information about why
code review matters, see these posts on the topic:
* `Code Review - Fix Bugs Early and Often`_
* `Code Review - How to Convince a Skeptic`_
* `Code Review - Learn How NASA Codes`_
You can also use the |RCE| API set up continuous integration servers to leave
comments from a test suite. See the :ref:`api` and
:ref:`integrations-ref` sections for examples on how to set this up.
.. toctree::
review-diffs
approve-changes
reviewing-best-practices
.. _Code Review - Fix Bugs Early and Often: https://rhodecode.com/blog/code-review-fix-bugs-early-often/
.. _Code Review - How to Convince a Skeptic: https://rhodecode.com/blog/code-review-convince-skeptic/
.. _Code Review - Learn How NASA Codes: https://rhodecode.com/blog/code-review-learn-nasa-codes/

42
docs/code-review/review-diffs.rst Normal file
View file

@ -0,0 +1,42 @@
.. _code-diff-side-ref:
Reviewing Diffs
---------------
Diffs are representations of changes made between different changesets of
a file. |RCE| provides 4 different types of diffs for each commit or
changeset, and depending on your preference you can use whichever for code
review purposes.
* Plain diff
* Full diff
* Side-by-side diff
* Raw diff
Reviewing Changes
-----------------
|RCM| displays all code changes made with each commit. Removed content is
marked in red and new content in green.
.. image:: ../images/plain-diff.png
:alt: Plain Diff
Side-By-Side Diffs
------------------
To review code with a side-by-side diff, use the following steps:
1. Open the repository in which you wish to review a file
2. Select the revision you wish to review
3. Select the side-by-side diff icon beside the file name
.. image:: ../images/side-by-side-diff.png
:alt: Side by side diff
Notifying Users
---------------
To notify other users of you comments, or requests for feedback,
see :ref:`review-notifications-ref`

21
docs/code-review/reviewing-best-practices.rst Normal file
View file

@ -0,0 +1,21 @@
.. _code-best-practices-ref:
Code Review - Best Practices
----------------------------
The following is a list of best practices for reviewing code gathered from
various sources:
* **Implement a Core Review standard**, because the yield of the Code Review
phase is 50 to 80% better than that of the Test phase.
* Review between **100 and 300 lines of code** at a time and spend 30-60 minutes
doing it for best results.
* **Avoid code review meetings**, because meetings contributed only 4% of the
defects found in the code inspections.
* Slow down to a comfortable pace, as reviewers **slower than 400 lines per
hour are above average** in their ability to uncover defects. But when faster
than 450 lines/hour the defect density is below average in 87% of the cases.
* Take a time-out, because defects are found at relatively constant rates
through the first **60 minutes of inspection**. At that point the
checklist-style review levels off sharply; the other review styles level
off slightly later. In no case is a defect discovered after 90 minutes.

19
docs/collaboration/approve-pull-request.rst Normal file
View file

@ -0,0 +1,19 @@
Approve |prs|
-------------
To approve a |pr|, use the following steps:
1. Select :menuselection:`username --> Notifications --> Pull Requests`
and open the |pr| you with to approve
2. Leave your review comments inline, or in the commit message.
3. Leave a commit message that outlines the review.
4. Set the review status to :guilabel:`Approved`
5. Select :guilabel:`Comment`
If you approve the |pr|, you will be able to merge automatically if |RCM|
detects that it can do so safely. You will see this message:
:guilabel:`This pull request can be automatically merged.`
Otherwise you will need to merge the |pr| locally and push your changes, see
:ref:`manual-merge-requests-ref`.

24
docs/collaboration/collaboration.rst Normal file
View file

@ -0,0 +1,24 @@
.. _collaborate-ref:
Collaboration
=============
.. note::
Forking and branching does not work with |svn| |repos|.
Collaboration in |RCM| is accomplished through a combination of the following
functions:
.. only:: latex
* :ref:`review-notifications-ref`
* :ref:`forks-branches-ref`
* :ref:`pull-requests-ref`
.. toctree::
workflow
forks-branches
repo-locking

31
docs/collaboration/fixing-common-commits.rst Normal file
View file

@ -0,0 +1,31 @@
.. _merging-empty-repo-ref:
Merging Forks with an Empty Repository
======================================
When a new repository is created, it has no commits. If the empty repository is
forked, neither |repo| will have any shared information to link them together,
making it impossible to create a |pr| to merge them.
To avoid this problem, create an initial commit on the new repository before
forking it. It can be accomplished, for example, by adding a README file to the
master repository and commiting it to the server before forking.
In case the fork was already made and you are unable to push or merge due to the
lack of a common commit between both repositories, the following steps would
enable you to fix this problem.
1. Create a commit on the master repository.
2. Pull the changes from the fork to the master repository, and rebase them
on top of the new commit.
.. code-block:: bash
#pull from the fork into master
$ hg pull -r fork-commit-id
3. If the changes were made locally, push the changes to the server.
4. On the forked repository, pull the changes from master.
Now you should be able to create a |pr| or merge between both repositories.

101
docs/collaboration/forks-branches.rst Normal file
View file

@ -0,0 +1,101 @@
.. _forks-branches-ref:
Forking and Branching
---------------------
Forking clones the original |repo| and creates an independent |repo|.
Branching allows you to develop independently
of the main branch based on the changeset branched, but remains linked to the
main |repo|.
Both provide excellent collaboration functionality,
and do not differ greatly, but you can find many online discussions
where people fight about the differences.
Fork a |repo|
^^^^^^^^^^^^^
To fork a |repo|, use the following steps:
1. Select :menuselection:`Admin --> repositories`
2. Select the |repo| you wish to fork.
3. Select :menuselection:`Options --> Fork`
4. On the :guilabel:`Create fork` page, set the following properties:
* The fork name
* The fork description
* If the fork is private or public
* The copy permissions
Branch a |git| |repo|
^^^^^^^^^^^^^^^^^^^^^
Currently branching is only supported from the command line but is picked up
on the web interface. To branch a |git| |repo| use the following example:
.. code-block:: bash
# branch and checkout
git branch new-branch
git checkout new-branch
# same function shorthand
git checkout -b new-branch
# Example usage
$ git checkout -b example-branch
Switched to a new branch 'example-branch'
$ git status
On branch example-branch
Initial commit
nothing to commit (create/copy files and use "git add" to track)
$ vi example-script.sh
$ git add example-script.sh
$ git commit -a -m "ghost script: initial file"
$ git push
Once it is pushed to the |RCM| server, you can switch to the newly created
branch using the following steps:
1. Select :menuselection:`Admin --> Repositories`.
2. Select the |repo| you branched.
3. Select :menuselection:`Switch To --> Branches` and choose the new branch.
For more information, your can read more here on the Git website,
`Git Branching`_.
Branch a |hg| |repo|
^^^^^^^^^^^^^^^^^^^^
.. note::
To use branches in |hg| like |git|, use the `hg bookmark` option instead.
Also see the :ref:`bvb` section for more information.
To branch a |hg| |repo|, use the following example and push your changes to
the main |repo|. Once pushed, you can view the new branch in |RCE| by
selecting :menuselection:`Switch To --> Branches` from the |repo| page.
.. code-block:: bash
$ hg branch example-456
$ hg ci -m "branch: ticket #456"
$ hg push --new-branch
Bookmark a |hg| |repo|
^^^^^^^^^^^^^^^^^^^^^^
Bookmarks are used in |hg| in much the same way as branches are in |git|. See
the `Mercurial Bookmarks`_ documentation for more information.
.. code-block:: bash
$ hg bookmark example-456
$ hg ci -m "branch: ticket #456"
$ hg push -B example-456
.. image:: ../images/branch-example.png
.. _Git Branching: http://git-scm.com/book/en/v2/Git-Branching-Basic-Branching-and-Merging
.. _Mercurial Bookmarks: https://mercurial.selenic.com/wiki/Bookmarks

39
docs/collaboration/mention-reviewer-function.rst Normal file
View file

@ -0,0 +1,39 @@
.. _user-notify-ref:
Using Notifications
-------------------
To notify users of items that require their attention you can use the mention
function. The mention function allows you to use ``@username`` within |RCM|.
The notification function can be used within the following
items to highlight their need for attention:
* Commit messages
* Pull requests
* Inline comments
* Code review
.. note::
Mentioned users will receive an email and a notification.
Pull Request Notifications
--------------------------
To notify a user of a pull request, use the following steps.
1. Open the repository fork
2. Select :guilabel:`Open new pull request`
3. Add the :guilabel:`@username` in the :guilabel:`Pull request viewers`
input field.
4. Select :guilabel:`Submit Pull Request`
Commit Message Notifications
----------------------------
To notify a user in a commit message, use the following steps.
1. Open a repository with commits in it.
2. Click on the commit message or revision number.
3. Add an :guilabel:`@username` in an inline comment or in your approval
comment and commit.

35
docs/collaboration/merge-pull-request.rst Normal file
View file

@ -0,0 +1,35 @@
.. _merge-requests-ref:
Merge a |pr|
------------
|RCM| can detect if it can automatically merge the changes in a |pr|. If it
can, you will see the following message:
:guilabel:`This pull request can be automatically merged.` To merge,
click the big blue button! To enable this feature, see :ref:`server-side-merge`.
.. image:: ../images/merge-pr-button.png
If you cannot automatically merge a |pr|, you will see one of the following
messages:
* :guilabel:`This pull request cannot be merged because of conflicts`
* :guilabel:`Reviewer approval is pending`
.. _manual-merge-requests-ref:
Manual Merge a |PR|
^^^^^^^^^^^^^^^^^^^
If |RCM| cannot safely merge the changes in a |pr|,
usually due to conflicts, you need to manually merge the changes on the
command line. You can see more information for each |repo| type at the
following links:
* `Git Manual Merging`_
* `Mercurial Manual Merging`_
* `Subversion Manual Merging`_
.. _Git Manual Merging: http://git-scm.com/book/en/v2/Git-Branching-Basic-Branching-and-Merging
.. _Mercurial Manual Merging: http://hgbook.red-bean.com/read/a-tour-of-mercurial-merging-work.html
.. _Subversion Manual Merging: http://svnbook.red-bean.com/en/1.7/svn.branchmerge.basicmerging.html

22
docs/collaboration/notifications-overview.rst Normal file
View file

@ -0,0 +1,22 @@
Notifications Overview
----------------------
|RCM| has an integrated notification system which alerts users to requests
that they have received. Notifications can occur for the following reasons:
* Pull request reviews
* Commit message mentions
When someone opens a |pr| on one of your |repos|, or adds you as a |pr|
reviewer, you will receive a notification in |RCE| and an email,
if not configured see :ref:`set-up-mail`. Also, during the review process you
receive notifications on the following actions:
* New comments
* Status changes
* Inline code review comments
Each notifications provides a link to take you directly to the issue.
.. image:: ../images/notifications.png
:alt: Notifying Colleagues

34
docs/collaboration/open-pull-request.rst Normal file
View file

@ -0,0 +1,34 @@
.. _open-requests-ref:
Open a |pr|
-----------
.. important::
To open a |pr|, it is necessary that the source and the target repositories
have at least one commit in common. For more information,
see :ref:`merging-empty-repo-ref`.
Once you have finished your work on a fork and want your work merged with the
original |repo|, you need to open a |pr|. To open a |pr| and send for
review, use the following steps:
1. Select
:menuselection:`Admin --> repositories --> repo name --> Options --> Create Pull Request`
2. On the :guilabel:`New Pull Request` page, enter the following information:
* The |pr| name.
* The |pr| description.
* Add the reviewer names in the :guilabel:`Pull Request Reviewer` field.
3. Review the changesets that make up the |pr|.
4. Select :guilabel:`Submit Pull Request`.
.. image:: ../images/open-pr.png
:alt: Open a pull request
The pull request can either be merged into the original repository,
or it can be declined due to issues during the review process. If issues
arise, you can fix them and update the |pr|. For more,
see :ref:`update-requests-ref`.

7
docs/collaboration/pr-flow.rst Normal file
View file

@ -0,0 +1,7 @@
Pull Request Workflow
---------------------
The following diagram represents a standard pull request workflow.
.. image:: ../images/pull-request-flow.png
:align: center

Some files were not shown because too many files have changed in this diff Show more