project: added all source files and assets

.bumpversion.cfg

@@ -0,0 +1,5 @@
+[bumpversion]
+current_version = 4.0.0
+message = release: Bump version {current_version} to {new_version}
+
+[bumpversion:file:rhodecode/VERSION]

.coveragerc

@@ -0,0 +1,18 @@
+[run]
+
+branch = True
+
+include =
+    rhodecode/lib/*
+    rhodecode/model/*
+    rhodecode/controllers/*
+
+omit =
+    rhodecode/lib/vcs/remote/*
+    rhodecode/lib/dbmigrate/*
+
+[report]
+
+exclude_lines =
+    raise NotImplementedError
+

.jshintrc

@@ -0,0 +1,38 @@
+{
+  /*
+   * ENVIRONMENTS
+   * =================
+   */
+
+  // Define globals exposed by modern browsers.
+  "browser": true,
+
+  // Define globals exposed by jQuery.
+  "jquery": true,
+
+  /*
+   * ENFORCING OPTIONS
+   * =================
+   */
+
+  // Prohibit use of == and != in favor of === and !==.
+  "eqeqeq": true,
+
+  // Enforce tab width of 2 spaces.
+  "indent": 2,
+
+  // Prohibit use of a variable before it is defined.
+  "latedef": true,
+
+  // Enforce line length to 100 characters
+  "maxlen": 100,
+
+  // Require capitalized names for constructor functions.
+  "newcap": true,
+
+  // Enforce placing 'use strict' at the top function scope
+  "strict": true,
+
+  // Prohibit use of explicitly undeclared variables.
+  "undef": true
+}

.release.cfg

@@ -0,0 +1,31 @@
+[DEFAULT]
+done = false
+
+[task:fixes_on_stable]
+done = true
+
+[task:changelog_updated]
+done = true
+
+[task:nix_dependencies_moved]
+done = true
+
+[task:bump_version]
+done = true
+
+[task:generate_js_routes]
+done = true
+
+[task:generate_api_docs]
+done = true
+
+[release]
+state = prepared
+version = 3.8.3
+
+[task:updated_translation]
+
+[task:updated_trial_license]
+
+[task:generate_oss_licenses]
+

.tx/config

@@ -0,0 +1,18 @@
+[main]
+host = https://www.transifex.com
+
+[RhodeCode.pot]
+source_file = rhodecode/i18n/rhodecode.pot
+source_lang = en
+type = PO
+
+trans.be    = rhodecode/i18n/be/LC_MESSAGES/rhodecode.po
+trans.de    = rhodecode/i18n/de/LC_MESSAGES/rhodecode.po
+trans.es    = rhodecode/i18n/es/LC_MESSAGES/rhodecode.po
+trans.fr    = rhodecode/i18n/fr/LC_MESSAGES/rhodecode.po
+trans.it    = rhodecode/i18n/it/LC_MESSAGES/rhodecode.po
+trans.ja    = rhodecode/i18n/ja/LC_MESSAGES/rhodecode.po
+trans.pl    = rhodecode/i18n/pl/LC_MESSAGES/rhodecode.po
+trans.pt    = rhodecode/i18n/pt/LC_MESSAGES/rhodecode.po
+trans.ru    = rhodecode/i18n/ru/LC_MESSAGES/rhodecode.po
+trans.zh    = rhodecode/i18n/zh/LC_MESSAGES/rhodecode.po

CHANGES.rst

@@ -0,0 +1 @@
+.. include:: docs/release-notes/release-notes.rst

Gruntfile.js

@@ -0,0 +1,137 @@
+module.exports = function(grunt) {
+  grunt.initConfig({
+
+    dirs: {
+      css: "rhodecode/public/css",
+      js: {
+        "src": "rhodecode/public/js/src",
+        "dest": "rhodecode/public/js"
+      }
+    },
+
+    concat: {
+      dist: {
+        src: [
+          // Base libraries
+          '<%= dirs.js.src %>/jquery-1.11.1.min.js',
+          '<%= dirs.js.src %>/logging.js',
+          '<%= dirs.js.src %>/bootstrap.js',
+          '<%= dirs.js.src %>/mousetrap.js',
+          '<%= dirs.js.src %>/moment.js',
+          '<%= dirs.js.src %>/appenlight-client-0.4.1.min.js',
+
+          // Plugins
+          '<%= dirs.js.src %>/plugins/jquery.pjax.js',
+          '<%= dirs.js.src %>/plugins/jquery.dataTables.js',
+          '<%= dirs.js.src %>/plugins/flavoured_checkbox.js',
+          '<%= dirs.js.src %>/plugins/jquery.auto-grow-input.js',
+          '<%= dirs.js.src %>/plugins/jquery.autocomplete.js',
+          '<%= dirs.js.src %>/plugins/jquery.debounce.js',
+          '<%= dirs.js.src %>/plugins/jquery.timeago.js',
+          '<%= dirs.js.src %>/plugins/jquery.timeago-extension.js',
+
+          // Select2
+          '<%= dirs.js.src %>/select2/select2.js',
+          
+          // Code-mirror
+          '<%= dirs.js.src %>/codemirror/codemirror.js',
+          '<%= dirs.js.src %>/codemirror/codemirror_loadmode.js',
+          '<%= dirs.js.src %>/codemirror/codemirror_hint.js',
+          '<%= dirs.js.src %>/codemirror/codemirror_overlay.js',
+          '<%= dirs.js.src %>/codemirror/codemirror_placeholder.js',
+          // TODO: mikhail: this is an exception. Since the code mirror modes
+          // are loaded "on the fly", we need to keep them in a public folder
+          '<%= dirs.js.dest %>/mode/meta.js',
+          '<%= dirs.js.dest %>/mode/meta_ext.js',
+          '<%= dirs.js.dest %>/rhodecode/i18n/select2/translations.js',
+
+          // Rhodecode utilities
+          '<%= dirs.js.src %>/rhodecode/utils/array.js',
+          '<%= dirs.js.src %>/rhodecode/utils/string.js',
+          '<%= dirs.js.src %>/rhodecode/utils/pyroutes.js',
+          '<%= dirs.js.src %>/rhodecode/utils/ajax.js',
+          '<%= dirs.js.src %>/rhodecode/utils/autocomplete.js',
+          '<%= dirs.js.src %>/rhodecode/utils/colorgenerator.js',
+          '<%= dirs.js.src %>/rhodecode/utils/ie.js',
+          '<%= dirs.js.src %>/rhodecode/utils/os.js',
+
+          // Rhodecode widgets
+          '<%= dirs.js.src %>/rhodecode/widgets/multiselect.js',
+
+          // Rhodecode components
+          '<%= dirs.js.src %>/rhodecode/pyroutes.js',
+          '<%= dirs.js.src %>/rhodecode/codemirror.js',
+          '<%= dirs.js.src %>/rhodecode/comments.js',
+          '<%= dirs.js.src %>/rhodecode/constants.js',
+          '<%= dirs.js.src %>/rhodecode/files.js',
+          '<%= dirs.js.src %>/rhodecode/followers.js',
+          '<%= dirs.js.src %>/rhodecode/menus.js',
+          '<%= dirs.js.src %>/rhodecode/notifications.js',
+          '<%= dirs.js.src %>/rhodecode/permissions.js',
+          '<%= dirs.js.src %>/rhodecode/pjax.js',
+          '<%= dirs.js.src %>/rhodecode/pullrequests.js',
+          '<%= dirs.js.src %>/rhodecode/settings.js',
+          '<%= dirs.js.src %>/rhodecode/select2_widgets.js',
+          '<%= dirs.js.src %>/rhodecode/tooltips.js',
+          '<%= dirs.js.src %>/rhodecode/users.js',
+          '<%= dirs.js.src %>/rhodecode/appenlight.js',
+
+          // Rhodecode main module
+          '<%= dirs.js.src %>/rhodecode.js'
+        ],
+        dest: '<%= dirs.js.dest %>/scripts.js',
+        nonull: true
+      }
+    },
+
+    less: {
+      development: {
+        options: {
+          compress: false,
+          yuicompress: false,
+          optimization: 0
+        },
+        files: {
+          "<%= dirs.css %>/style.css": "<%= dirs.css %>/main.less"
+        }
+      },
+      production: {
+        options: {
+          compress: true,
+          yuicompress: true,
+          optimization: 2
+        },
+        files: {
+          "<%= dirs.css %>/style.css": "<%= dirs.css %>/main.less"
+        }
+      }
+    },
+
+    watch: {
+      less: {
+        files: ["<%= dirs.css %>/*.less"],
+        tasks: ["less:production"]
+      },
+      js: {
+        files: ["<%= dirs.js.src %>/**/*.js"],
+        tasks: ["concat:dist"]
+      }
+    },
+
+    jshint: {
+      rhodecode: {
+        src: '<%= dirs.js.src %>/rhodecode/**/*.js',
+        options: {
+          jshintrc: '.jshintrc'
+        }
+      }
+    }
+  });
+
+  grunt.loadNpmTasks('grunt-contrib-less');
+  grunt.loadNpmTasks('grunt-contrib-concat');
+  grunt.loadNpmTasks('grunt-contrib-watch');
+  grunt.loadNpmTasks('grunt-contrib-jshint');
+
+  grunt.registerTask('default', ['less:production', 'concat:dist']);
+};

LICENSE.txt

@@ -0,0 +1,690 @@
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License, version 3
+(only), as published by the Free Software Foundation.
+
+
+This program incorporates work covered by the following copyright and
+permission notice:
+
+   Copyright (c) 2014-2016 - packaging
+       file:
+   Copyright (c) 2008-2011 - msgpack-python
+       file:licenses/msgpack_license.txt
+
+Both licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+imitations under the License.
+
+
+Below is the full text of GNU Affero General Public License, version 3
+
+
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<http://www.gnu.org/licenses/>.

MANIFEST.in

@@ -0,0 +1,48 @@
+# top level files
+include test.ini
+include MANIFEST.in
+include README.rst
+include rhodecode/VERSION
+
+# docs
+recursive-include docs *
+
+# init.d
+recursive-include init.d *
+
+# translations
+recursive-include rhodecode/i18n *
+
+# bin stuff
+recursive-include rhodecode/bin *
+
+# hook templates
+recursive-include rhodecode/config/hook_templates *
+
+# non-python core stuff
+recursive-include rhodecode *.cfg
+recursive-include rhodecode *.json
+recursive-include rhodecode *.ini_tmpl
+recursive-include rhodecode *.sh
+
+# images, css
+include rhodecode/public/css/*.css
+include rhodecode/public/images/*.*
+
+# sound files
+include rhodecode/public/sounds/*.mp3
+include rhodecode/public/sounds/*.wav
+
+# fonts
+recursive-include rhodecode/public/fonts/ProximaNova *
+recursive-include rhodecode/public/fonts/RCIcons *
+
+# js
+recursive-include rhodecode/public/js *
+
+# templates
+recursive-include rhodecode/templates *
+
+# skip any tests files
+recursive-exclude rhodecode/tests *
+

Makefile

@@ -0,0 +1,39 @@
+
+WEBPACK=./node_modules/webpack/bin/webpack.js
+GRUNT=grunt
+NODE_PATH=./node_modules
+FLAKE8=flake8 setup.py pytest_pylons/ rhodecode/ --select=E124 --ignore=E711,E712,E510,E121,E122,E126,E127,E128,E501,F401 --max-line-length=100 --exclude=*rhodecode/lib/dbmigrate/*,*rhodecode/tests/*,*rhodecode/lib/vcs/utils/*
+CI_PREFIX=enterprise
+
+.PHONY: help clean test test-clean test-lint test-only
+
+help:
+	@echo "TODO: describe Makefile"
+
+clean: test-clean
+	find . -type f \( -iname '*.c' -o -iname '*.pyc' -o -iname '*.so' \) -exec rm '{}' ';'
+
+test: test-clean test-lint test-only
+
+test-clean:
+	rm -rf coverage.xml htmlcov junit.xml pylint.log result
+
+test-lint:
+	if [ "$$IN_NIX_SHELL" = "1" ]; then \
+		$(FLAKE8); \
+	else \
+		$(FLAKE8) --format=pylint --exit-zero > pylint.log; \
+	fi
+
+test-only:
+	PYTHONHASHSEED=random py.test -vv -r xw --cov=rhodecode --cov-report=term-missing --cov-report=html rhodecode/tests/
+
+web-build:
+	NODE_PATH=$(NODE_PATH) $(GRUNT)
+
+web-test:
+	@echo "no test for our javascript, yet!"
+
+docs-bootstrap:
+	(cd docs; nix-build default.nix -o result)
+	@echo "Please go to docs folder and run make html"

README.rst

@@ -0,0 +1,101 @@
+=========
+RhodeCode
+=========
+
+About
+-----
+
+``RhodeCode`` is a fast and powerful management tool for Mercurial_ and GIT_
+and Subversion_ with a built in push/pull server, full text search,
+pull requests and powerfull code-review system. It works on http/https and
+has a few unique features like:
+ - plugable architecture
+ - advanced permission system with IP restrictions
+ - rich set of authentication plugins including LDAP,
+   ActiveDirectory, Atlassian Crowd, Http-Headers, Pam, Token-Auth.
+ - live code-review chat
+ - full web based file editing
+ - unified multi vcs support
+ - snippets (gist) system
+ - integration with all 3rd party issue trackers
+
+RhodeCode also provides rich API, and multiple event hooks so it's easy
+integrable with existing external systems.
+
+RhodeCode is similar in some respects to gitlab_, github_ or bitbucket_,
+however RhodeCode can be run as standalone hosted application on your own server.
+RhodeCode can be installed on \*nix or Windows systems.
+
+RhodeCode uses `PEP386 versioning <http://www.python.org/dev/peps/pep-0386/>`_
+
+Installation
+------------
+Please visit https://docs.rhodecode.com/RhodeCode-Control/tasks/install-cli.html
+for more details
+
+
+Source code
+-----------
+
+The latest sources can be obtained from official RhodeCode instance
+https://code.rhodecode.com
+
+
+RhodeCode Features
+------------------
+
+Check out all features of RhodeCode at https://rhodecode.com/features
+
+License
+-------
+
+``RhodeCode`` is dual-licensed with AGPLv3 and commercial license.
+Please see LICENSE.txt file for details.
+
+
+Getting help
+------------
+
+Listed bellow are various support resources that should help.
+
+.. note::
+
+   Please try to read the documentation before posting any issues, especially
+   the **troubleshooting section**
+
+- Official issue tracker `RhodeCode Issue tracker <https://issues.rhodecode.com>`_
+
+- Search our community portal `Community portal <https://community.rhodecode.com>`_
+
+- Join #rhodecode on FreeNode (irc.freenode.net)
+  or use http://webchat.freenode.net/?channels=rhodecode for web access to irc.
+
+- You can also follow RhodeCode on twitter **@RhodeCode** where we often post
+  news and other interesting stuff about RhodeCode.
+
+
+Online documentation
+--------------------
+
+Online documentation for the current version of RhodeCode is available at
+ - http://rhodecode.com/docs
+
+You may also build the documentation for yourself - go into ``docs/`` and run::
+
+    nix-build default.nix -o result && make clean html
+
+(You need to have sphinx_ installed to build the documentation. If you don't
+have sphinx_ installed you can install it via the command:
+``pip install sphinx``)
+
+.. _virtualenv: http://pypi.python.org/pypi/virtualenv
+.. _python: http://www.python.org/
+.. _sphinx: http://sphinx.pocoo.org/
+.. _mercurial: http://mercurial.selenic.com/
+.. _bitbucket: http://bitbucket.org/
+.. _github: http://github.com/
+.. _gitlab: http://gitlab.com/
+.. _subversion: http://subversion.tigris.org/
+.. _git: http://git-scm.com/
+.. _celery: http://celeryproject.org/
+.. _vcs: http://pypi.python.org/pypi/vcs

acceptance_tests/README.rst

@@ -0,0 +1,47 @@
+README - Quickstart
+===================
+
+This folder contains functional tests and the automation of specification
+examples. Details about testing can be found in
+`/docs-internal/testing/index.rst`.
+
+
+Setting up your Rhodecode Enterprise instance
+---------------------------------------------
+
+The tests will create users and repositories as needed, so you can start with a
+new and empty instance.
+
+Use the following example call for the database setup of Enterprise::
+
+   paster setup-rhodecode \
+     --user=admin \
+     --email=admin@example.com \
+     --password=secret \
+     --api-key=9999999999999999999999999999999999999999 \
+     your-enterprise-config.ini
+
+This way the username, password and auth token of the admin user will match the
+defaults from the test run.
+
+
+Usage
+-----
+
+1. Make sure your Rhodecode Enterprise instance is running at
+   http://localhost:5000.
+
+2. Enter `nix-shell` from the acceptance_tests folder::
+
+     cd acceptance_tests
+     nix-shell -I ~/dev
+
+   Make sure that `rcpkgs` and `rcnixpkgs` are available on the nix path.
+
+3. Run the tests::
+
+     py.test -c example.ini -vs
+
+   The parameter ``-vs`` allows you to see debugging output during the test
+   run. Check ``py.test --help`` and the documentation at http://pytest.org to
+   learn all details about the test runner.

configs/development.ini

@@ -0,0 +1,575 @@
+################################################################################
+################################################################################
+# RhodeCode Enterprise - configuration file                                    #
+# Built-in functions and variables                                             #
+# The %(here)s variable will be replaced with the parent directory of this file#
+#                                                                              #
+################################################################################
+
+[DEFAULT]
+debug = true
+pdebug = false
+################################################################################
+## Uncomment and replace with the email address which should receive          ##
+## any error reports after an application crash                               ##
+## Additionally these settings will be used by the RhodeCode mailing system   ##
+################################################################################
+#email_to = admin@localhost
+#error_email_from = paste_error@localhost
+#app_email_from = rhodecode-noreply@localhost
+#error_message =
+#email_prefix = [RhodeCode]
+
+#smtp_server = mail.server.com
+#smtp_username =
+#smtp_password =
+#smtp_port =
+#smtp_use_tls = false
+#smtp_use_ssl = true
+## Specify available auth parameters here (e.g. LOGIN PLAIN CRAM-MD5, etc.)
+#smtp_auth =
+
+[server:main]
+## COMMON ##
+host = 127.0.0.1
+port = 5000
+
+##########################
+## WAITRESS WSGI SERVER ##
+##########################
+use = egg:waitress#main
+## number of worker threads
+threads = 5
+## MAX BODY SIZE 100GB
+max_request_body_size = 107374182400
+## Use poll instead of select, fixes file descriptors limits problems.
+## May not work on old windows systems.
+asyncore_use_poll = true
+
+
+##########################
+## GUNICORN WSGI SERVER ##
+##########################
+## run with gunicorn --log-config <inifile.ini> --paste <inifile.ini>
+#use = egg:gunicorn#main
+## Sets the number of process workers. You must set `instance_id = *`
+## when this option is set to more than one worker, recommended
+## value is (2 * NUMBER_OF_CPUS + 1), eg 2CPU = 5 workers
+## The `instance_id = *` must be set in the [app:main] section below
+#workers = 1
+## number of threads for each of the worker, must be set to 1 for gevent
+## generally recommened to be at 1
+#threads = 1
+## process name
+#proc_name = rhodecode
+## type of worker class, one of sync, gevent
+## recommended for bigger setup is using of of other than sync one
+#worker_class = sync
+## max number of requests that worker will handle before being gracefully
+## restarted, could prevent memory leaks
+#max_requests = 1000
+#max_requests_jitter = 30
+## ammount of time a worker can spend with handling a request before it
+## gets killed and restarted. Set to 6hrs
+#timeout = 21600
+
+
+## prefix middleware for RhodeCode, disables force_https flag.
+## allows to set RhodeCode under a prefix in server.
+## eg https://server.com/<prefix>. Enable `filter-with =` option below as well.
+#[filter:proxy-prefix]
+#use = egg:PasteDeploy#prefix
+#prefix = /<your-prefix>
+
+[app:main]
+use = egg:rhodecode-enterprise-ce
+## enable proxy prefix middleware, defined below
+#filter-with = proxy-prefix
+
+# During development the we want to have the debug toolbar enabled
+pyramid.includes =
+    pyramid_debugtoolbar
+    rhodecode.utils.debugtoolbar
+    rhodecode.lib.middleware.request_wrapper
+
+pyramid.reload_templates = true
+
+debugtoolbar.hosts = 0.0.0.0/0
+debugtoolbar.exclude_prefixes =
+    /css
+    /fonts
+    /images
+    /js
+
+## RHODECODE PLUGINS ##
+rhodecode.includes =
+    rhodecode.api
+
+
+# api prefix url
+rhodecode.api.url = /_admin/api
+
+
+## END RHODECODE PLUGINS ##
+
+full_stack = true
+
+## Serve static files via RhodeCode, disable to serve them via HTTP server
+static_files = true
+
+## Optional Languages
+## en(default), be, de, es, fr, it, ja, pl, pt, ru, zh
+lang = en
+
+## perform a full repository scan on each server start, this should be
+## set to false after first startup, to allow faster server restarts.
+startup.import_repos = false
+
+## Uncomment and set this path to use archive download cache.
+## Once enabled, generated archives will be cached at this location
+## and served from the cache during subsequent requests for the same archive of
+## the repository.
+#archive_cache_dir = /tmp/tarballcache
+
+## change this to unique ID for security
+app_instance_uuid = rc-production
+
+## cut off limit for large diffs (size in bytes)
+cut_off_limit_diff = 1024000
+cut_off_limit_file = 256000
+
+## use cache version of scm repo everywhere
+vcs_full_cache = true
+
+## force https in RhodeCode, fixes https redirects, assumes it's always https
+## Normally this is controlled by proper http flags sent from http server
+force_https = false
+
+## use Strict-Transport-Security headers
+use_htsts = false
+
+## number of commits stats will parse on each iteration
+commit_parse_limit = 25
+
+## git rev filter option, --all is the default filter, if you need to
+## hide all refs in changelog switch this to --branches --tags
+git_rev_filter = --branches --tags
+
+# Set to true if your repos are exposed using the dumb protocol
+git_update_server_info = false
+
+## RSS/ATOM feed options
+rss_cut_off_limit = 256000
+rss_items_per_page = 10
+rss_include_diff = false
+
+## gist URL alias, used to create nicer urls for gist. This should be an
+## url that does rewrites to _admin/gists/<gistid>.
+## example: http://gist.rhodecode.org/{gistid}. Empty means use the internal
+## RhodeCode url, ie. http[s]://rhodecode.server/_admin/gists/<gistid>
+gist_alias_url =
+
+## List of controllers (using glob pattern syntax) that AUTH TOKENS could be
+## used for access.
+## Adding ?auth_token = <token> to the url authenticates this request as if it
+## came from the the logged in user who own this authentication token.
+##
+## Syntax is <ControllerClass>:<function_pattern>.
+## To enable access to raw_files put `FilesController:raw`.
+## To enable access to patches add `ChangesetController:changeset_patch`.
+## The list should be "," separated and on a single line.
+##
+## Recommended controllers to enable:
+#    ChangesetController:changeset_patch,
+#    ChangesetController:changeset_raw,
+#    FilesController:raw,
+#    FilesController:archivefile,
+#    GistsController:*,
+api_access_controllers_whitelist =
+
+## default encoding used to convert from and to unicode
+## can be also a comma separated list of encoding in case of mixed encodings
+default_encoding = UTF-8
+
+## instance-id prefix
+## a prefix key for this instance used for cache invalidation when running
+## multiple instances of rhodecode, make sure it's globally unique for
+## all running rhodecode instances. Leave empty if you don't use it
+instance_id =
+
+## alternative return HTTP header for failed authentication. Default HTTP
+## response is 401 HTTPUnauthorized. Currently HG clients have troubles with
+## handling that causing a series of failed authentication calls.
+## Set this variable to 403 to return HTTPForbidden, or any other HTTP code
+## This will be served instead of default 401 on bad authnetication
+auth_ret_code =
+
+## use special detection method when serving auth_ret_code, instead of serving
+## ret_code directly, use 401 initially (Which triggers credentials prompt)
+## and then serve auth_ret_code to clients
+auth_ret_code_detection = false
+
+## locking return code. When repository is locked return this HTTP code. 2XX
+## codes don't break the transactions while 4XX codes do
+lock_ret_code = 423
+
+## allows to change the repository location in settings page
+allow_repo_location_change = true
+
+## allows to setup custom hooks in settings page
+allow_custom_hooks_settings = true
+
+## generated license token, goto license page in RhodeCode settings to obtain
+## new token
+license_token =
+
+## supervisor connection uri, for managing supervisor and logs.
+supervisor.uri =
+## supervisord group name/id we only want this RC instance to handle
+supervisor.group_id = dev
+
+## Display extended labs settings
+labs_settings_active = true
+
+####################################
+###        CELERY CONFIG        ####
+####################################
+use_celery = false
+broker.host = localhost
+broker.vhost = rabbitmqhost
+broker.port = 5672
+broker.user = rabbitmq
+broker.password = qweqwe
+
+celery.imports = rhodecode.lib.celerylib.tasks
+
+celery.result.backend = amqp
+celery.result.dburi = amqp://
+celery.result.serialier = json
+
+#celery.send.task.error.emails = true
+#celery.amqp.task.result.expires = 18000
+
+celeryd.concurrency = 2
+#celeryd.log.file = celeryd.log
+celeryd.log.level = debug
+celeryd.max.tasks.per.child = 1
+
+## tasks will never be sent to the queue, but executed locally instead.
+celery.always.eager = false
+
+####################################
+###         BEAKER CACHE        ####
+####################################
+# default cache dir for templates.  Putting this into a ramdisk
+## can boost performance, eg. %(here)s/data_ramdisk
+cache_dir = %(here)s/data
+
+## locking and default file storage for Beaker. Putting this into a ramdisk
+## can boost performance, eg. %(here)s/data_ramdisk/cache/beaker_data
+beaker.cache.data_dir = %(here)s/data/cache/beaker_data
+beaker.cache.lock_dir = %(here)s/data/cache/beaker_lock
+
+beaker.cache.regions = super_short_term, short_term, long_term, sql_cache_short, auth_plugins, repo_cache_long
+
+beaker.cache.super_short_term.type = memory
+beaker.cache.super_short_term.expire = 10
+beaker.cache.super_short_term.key_length = 256
+
+beaker.cache.short_term.type = memory
+beaker.cache.short_term.expire = 60
+beaker.cache.short_term.key_length = 256
+
+beaker.cache.long_term.type = memory
+beaker.cache.long_term.expire = 36000
+beaker.cache.long_term.key_length = 256
+
+beaker.cache.sql_cache_short.type = memory
+beaker.cache.sql_cache_short.expire = 10
+beaker.cache.sql_cache_short.key_length = 256
+
+# default is memory cache, configure only if required
+# using multi-node or multi-worker setup
+#beaker.cache.auth_plugins.type = ext:database
+#beaker.cache.auth_plugins.lock_dir = %(here)s/data/cache/auth_plugin_lock
+#beaker.cache.auth_plugins.url = postgresql://postgres:secret@localhost/rhodecode
+#beaker.cache.auth_plugins.url = mysql://root:secret@127.0.0.1/rhodecode
+#beaker.cache.auth_plugins.sa.pool_recycle = 3600
+#beaker.cache.auth_plugins.sa.pool_size = 10
+#beaker.cache.auth_plugins.sa.max_overflow = 0
+
+beaker.cache.repo_cache_long.type = memorylru_base
+beaker.cache.repo_cache_long.max_items = 4096
+beaker.cache.repo_cache_long.expire = 2592000
+
+# default is memorylru_base cache, configure only if required
+# using multi-node or multi-worker setup
+#beaker.cache.repo_cache_long.type = ext:memcached
+#beaker.cache.repo_cache_long.url = localhost:11211
+#beaker.cache.repo_cache_long.expire = 1209600
+#beaker.cache.repo_cache_long.key_length = 256
+
+####################################
+###       BEAKER SESSION        ####
+####################################
+
+## .session.type is type of storage options for the session, current allowed
+## types are file, ext:memcached, ext:database, and memory(default).
+beaker.session.type = file
+beaker.session.data_dir = %(here)s/data/sessions/data
+
+## db based session, fast, and allows easy management over logged in users ##
+#beaker.session.type = ext:database
+#beaker.session.table_name = db_session
+#beaker.session.sa.url = postgresql://postgres:secret@localhost/rhodecode
+#beaker.session.sa.url = mysql://root:secret@127.0.0.1/rhodecode
+#beaker.session.sa.pool_recycle = 3600
+#beaker.session.sa.echo = false
+
+beaker.session.key = rhodecode
+beaker.session.secret = develop-rc-uytcxaz
+beaker.session.lock_dir = %(here)s/data/sessions/lock
+
+## Secure encrypted cookie. Requires AES and AES python libraries
+## you must disable beaker.session.secret to use this
+#beaker.session.encrypt_key = <key_for_encryption>
+#beaker.session.validate_key = <validation_key>
+
+## sets session as invalid(also logging out user) if it haven not been
+## accessed for given amount of time in seconds
+beaker.session.timeout = 2592000
+beaker.session.httponly = true
+#beaker.session.cookie_path = /<your-prefix>
+
+## uncomment for https secure cookie
+beaker.session.secure = false
+
+## auto save the session to not to use .save()
+beaker.session.auto = false
+
+## default cookie expiration time in seconds, set to `true` to set expire
+## at browser close
+#beaker.session.cookie_expires = 3600
+
+###################################
+## SEARCH INDEXING CONFIGURATION ##
+###################################
+
+search.module = rhodecode.lib.index.whoosh
+search.location = %(here)s/data/index
+
+###################################
+## ERROR AND LOG HANDLING SYSTEM ##
+###################################
+
+## Appenlight is tailored to work with RhodeCode, see
+## http://appenlight.com for details how to obtain an account
+
+## appenlight integration enabled
+appenlight = false
+
+appenlight.server_url = https://api.appenlight.com
+appenlight.api_key = YOUR_API_KEY
+;appenlight.transport_config = https://api.appenlight.com?threaded=1&timeout=5
+
+# used for JS client
+appenlight.api_public_key = YOUR_API_PUBLIC_KEY
+
+## TWEAK AMOUNT OF INFO SENT HERE
+
+## enables 404 error logging (default False)
+appenlight.report_404 = false
+
+## time in seconds after request is considered being slow (default 1)
+appenlight.slow_request_time = 1
+
+## record slow requests in application
+## (needs to be enabled for slow datastore recording and time tracking)
+appenlight.slow_requests = true
+
+## enable hooking to application loggers
+appenlight.logging = true
+
+## minimum log level for log capture
+appenlight.logging.level = WARNING
+
+## send logs only from erroneous/slow requests
+## (saves API quota for intensive logging)
+appenlight.logging_on_error = false
+
+## list of additonal keywords that should be grabbed from environ object
+## can be string with comma separated list of words in lowercase
+## (by default client will always send following info:
+## 'REMOTE_USER', 'REMOTE_ADDR', 'SERVER_NAME', 'CONTENT_TYPE' + all keys that
+## start with HTTP* this list be extended with additional keywords here
+appenlight.environ_keys_whitelist =
+
+## list of keywords that should be blanked from request object
+## can be string with comma separated list of words in lowercase
+## (by default client will always blank keys that contain following words
+## 'password', 'passwd', 'pwd', 'auth_tkt', 'secret', 'csrf'
+## this list be extended with additional keywords set here
+appenlight.request_keys_blacklist =
+
+## list of namespaces that should be ignores when gathering log entries
+## can be string with comma separated list of namespaces
+## (by default the client ignores own entries: appenlight_client.client)
+appenlight.log_namespace_blacklist =
+
+
+################################################################################
+## WARNING: *THE LINE BELOW MUST BE UNCOMMENTED ON A PRODUCTION ENVIRONMENT*  ##
+## Debug mode will enable the interactive debugging tool, allowing ANYONE to  ##
+## execute malicious code after an exception is raised.                       ##
+################################################################################
+#set debug = false
+
+
+##############
+## STYLING  ##
+##############
+debug_style = true
+
+#########################################################
+### DB CONFIGS - EACH DB WILL HAVE IT'S OWN CONFIG    ###
+#########################################################
+sqlalchemy.db1.url = sqlite:///%(here)s/rhodecode.db?timeout=30
+#sqlalchemy.db1.url = postgresql://postgres:qweqwe@localhost/rhodecode
+#sqlalchemy.db1.url = mysql://root:qweqwe@localhost/rhodecode
+
+# see sqlalchemy docs for other advanced settings
+
+## print the sql statements to output
+sqlalchemy.db1.echo = false
+## recycle the connections after this ammount of seconds
+sqlalchemy.db1.pool_recycle = 3600
+sqlalchemy.db1.convert_unicode = true
+
+## the number of connections to keep open inside the connection pool.
+## 0 indicates no limit
+#sqlalchemy.db1.pool_size = 5
+
+## the number of connections to allow in connection pool "overflow", that is
+## connections that can be opened above and beyond the pool_size setting,
+## which defaults to five.
+#sqlalchemy.db1.max_overflow = 10
+
+
+##################
+### VCS CONFIG ###
+##################
+vcs.server.enable = true
+vcs.server = localhost:9900
+# Available protocols: pyro4, http
+vcs.server.protocol = pyro4
+
+# available impl:
+# vcsserver.scm_app (EE only, for testing),
+# rhodecode.lib.middleware.utils.scm_app_http
+# pyro4
+#vcs.scm_app_implementation = rhodecode.lib.middleware.utils.scm_app_http
+
+vcs.server.log_level = debug
+vcs.start_server = true
+vcs.backends = hg, git, svn
+vcs.connection_timeout = 3600
+## Compatibility version when creating SVN repositories. Defaults to newest version when commented out.
+## Available options are: pre-1.4-compatible, pre-1.5-compatible, pre-1.6-compatible, pre-1.8-compatible
+#vcs.svn.compatible_version = pre-1.8-compatible
+
+################################
+### LOGGING CONFIGURATION   ####
+################################
+[loggers]
+keys = root, routes, rhodecode, sqlalchemy, beaker, pyro4, templates, whoosh_indexer
+
+[handlers]
+keys = console, console_sql
+
+[formatters]
+keys = generic, color_formatter, color_formatter_sql
+
+#############
+## LOGGERS ##
+#############
+[logger_root]
+level = NOTSET
+handlers = console
+
+[logger_routes]
+level = DEBUG
+handlers =
+qualname = routes.middleware
+## "level = DEBUG" logs the route matched and routing variables.
+propagate = 1
+
+[logger_beaker]
+level = DEBUG
+handlers =
+qualname = beaker.container
+propagate = 1
+
+[logger_pyro4]
+level = DEBUG
+handlers =
+qualname = Pyro4
+propagate = 1
+
+[logger_templates]
+level = INFO
+handlers =
+qualname = pylons.templating
+propagate = 1
+
+[logger_rhodecode]
+level = DEBUG
+handlers =
+qualname = rhodecode
+propagate = 1
+
+[logger_sqlalchemy]
+level = INFO
+handlers = console_sql
+qualname = sqlalchemy.engine
+propagate = 0
+
+[logger_whoosh_indexer]
+level = DEBUG
+handlers =
+qualname = whoosh_indexer
+propagate = 1
+
+##############
+## HANDLERS ##
+##############
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = DEBUG
+formatter = color_formatter
+
+[handler_console_sql]
+class = StreamHandler
+args = (sys.stderr,)
+level = DEBUG
+formatter = color_formatter_sql
+
+################
+## FORMATTERS ##
+################
+
+[formatter_generic]
+class = rhodecode.lib.logging_formatter.Pyro4AwareFormatter
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S
+
+[formatter_color_formatter]
+class = rhodecode.lib.logging_formatter.ColorFormatter
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S
+
+[formatter_color_formatter_sql]
+class = rhodecode.lib.logging_formatter.ColorFormatterSql
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S

configs/gunicorn_config.py

@@ -0,0 +1,96 @@
+"""gunicorn config hooks"""
+
+import multiprocessing
+import sys
+import threading
+import traceback
+
+
+# GLOBAL #
+errorlog = '-'
+accesslog = '-'
+loglevel = 'debug'
+
+# SECURITY #
+limit_request_line = 4094
+limit_request_fields = 100
+limit_request_field_size = 8190
+
+# SERVER MECHANICS #
+# None == system temp dir #
+worker_tmp_dir = None
+tmp_upload_dir = None
+#proc_name =
+
+# self adjust workers based on CPU #
+#workers = multiprocessing.cpu_count() * 2 + 1
+
+access_log_format = '[%(p)s] %(h)15s %(l)s %(u)s %(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s" request_time:%(L)s'
+
+# For the gevent worker classes #
+# this limits the maximum number of simultaneous clients that #
+# a single process can handle. #
+#worker_connections = 10
+
+# Max requests to handle by each worker before restarting it, #
+# could prevent memory leaks #
+#max_requests = 1000
+#max_requests_jitter = 30
+
+
+# If a worker does not notify the master process in this #
+# number of seconds it is killed and a new worker is spawned #
+# to replace it. #
+#timeout = 3600
+
+access_log_format = (
+    '[%(p)-10s] %(h)s time:%(L)s %(l)s %(u)s '
+    '%(t)s "%(r)s" %(s)s %(b)s "%(f)s" "%(a)s"')
+
+
+def post_fork(server, worker):
+    server.log.info("[<%s>] worker spawned", worker.pid)
+
+
+def pre_fork(server, worker):
+    pass
+
+
+def pre_exec(server):
+    server.log.info("Forked child, re-executing.")
+
+
+def when_ready(server):
+    server.log.info("Server is ready. Spawning workers")
+
+
+def worker_int(worker):
+    worker.log.info("[<%-10s>] worker received INT or QUIT signal", worker.pid)
+
+    # get traceback info
+    id2name = dict([(th.ident, th.name) for th in threading.enumerate()])
+    code = []
+    for thread_id, stack in sys._current_frames().items():
+        code.append(
+            "\n# Thread: %s(%d)" % (id2name.get(thread_id, ""), thread_id))
+        for fname, lineno, name, line in traceback.extract_stack(stack):
+            code.append('File: "%s", line %d, in %s' % (fname, lineno, name))
+            if line:
+                code.append("  %s" % (line.strip()))
+    worker.log.debug("\n".join(code))
+
+
+def worker_abort(worker):
+    worker.log.info("[<%-10s>] worker received SIGABRT signal", worker.pid)
+
+
+def pre_request(worker, req):
+    return
+    worker.log.debug("[<%-10s>] PRE WORKER: %s %s",
+                     worker.pid, req.method, req.path)
+
+
+def post_request(worker, req, environ, resp):
+    return
+    worker.log.debug("[<%-10s>] POST WORKER: %s %s resp: %s", worker.pid,
+                     req.method, req.path, resp.status_code)

configs/init.d/.readme.txt

@@ -0,0 +1 @@
+Example init scripts.

configs/init.d/supervisord.conf

@@ -0,0 +1,61 @@
+; Sample supervisor RhodeCode config file.
+;
+; For more information on the config file, please see:
+; http://supervisord.org/configuration.html
+;
+; Note: shell expansion ("~" or "$HOME") is not supported.  Environment
+; variables can be expanded using this syntax: "%(ENV_HOME)s".
+
+[unix_http_server]
+file=/tmp/supervisor.sock   ; (the path to the socket file)
+;chmod=0700                 ; socket file mode (default 0700)
+;chown=nobody:nogroup       ; socket file uid:gid owner
+;username=user              ; (default is no username (open server))
+;password=123               ; (default is no password (open server))
+
+[supervisord]
+logfile=/home/ubuntu/rhodecode/supervisord.log ; (main log file;default $CWD/supervisord.log)
+logfile_maxbytes=50MB        ; (max main logfile bytes b4 rotation;default 50MB)
+logfile_backups=10           ; (num of main logfile rotation backups;default 10)
+loglevel=info                ; (log level;default info; others: debug,warn,trace)
+pidfile=/home/ubuntu/rhodecode/supervisord.pid ; (supervisord pidfile;default supervisord.pid)
+nodaemon=true               ; (start in foreground if true;default false)
+minfds=1024                  ; (min. avail startup file descriptors;default 1024)
+minprocs=200                 ; (min. avail process descriptors;default 200)
+;umask=022                   ; (process file creation umask;default 022)
+user=ubuntu                 ; (default is current user, required if root)
+;identifier=supervisor       ; (supervisord identifier, default is 'supervisor')
+;directory=/tmp              ; (default is not to cd during start)
+;nocleanup=true              ; (don't clean up tempfiles at start;default false)
+;childlogdir=/tmp            ; ('AUTO' child log dir, default $TEMP)
+environment=HOME=/home/ubuntu,LANG=en_US.UTF-8     ; (key value pairs to add to environment)
+;strip_ansi=false            ; (strip ansi escape codes in logs; def. false)
+
+; the below section must remain in the config file for RPC
+; (supervisorctl/web interface) to work, additional interfaces may be
+; added by defining them in separate rpcinterface: sections
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+
+[supervisorctl]
+serverurl=unix:///tmp/supervisor.sock ; use a unix:// URL  for a unix socket
+;username=chris              ; should be same as http_username if set
+;password=123                ; should be same as http_password if set
+
+
+; restart with supervisorctl restart rhodecode:*
+[program:rhodecode]
+numprocs = 1
+numprocs_start = 5000
+directory=/home/ubuntu/rhodecode/source
+command = /home/ubuntu/rhodecode/venv/bin/paster serve /home/ubuntu/rhodecode/source/prod.ini
+process_name = %(program_name)s_%(process_num)04d
+redirect_stderr=true
+stdout_logfile=/home/ubuntu/rhodecode/rhodecode.log
+
+[program:rhodecode_workers]
+numproces = 1
+directory = /home/ubuntu/rhodecode/source
+command = /home/ubuntu/rhodecode/venv/bin/paster celeryd /home/ubuntu/rhodecode/source/prod.ini --autoscale=10,2
+redirect_stderr=true
+stdout_logfile=/%(here)s/rhodecode_workers.log

configs/production.ini

@@ -0,0 +1,541 @@
+################################################################################
+################################################################################
+# RhodeCode Enterprise - configuration file                                    #
+# Built-in functions and variables                                             #
+# The %(here)s variable will be replaced with the parent directory of this file#
+#                                                                              #
+################################################################################
+
+[DEFAULT]
+debug = true
+pdebug = false
+################################################################################
+## Uncomment and replace with the email address which should receive          ##
+## any error reports after an application crash                               ##
+## Additionally these settings will be used by the RhodeCode mailing system   ##
+################################################################################
+#email_to = admin@localhost
+#error_email_from = paste_error@localhost
+#app_email_from = rhodecode-noreply@localhost
+#error_message =
+#email_prefix = [RhodeCode]
+
+#smtp_server = mail.server.com
+#smtp_username =
+#smtp_password =
+#smtp_port =
+#smtp_use_tls = false
+#smtp_use_ssl = true
+## Specify available auth parameters here (e.g. LOGIN PLAIN CRAM-MD5, etc.)
+#smtp_auth =
+
+[server:main]
+## COMMON ##
+host = 127.0.0.1
+port = 5000
+
+##########################
+## WAITRESS WSGI SERVER ##
+##########################
+use = egg:waitress#main
+## number of worker threads
+threads = 5
+## MAX BODY SIZE 100GB
+max_request_body_size = 107374182400
+## Use poll instead of select, fixes file descriptors limits problems.
+## May not work on old windows systems.
+asyncore_use_poll = true
+
+
+##########################
+## GUNICORN WSGI SERVER ##
+##########################
+## run with gunicorn --log-config <inifile.ini> --paste <inifile.ini>
+#use = egg:gunicorn#main
+## Sets the number of process workers. You must set `instance_id = *`
+## when this option is set to more than one worker, recommended
+## value is (2 * NUMBER_OF_CPUS + 1), eg 2CPU = 5 workers
+## The `instance_id = *` must be set in the [app:main] section below
+#workers = 1
+## number of threads for each of the worker, must be set to 1 for gevent
+## generally recommened to be at 1
+#threads = 1
+## process name
+#proc_name = rhodecode
+## type of worker class, one of sync, gevent
+## recommended for bigger setup is using of of other than sync one
+#worker_class = sync
+## max number of requests that worker will handle before being gracefully
+## restarted, could prevent memory leaks
+#max_requests = 1000
+#max_requests_jitter = 30
+## ammount of time a worker can spend with handling a request before it
+## gets killed and restarted. Set to 6hrs
+#timeout = 21600
+
+
+## prefix middleware for RhodeCode, disables force_https flag.
+## allows to set RhodeCode under a prefix in server.
+## eg https://server.com/<prefix>. Enable `filter-with =` option below as well.
+#[filter:proxy-prefix]
+#use = egg:PasteDeploy#prefix
+#prefix = /<your-prefix>
+
+[app:main]
+use = egg:rhodecode-enterprise-ce
+## enable proxy prefix middleware, defined below
+#filter-with = proxy-prefix
+
+full_stack = true
+
+## Serve static files via RhodeCode, disable to serve them via HTTP server
+static_files = true
+
+## Optional Languages
+## en(default), be, de, es, fr, it, ja, pl, pt, ru, zh
+lang = en
+
+## perform a full repository scan on each server start, this should be
+## set to false after first startup, to allow faster server restarts.
+startup.import_repos = false
+
+## Uncomment and set this path to use archive download cache.
+## Once enabled, generated archives will be cached at this location
+## and served from the cache during subsequent requests for the same archive of
+## the repository.
+#archive_cache_dir = /tmp/tarballcache
+
+## change this to unique ID for security
+app_instance_uuid = rc-production
+
+## cut off limit for large diffs (size in bytes)
+cut_off_limit_diff = 1024000
+cut_off_limit_file = 256000
+
+## use cache version of scm repo everywhere
+vcs_full_cache = true
+
+## force https in RhodeCode, fixes https redirects, assumes it's always https
+## Normally this is controlled by proper http flags sent from http server
+force_https = false
+
+## use Strict-Transport-Security headers
+use_htsts = false
+
+## number of commits stats will parse on each iteration
+commit_parse_limit = 25
+
+## git rev filter option, --all is the default filter, if you need to
+## hide all refs in changelog switch this to --branches --tags
+git_rev_filter = --branches --tags
+
+# Set to true if your repos are exposed using the dumb protocol
+git_update_server_info = false
+
+## RSS/ATOM feed options
+rss_cut_off_limit = 256000
+rss_items_per_page = 10
+rss_include_diff = false
+
+## gist URL alias, used to create nicer urls for gist. This should be an
+## url that does rewrites to _admin/gists/<gistid>.
+## example: http://gist.rhodecode.org/{gistid}. Empty means use the internal
+## RhodeCode url, ie. http[s]://rhodecode.server/_admin/gists/<gistid>
+gist_alias_url =
+
+## List of controllers (using glob pattern syntax) that AUTH TOKENS could be
+## used for access.
+## Adding ?auth_token = <token> to the url authenticates this request as if it
+## came from the the logged in user who own this authentication token.
+##
+## Syntax is <ControllerClass>:<function_pattern>.
+## To enable access to raw_files put `FilesController:raw`.
+## To enable access to patches add `ChangesetController:changeset_patch`.
+## The list should be "," separated and on a single line.
+##
+## Recommended controllers to enable:
+#    ChangesetController:changeset_patch,
+#    ChangesetController:changeset_raw,
+#    FilesController:raw,
+#    FilesController:archivefile,
+#    GistsController:*,
+api_access_controllers_whitelist =
+
+## default encoding used to convert from and to unicode
+## can be also a comma separated list of encoding in case of mixed encodings
+default_encoding = UTF-8
+
+## instance-id prefix
+## a prefix key for this instance used for cache invalidation when running
+## multiple instances of rhodecode, make sure it's globally unique for
+## all running rhodecode instances. Leave empty if you don't use it
+instance_id =
+
+## alternative return HTTP header for failed authentication. Default HTTP
+## response is 401 HTTPUnauthorized. Currently HG clients have troubles with
+## handling that causing a series of failed authentication calls.
+## Set this variable to 403 to return HTTPForbidden, or any other HTTP code
+## This will be served instead of default 401 on bad authnetication
+auth_ret_code =
+
+## use special detection method when serving auth_ret_code, instead of serving
+## ret_code directly, use 401 initially (Which triggers credentials prompt)
+## and then serve auth_ret_code to clients
+auth_ret_code_detection = false
+
+## locking return code. When repository is locked return this HTTP code. 2XX
+## codes don't break the transactions while 4XX codes do
+lock_ret_code = 423
+
+## allows to change the repository location in settings page
+allow_repo_location_change = true
+
+## allows to setup custom hooks in settings page
+allow_custom_hooks_settings = true
+
+## generated license token, goto license page in RhodeCode settings to obtain
+## new token
+license_token =
+
+## supervisor connection uri, for managing supervisor and logs.
+supervisor.uri =
+## supervisord group name/id we only want this RC instance to handle
+supervisor.group_id = prod
+
+## Display extended labs settings
+labs_settings_active = true
+
+####################################
+###        CELERY CONFIG        ####
+####################################
+use_celery = false
+broker.host = localhost
+broker.vhost = rabbitmqhost
+broker.port = 5672
+broker.user = rabbitmq
+broker.password = qweqwe
+
+celery.imports = rhodecode.lib.celerylib.tasks
+
+celery.result.backend = amqp
+celery.result.dburi = amqp://
+celery.result.serialier = json
+
+#celery.send.task.error.emails = true
+#celery.amqp.task.result.expires = 18000
+
+celeryd.concurrency = 2
+#celeryd.log.file = celeryd.log
+celeryd.log.level = debug
+celeryd.max.tasks.per.child = 1
+
+## tasks will never be sent to the queue, but executed locally instead.
+celery.always.eager = false
+
+####################################
+###         BEAKER CACHE        ####
+####################################
+# default cache dir for templates.  Putting this into a ramdisk
+## can boost performance, eg. %(here)s/data_ramdisk
+cache_dir = %(here)s/data
+
+## locking and default file storage for Beaker. Putting this into a ramdisk
+## can boost performance, eg. %(here)s/data_ramdisk/cache/beaker_data
+beaker.cache.data_dir = %(here)s/data/cache/beaker_data
+beaker.cache.lock_dir = %(here)s/data/cache/beaker_lock
+
+beaker.cache.regions = super_short_term, short_term, long_term, sql_cache_short, auth_plugins, repo_cache_long
+
+beaker.cache.super_short_term.type = memory
+beaker.cache.super_short_term.expire = 10
+beaker.cache.super_short_term.key_length = 256
+
+beaker.cache.short_term.type = memory
+beaker.cache.short_term.expire = 60
+beaker.cache.short_term.key_length = 256
+
+beaker.cache.long_term.type = memory
+beaker.cache.long_term.expire = 36000
+beaker.cache.long_term.key_length = 256
+
+beaker.cache.sql_cache_short.type = memory
+beaker.cache.sql_cache_short.expire = 10
+beaker.cache.sql_cache_short.key_length = 256
+
+# default is memory cache, configure only if required
+# using multi-node or multi-worker setup
+#beaker.cache.auth_plugins.type = ext:database
+#beaker.cache.auth_plugins.lock_dir = %(here)s/data/cache/auth_plugin_lock
+#beaker.cache.auth_plugins.url = postgresql://postgres:secret@localhost/rhodecode
+#beaker.cache.auth_plugins.url = mysql://root:secret@127.0.0.1/rhodecode
+#beaker.cache.auth_plugins.sa.pool_recycle = 3600
+#beaker.cache.auth_plugins.sa.pool_size = 10
+#beaker.cache.auth_plugins.sa.max_overflow = 0
+
+beaker.cache.repo_cache_long.type = memorylru_base
+beaker.cache.repo_cache_long.max_items = 4096
+beaker.cache.repo_cache_long.expire = 2592000
+
+# default is memorylru_base cache, configure only if required
+# using multi-node or multi-worker setup
+#beaker.cache.repo_cache_long.type = ext:memcached
+#beaker.cache.repo_cache_long.url = localhost:11211
+#beaker.cache.repo_cache_long.expire = 1209600
+#beaker.cache.repo_cache_long.key_length = 256
+
+####################################
+###       BEAKER SESSION        ####
+####################################
+
+## .session.type is type of storage options for the session, current allowed
+## types are file(default), ext:memcached, ext:database, and memory.
+#beaker.session.type = file
+
+## db based session, fast, and allows easy management over logged in users ##
+#beaker.session.type = ext:database
+#beaker.session.lock_dir = %(here)s/data/cache/session_db_lock
+#beaker.session.table_name = db_session
+#beaker.session.sa.url = postgresql://postgres:secret@localhost/rhodecode
+#beaker.session.sa.url = mysql://root:secret@127.0.0.1/rhodecode
+#beaker.session.sa.pool_recycle = 3600
+#beaker.session.sa.echo = false
+
+beaker.session.key = rhodecode
+beaker.session.secret = production-rc-uytcxaz
+
+## Secure encrypted cookie. Requires AES and AES python libraries
+## you must disable beaker.session.secret to use this
+#beaker.session.encrypt_key = <key_for_encryption>
+#beaker.session.validate_key = <validation_key>
+
+## sets session as invalid(also logging out user) if it haven not been
+## accessed for given amount of time in seconds
+beaker.session.timeout = 2592000
+beaker.session.httponly = true
+#beaker.session.cookie_path = /<your-prefix>
+
+## uncomment for https secure cookie
+beaker.session.secure = false
+
+## auto save the session to not to use .save()
+beaker.session.auto = false
+
+## default cookie expiration time in seconds, set to `true` to set expire
+## at browser close
+#beaker.session.cookie_expires = 3600
+
+###################################
+## SEARCH INDEXING CONFIGURATION ##
+###################################
+
+search.module = rhodecode.lib.index.whoosh
+search.location = %(here)s/data/index
+
+###################################
+## ERROR AND LOG HANDLING SYSTEM ##
+###################################
+
+## Appenlight is tailored to work with RhodeCode, see
+## http://appenlight.com for details how to obtain an account
+
+## appenlight integration enabled
+appenlight = false
+
+appenlight.server_url = https://api.appenlight.com
+appenlight.api_key = YOUR_API_KEY
+;appenlight.transport_config = https://api.appenlight.com?threaded=1&timeout=5
+
+# used for JS client
+appenlight.api_public_key = YOUR_API_PUBLIC_KEY
+
+## TWEAK AMOUNT OF INFO SENT HERE
+
+## enables 404 error logging (default False)
+appenlight.report_404 = false
+
+## time in seconds after request is considered being slow (default 1)
+appenlight.slow_request_time = 1
+
+## record slow requests in application
+## (needs to be enabled for slow datastore recording and time tracking)
+appenlight.slow_requests = true
+
+## enable hooking to application loggers
+appenlight.logging = true
+
+## minimum log level for log capture
+appenlight.logging.level = WARNING
+
+## send logs only from erroneous/slow requests
+## (saves API quota for intensive logging)
+appenlight.logging_on_error = false
+
+## list of additonal keywords that should be grabbed from environ object
+## can be string with comma separated list of words in lowercase
+## (by default client will always send following info:
+## 'REMOTE_USER', 'REMOTE_ADDR', 'SERVER_NAME', 'CONTENT_TYPE' + all keys that
+## start with HTTP* this list be extended with additional keywords here
+appenlight.environ_keys_whitelist =
+
+## list of keywords that should be blanked from request object
+## can be string with comma separated list of words in lowercase
+## (by default client will always blank keys that contain following words
+## 'password', 'passwd', 'pwd', 'auth_tkt', 'secret', 'csrf'
+## this list be extended with additional keywords set here
+appenlight.request_keys_blacklist =
+
+## list of namespaces that should be ignores when gathering log entries
+## can be string with comma separated list of namespaces
+## (by default the client ignores own entries: appenlight_client.client)
+appenlight.log_namespace_blacklist =
+
+
+################################################################################
+## WARNING: *THE LINE BELOW MUST BE UNCOMMENTED ON A PRODUCTION ENVIRONMENT*  ##
+## Debug mode will enable the interactive debugging tool, allowing ANYONE to  ##
+## execute malicious code after an exception is raised.                       ##
+################################################################################
+set debug = false
+
+
+##############
+## STYLING  ##
+##############
+debug_style = false
+
+#########################################################
+### DB CONFIGS - EACH DB WILL HAVE IT'S OWN CONFIG    ###
+#########################################################
+#sqlalchemy.db1.url = sqlite:///%(here)s/rhodecode.db?timeout=30
+sqlalchemy.db1.url = postgresql://postgres:qweqwe@localhost/rhodecode
+#sqlalchemy.db1.url = mysql://root:qweqwe@localhost/rhodecode
+
+# see sqlalchemy docs for other advanced settings
+
+## print the sql statements to output
+sqlalchemy.db1.echo = false
+## recycle the connections after this ammount of seconds
+sqlalchemy.db1.pool_recycle = 3600
+sqlalchemy.db1.convert_unicode = true
+
+## the number of connections to keep open inside the connection pool.
+## 0 indicates no limit
+#sqlalchemy.db1.pool_size = 5
+
+## the number of connections to allow in connection pool "overflow", that is
+## connections that can be opened above and beyond the pool_size setting,
+## which defaults to five.
+#sqlalchemy.db1.max_overflow = 10
+
+
+##################
+### VCS CONFIG ###
+##################
+vcs.server.enable = true
+vcs.server = localhost:9900
+# Available protocols: pyro4, http
+vcs.server.protocol = pyro4
+vcs.server.log_level = info
+vcs.start_server = false
+vcs.backends = hg, git, svn
+vcs.connection_timeout = 3600
+## Compatibility version when creating SVN repositories. Defaults to newest version when commented out.
+## Available options are: pre-1.4-compatible, pre-1.5-compatible, pre-1.6-compatible, pre-1.8-compatible
+#vcs.svn.compatible_version = pre-1.8-compatible
+
+################################
+### LOGGING CONFIGURATION   ####
+################################
+[loggers]
+keys = root, routes, rhodecode, sqlalchemy, beaker, pyro4, templates, whoosh_indexer
+
+[handlers]
+keys = console, console_sql
+
+[formatters]
+keys = generic, color_formatter, color_formatter_sql
+
+#############
+## LOGGERS ##
+#############
+[logger_root]
+level = NOTSET
+handlers = console
+
+[logger_routes]
+level = DEBUG
+handlers =
+qualname = routes.middleware
+## "level = DEBUG" logs the route matched and routing variables.
+propagate = 1
+
+[logger_beaker]
+level = DEBUG
+handlers =
+qualname = beaker.container
+propagate = 1
+
+[logger_pyro4]
+level = DEBUG
+handlers =
+qualname = Pyro4
+propagate = 1
+
+[logger_templates]
+level = INFO
+handlers =
+qualname = pylons.templating
+propagate = 1
+
+[logger_rhodecode]
+level = DEBUG
+handlers =
+qualname = rhodecode
+propagate = 1
+
+[logger_sqlalchemy]
+level = INFO
+handlers = console_sql
+qualname = sqlalchemy.engine
+propagate = 0
+
+[logger_whoosh_indexer]
+level = DEBUG
+handlers =
+qualname = whoosh_indexer
+propagate = 1
+
+##############
+## HANDLERS ##
+##############
+
+[handler_console]
+class = StreamHandler
+args = (sys.stderr,)
+level = INFO
+formatter = generic
+
+[handler_console_sql]
+class = StreamHandler
+args = (sys.stderr,)
+level = WARN
+formatter = generic
+
+################
+## FORMATTERS ##
+################
+
+[formatter_generic]
+class = rhodecode.lib.logging_formatter.Pyro4AwareFormatter
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S
+
+[formatter_color_formatter]
+class = rhodecode.lib.logging_formatter.ColorFormatter
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S
+
+[formatter_color_formatter_sql]
+class = rhodecode.lib.logging_formatter.ColorFormatterSql
+format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+datefmt = %Y-%m-%d %H:%M:%S

configs/rcchannelstream.ini

@@ -0,0 +1,6 @@
+[channelstream]
+admin_secret = secret
+secret = secret
+port = 9800
+demo = false
+allow_posting_from = 127.0.0.1

default.nix

@@ -0,0 +1,215 @@
+# Nix environment for the community edition
+#
+# This shall be as lean as possible, just producing the Enterprise
+# derivation. For advanced tweaks to pimp up the development environment we use
+# "shell.nix" so that it does not have to clutter this file.
+
+{ pkgs ? (import <nixpkgs> {})
+, pythonPackages ? "python27Packages"
+, pythonExternalOverrides ? self: super: {}
+, doCheck ? true
+}:
+
+let pkgs_ = pkgs; in
+
+let
+  pkgs = pkgs_.overridePackages (self: super: {
+    # Override subversion derivation to
+    #  - activate python bindings
+    #  - set version to 1.8
+    subversion = super.subversion18.override {
+       httpSupport = true;
+       pythonBindings = true;
+       python = self.python27Packages.python;
+    };
+  });
+
+  inherit (pkgs.lib) fix extends;
+
+  basePythonPackages = with builtins; if isAttrs pythonPackages
+    then pythonPackages
+    else getAttr pythonPackages pkgs;
+
+  elem = builtins.elem;
+  basename = path: with pkgs.lib; last (splitString "/" path);
+  startsWith = prefix: full: let
+    actualPrefix = builtins.substring 0 (builtins.stringLength prefix) full;
+  in actualPrefix == prefix;
+
+  src-filter = path: type: with pkgs.lib;
+    let
+      ext = last (splitString "." path);
+    in
+      !elem (basename path) [
+        ".git" ".hg" "__pycache__" ".eggs" "node_modules"
+        "build" "data" "tmp"] &&
+      !elem ext ["egg-info" "pyc"] &&
+      !startsWith "result" path;
+
+  rhodecode-enterprise-ce-src = builtins.filterSource src-filter ./.;
+
+  # Load the generated node packages
+  nodePackages = pkgs.callPackage "${pkgs.path}/pkgs/top-level/node-packages.nix" rec {
+    self = nodePackages;
+    generated = pkgs.callPackage ./pkgs/node-packages.nix { inherit self; };
+  };
+
+  # TODO: Should be taken automatically out of the generates packages.
+  # apps.nix has one solution for this, although I'd prefer to have the deps
+  # from package.json mapped in here.
+  nodeDependencies = with nodePackages; [
+    grunt
+    grunt-contrib-concat
+    grunt-contrib-jshint
+    grunt-contrib-less
+    grunt-contrib-watch
+    jshint
+  ];
+
+  pythonGeneratedPackages = self: basePythonPackages.override (a: {
+    inherit self;
+  })
+  // (scopedImport {
+    self = self;
+    super = basePythonPackages;
+    inherit pkgs;
+    inherit (pkgs) fetchurl fetchgit;
+  } ./pkgs/python-packages.nix);
+
+  pythonOverrides = import ./pkgs/python-packages-overrides.nix {
+    inherit
+      basePythonPackages
+      pkgs;
+  };
+
+  pythonLocalOverrides = self: super: {
+    rhodecode-enterprise-ce =
+      let
+        version = "${builtins.readFile ./rhodecode/VERSION}";
+        linkNodeModules = ''
+          echo "Link node packages"
+          # TODO: check if this adds stuff as a dependency, closure size
+          rm -fr node_modules
+          mkdir -p node_modules
+          ${pkgs.lib.concatMapStrings (dep: ''
+            ln -sfv ${dep}/lib/node_modules/${dep.pkgName} node_modules/
+          '') nodeDependencies}
+          echo "DONE: Link node packages"
+        '';
+      in super.rhodecode-enterprise-ce.override (attrs: {
+
+      inherit doCheck;
+      name = "rhodecode-enterprise-ce-${version}";
+      version = version;
+      src = rhodecode-enterprise-ce-src;
+
+      buildInputs =
+        attrs.buildInputs ++
+        (with self; [
+          pkgs.nodePackages.grunt-cli
+          pkgs.subversion
+          pytest-catchlog
+          rc_testdata
+        ]);
+
+      propagatedBuildInputs = attrs.propagatedBuildInputs ++ (with self; [
+        rhodecode-tools
+      ]);
+
+      # TODO: johbo: Make a nicer way to expose the parts. Maybe
+      # pkgs/default.nix?
+      passthru = {
+        inherit myPythonPackagesUnfix;
+        pythonPackages = self;
+      };
+
+      LC_ALL = "en_US.UTF-8";
+      LOCALE_ARCHIVE =
+        if pkgs.stdenv ? glibc
+        then "${pkgs.glibcLocales}/lib/locale/locale-archive"
+        else "";
+
+      # Somewhat snappier setup of the development environment
+      # TODO: move into shell.nix
+      # TODO: think of supporting a stable path again, so that multiple shells
+      #       can share it.
+      shellHook = ''
+        tmp_path=$(mktemp -d)
+        export PATH="$tmp_path/bin:$PATH"
+        export PYTHONPATH="$tmp_path/${self.python.sitePackages}:$PYTHONPATH"
+        mkdir -p $tmp_path/${self.python.sitePackages}
+        python setup.py develop --prefix $tmp_path --allow-hosts ""
+      '' + linkNodeModules;
+
+      preCheck = ''
+        export PATH="$out/bin:$PATH"
+      '';
+
+      postCheck = ''
+        rm -rf $out/lib/${self.python.libPrefix}/site-packages/pytest_pylons
+        rm -rf $out/lib/${self.python.libPrefix}/site-packages/rhodecode/tests
+      '';
+
+      preBuild = linkNodeModules + ''
+        grunt
+        rm -fr node_modules
+      '';
+
+      postInstall = ''
+        # python based programs need to be wrapped
+        ln -s ${self.supervisor}/bin/supervisor* $out/bin/
+        ln -s ${self.gunicorn}/bin/gunicorn $out/bin/
+        ln -s ${self.PasteScript}/bin/paster $out/bin/
+
+        # rhodecode-tools
+        # TODO: johbo: re-think this. Do the tools import anything from enterprise?
+        ln -s ${self.rhodecode-tools}/bin/rhodecode-* $out/bin/
+
+        # note that condition should be restricted when adding further tools
+        for file in $out/bin/*; do  #*/
+          wrapProgram $file \
+              --prefix PYTHONPATH : $PYTHONPATH \
+              --set PYTHONHASHSEED random
+        done
+
+        mkdir $out/etc
+        cp configs/production.ini $out/etc
+
+        echo "Writing meta information for rccontrol to nix-support/rccontrol"
+        mkdir -p $out/nix-support/rccontrol
+        cp -v rhodecode/VERSION $out/nix-support/rccontrol/version
+        echo "DONE: Meta information for rccontrol written"
+
+        # TODO: johbo: Make part of ac-tests
+        if [ ! -f rhodecode/public/js/scripts.js ]; then
+          echo "Missing scripts.js"
+          exit 1
+        fi
+        if [ ! -f rhodecode/public/css/style.css ]; then
+          echo "Missing style.css"
+          exit 1
+        fi
+      '';
+
+    });
+
+    rc_testdata = self.buildPythonPackage rec {
+      name = "rc_testdata-0.7.0";
+      src = pkgs.fetchhg {
+        url = "https://code.rhodecode.com/upstream/rc_testdata";
+        rev = "v0.7.0";
+        sha256 = "0w3z0zn8lagr707v67lgys23sl6pbi4xg7pfvdbw58h3q384h6rx";
+      };
+    };
+
+  };
+
+  # Apply all overrides and fix the final package set
+  myPythonPackagesUnfix =
+    (extends pythonExternalOverrides
+    (extends pythonLocalOverrides
+    (extends pythonOverrides
+             pythonGeneratedPackages)));
+  myPythonPackages = (fix myPythonPackagesUnfix);
+
+in myPythonPackages.rhodecode-enterprise-ce

docs-internal/vcs/http-transition.rst

@@ -0,0 +1,15 @@
+.. _vcs-http:
+
+========================================
+ Transition to HTTP based communication
+========================================
+
+We are in the process of replacing the Pyro4 based communication with an HTTP
+based implementation. Currently both backends are supported and can be
+activated via various settings in the configuration.
+
+To run the system in full HTTP based mode, use the following settings::
+
+   vcs.hooks.protocol = http
+   vcs.scm_app_implementation = rhodecode.lib.middleware.utils.scm_app_http
+   vcs.server.protocol = http

docs-internal/vcs/index.rst

@@ -0,0 +1,23 @@
+
+======================================
+ VCS client and VCSServer integration
+======================================
+
+Enterprise uses the VCSServer as a backend to provide version control
+functionalities. This section describes the components in Enterprise which talk
+to the VCSServer.
+
+The client library is implemented in :mod:`rhodecode.lib.vcs`. For HTTP based
+access of the command line clients special middlewares and utilities are
+implemented in :mod:`rhodecode.lib.middleware`.
+
+
+
+
+.. toctree::
+   :maxdepth: 2
+
+   http-transition
+   middleware
+   vcsserver
+   subversion

docs/.howto

@@ -0,0 +1,4 @@
+# building the docs
+cd docs
+nix-build default.nix -o result
+make clean html

docs/Makefile

@@ -0,0 +1,177 @@
+# Makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = ./result/bin/sphinx-build
+PAPER         =
+BUILDDIR      = _build
+
+# User-friendly check for sphinx-build
+ifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1)
+$(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/)
+endif
+
+# Internal variables.
+PAPEROPT_a4     = -D latex_paper_size=a4
+PAPEROPT_letter = -D latex_paper_size=letter
+ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+# the i18n builder cannot share the environment and doctrees with the others
+I18NSPHINXOPTS  = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) .
+
+.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext
+
+help:
+	@echo "Please use \`make <target>' where <target> is one of"
+	@echo "  html       to make standalone HTML files"
+	@echo "  dirhtml    to make HTML files named index.html in directories"
+	@echo "  singlehtml to make a single large HTML file"
+	@echo "  pickle     to make pickle files"
+	@echo "  json       to make JSON files"
+	@echo "  htmlhelp   to make HTML files and a HTML help project"
+	@echo "  qthelp     to make HTML files and a qthelp project"
+	@echo "  devhelp    to make HTML files and a Devhelp project"
+	@echo "  epub       to make an epub"
+	@echo "  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
+	@echo "  latexpdf   to make LaTeX files and run them through pdflatex"
+	@echo "  latexpdfja to make LaTeX files and run them through platex/dvipdfmx"
+	@echo "  text       to make text files"
+	@echo "  man        to make manual pages"
+	@echo "  texinfo    to make Texinfo files"
+	@echo "  info       to make Texinfo files and run them through makeinfo"
+	@echo "  gettext    to make PO message catalogs"
+	@echo "  changes    to make an overview of all changed/added/deprecated items"
+	@echo "  xml        to make Docutils-native XML files"
+	@echo "  pseudoxml  to make pseudoxml-XML files for display purposes"
+	@echo "  linkcheck  to check all external links for integrity"
+	@echo "  doctest    to run all doctests embedded in the documentation (if enabled)"
+
+clean:
+	rm -rf $(BUILDDIR)/*
+
+html:
+	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
+
+dirhtml:
+	$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
+
+singlehtml:
+	$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
+	@echo
+	@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
+
+pickle:
+	$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
+	@echo
+	@echo "Build finished; now you can process the pickle files."
+
+json:
+	$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
+	@echo
+	@echo "Build finished; now you can process the JSON files."
+
+htmlhelp:
+	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
+	@echo
+	@echo "Build finished; now you can run HTML Help Workshop with the" \
+	      ".hhp project file in $(BUILDDIR)/htmlhelp."
+
+qthelp:
+	$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
+	@echo
+	@echo "Build finished; now you can run "qcollectiongenerator" with the" \
+	      ".qhcp project file in $(BUILDDIR)/qthelp, like this:"
+	@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/RhodeCodeInstaller.qhcp"
+	@echo "To view the help file:"
+	@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/RhodeCodeInstaller.qhc"
+
+devhelp:
+	$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
+	@echo
+	@echo "Build finished."
+	@echo "To view the help file:"
+	@echo "# mkdir -p $$HOME/.local/share/devhelp/RhodeCodeInstaller"
+	@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/RhodeCodeInstaller"
+	@echo "# devhelp"
+
+epub:
+	$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
+	@echo
+	@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
+
+latex:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo
+	@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
+	@echo "Run \`make' in that directory to run these through (pdf)latex" \
+	      "(use \`make latexpdf' here to do that automatically)."
+
+latexpdf:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo "Running LaTeX files through pdflatex..."
+	$(MAKE) -C $(BUILDDIR)/latex all-pdf
+	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
+
+latexpdfja:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo "Running LaTeX files through platex and dvipdfmx..."
+	$(MAKE) -C $(BUILDDIR)/latex all-pdf-ja
+	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
+
+text:
+	$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
+	@echo
+	@echo "Build finished. The text files are in $(BUILDDIR)/text."
+
+man:
+	$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
+	@echo
+	@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
+
+texinfo:
+	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+	@echo
+	@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
+	@echo "Run \`make' in that directory to run these through makeinfo" \
+	      "(use \`make info' here to do that automatically)."
+
+info:
+	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+	@echo "Running Texinfo files through makeinfo..."
+	make -C $(BUILDDIR)/texinfo info
+	@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
+
+gettext:
+	$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
+	@echo
+	@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
+
+changes:
+	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
+	@echo
+	@echo "The overview file is in $(BUILDDIR)/changes."
+
+linkcheck:
+	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
+	@echo
+	@echo "Link check complete; look for any errors in the above output " \
+	      "or in $(BUILDDIR)/linkcheck/output.txt."
+
+doctest:
+	$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
+	@echo "Testing of doctests in the sources finished, look at the " \
+	      "results in $(BUILDDIR)/doctest/output.txt."
+
+xml:
+	$(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml
+	@echo
+	@echo "Build finished. The XML files are in $(BUILDDIR)/xml."
+
+pseudoxml:
+	$(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml
+	@echo
+	@echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml."

docs/_templates/layout.html

@@ -0,0 +1,18 @@
+{% extends "!layout.html" %}
+{% set css_files = css_files + ['_static/add.css'] %}
+
+{% block footer %}
+{{ super() }}
+
+  <script>
+    (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
+    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
+    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
+    })(window,document,'script','//www.google-analytics.com/analytics.js','ga');
+
+    ga('create', 'UA-55639800-3', 'auto');
+    ga('send', 'pageview');
+
+  </script>
+
+{% endblock %}

docs/admin/adding-anonymous-user.rst

@@ -0,0 +1,22 @@
+.. _permissions-info-anon-ref:
+
+Anonymous Users
+---------------
+
+By default, |RCM| provides |repo| access for registered users only. It can be
+configured to be **world-open** in terms of read and write permissions. This
+configuration is called "Anonymous Access" and allows |RCM| to be used as a
+public hub where unregistered users have access to your |repos|.
+
+Anonymous access is useful for open source projects, universities,
+or if running inside a restricted internal corporate network to serve
+documents to all employees. Anonymous users get the default user permission
+settings that are applied across the whole |RCM| system.
+
+To enable anonymous access to your |repos|, use the following steps:
+
+1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`.
+2. On the Application tab, check the :guilabel:`Allow anonymous access` box.
+3. Select :guilabel:`Save`.
+4. To set the anonymous user access permissions, which are based on the
+   default user settings, see :ref:`permissions-default-ref`.

docs/admin/adding-new-user.rst

@@ -0,0 +1,20 @@
+.. _permissions-add-user:
+
+Adding Users
+------------
+
+To create a new user, use the following steps.
+
+1. Select :menuselection:`Admin --> Users` in the top menu.
+2. Select the :guilabel:`Add User` button at the top right.
+3. Set the user credentials.
+4. Select :guilabel:`Save`.
+
+Once the user is created you can set which groups they belong to using the
+following steps:
+
+1. From the :menuselection:`Admin --> Users Groups` page select
+   :guilabel:`edit` beside the user group you want to include them in.
+2. On the :guilabel:`Settings` page, move the user from
+   :guilabel:`Available Members` into :guilabel:`Chosen Members` and
+   :guilabel:`Save`.

docs/admin/admin-tricks.rst

@@ -0,0 +1,222 @@
+.. _admin-tricks:
+
+One-time Admin Tasks
+--------------------
+
+* :ref:`web-analytics`
+* :ref:`admin-tricks-license`
+* :ref:`announcements`
+* :ref:`md-rst`
+* :ref:`repo-stats`
+* :ref:`server-side-merge`
+* :ref:`remap-rescan`
+* :ref:`custom-hooks`
+* :ref:`clear-repo-cache`
+* :ref:`set-repo-pub`
+* :ref:`ping`
+
+.. _web-analytics:
+
+Adding Web Analytics
+^^^^^^^^^^^^^^^^^^^^
+
+If you wish to add a Google Analytics, or any other kind of tracker to your
+|RCE| instance you can add the necessary codes to the header or footer
+section of each instance using the following steps:
+
+1. From the |RCE| interface, select
+   :menuselection:`Admin --> Settings --> Global`
+2. To add a tracking code to you instance, enter it in the header or footer
+   section and select **Save**
+
+Use the example templates in the drop-down menu to set up your configuration.
+
+.. _admin-tricks-license:
+
+Licence Key Management
+^^^^^^^^^^^^^^^^^^^^^^
+
+To manage your license key, go to
+:menuselection:`Admin --> Settings --> License`.
+On this page you can see the license key details. If you need a new license,
+or have questions about your current one, contact support@rhodecode.com
+
+.. _announcements:
+
+Server-wide Announcements
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+If you need to make a server-wide announcement to all users,
+you can add a message to be displayed using the following steps:
+
+1. From the |RCE| interface, select
+   :menuselection:`Admin --> Settings --> Global`
+2. To add a message that will be displayed to all users,
+   select :guilabel:`Server Announcement` from the drop-down menu and
+   change the ``var message = "TYPE YOUR MESSAGE HERE";`` example line.
+3. Select :guilabel:`Save`, and you will see the message once your page
+   refreshes.
+
+.. image:: ../images/server-wide-announcement.png
+   :alt: Server Wide Announcement
+
+.. _md-rst:
+
+Markdown or RST Rendering
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+|RCE| can use `Markdown`_ or `reStructured Text`_ in commit message,
+code review messages, and inline comments. To set the default to either,
+select your preference from the drop-down menu on the
+:menuselection:`Admin --> Settings --> Visual` page and select
+:guilabel:`Save settings`.
+
+.. _repo-stats:
+
+Enabling Repository Statistics
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To enable |repo| statistics, use the following steps:
+
+1. From the |RCE| interface, open
+   :menuselection:`Admin --> Repositories` and select
+   :guilabel:`Edit` beside the |repo| for which you wish to enable statistics.
+2. Check the :guilabel:`Enable statistics` box, and select :guilabel:`Save`
+
+.. _server-side-merge:
+
+Enabling Server-side Merging
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To enable server-side merging, use the following steps:
+
+1. From the |RCE| interface, open :menuselection:`Admin --> Settings --> VCS`
+2. Check the :guilabel:`Server-side merge` box, and select
+   :guilabel:`Save Settings`
+
+If you encounter slow performance with server-side merging enabled, check the
+speed at which your server is performing actions. When server-side merging is
+enabled, the following actions occurs on the server.
+
+* A |pr| is created in the database.
+* A shadow |repo| is created as a working environment for the |pr|.
+* On display, |RCE| checks if the |pr| can be merged.
+
+To check how fast the shadow |repo| creation is occurring on your server, use
+the following steps:
+
+1. Log into your server and create a directory in your |repos| folder.
+2. Clone a |repo| that is showing slow performance and time the action.
+
+.. code-block:: bash
+
+   # One option is to use the time command
+   $ time hg clone SOURCE_REPO TARGET
+
+.. _remap-rescan:
+
+Remap and Rescan Repositories
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+You may want to Remap and rescan the |repos| that |RCE| is managing to ensure
+the system is always up-to-date. This is useful after importing, deleting,
+or carrying out general cleaning up operations. To do this use the
+following steps:
+
+1. From the |RCE|, open
+   :menuselection:`Admin --> Settings --> Remap and rescan`
+2. Click :guilabel:`Rescan Repositories`
+
+Check the additional options if needed:
+
+* :guilabel:`Destroy old data`: Useful for purging deleted repository
+  information from the database.
+* :guilabel:`Invalidate cache for all repositories`: Use this to completely
+  remap all |repos|. Useful when importing or migrating |repos| to ensure all
+  new information is picked up.
+
+.. _custom-hooks:
+
+Adding Custom Hooks
+^^^^^^^^^^^^^^^^^^^
+
+To add custom hooks to your instance, use the following steps:
+
+1. Open :menuselection:`Admin --> Settings --> Hooks`
+2. Add your custom hook details, you can use a file path to specify custom
+   hook scripts, for example: ``python:/path/to/custom_hook.py``
+3. Select :guilabel:`Save`
+
+Also, see the |RC| Extensions section of the :ref:`rc-tools` guide. |RC|
+Extensions can be used to add additional hooks to your instance and comes
+with a number of pre-built plugins if you chose to install them.
+
+.. _clear-repo-cache:
+
+Clearing |repo| cache
+^^^^^^^^^^^^^^^^^^^^^
+
+If you need to clear the cache for a particular |repo|, use the following steps:
+
+1. Open :menuselection:`Admin --> Repositories` and select :guilabel:`Edit`
+   beside the |repo| whose cache you wish to clear.
+2. On the |repo| settings page, go to the :guilabel:`Caches` tab and select
+   :guilabel:`Invalidate repository cache`.
+
+.. _set-lang:
+
+Changing Default Language
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To change the default language of a |RCE| instance, change the language code
+in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. To
+do this, use the following steps.
+
+1. Open the :file:`rhodecode.ini` file and set the required language code.
+
+.. code-block:: ini
+
+   ## Optional Languages
+   ## en(default), de, fr, it, ja, pl, pt, ru, zh
+   lang = de
+
+2. Restart the |RCE| instance and check that the language has been updated.
+
+.. code-block:: bash
+
+   $ rccontrol restart enterprise-2
+   Instance "enterprise-2" successfully stopped.
+   Instance "enterprise-2" successfully started.
+
+.. image:: ../images/language.png
+
+.. _set-repo-pub:
+
+Setting Repositories to Publish
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To automatically promote your local |repos| to public after pushing to |RCE|,
+enable the :guilabel:`Set repositories as publishing` option on the
+:menuselection:`Admin --> Settings --> VCS` page.
+
+.. note::
+
+   This option is enabled by default on most |RCE| versions, but if upgrading
+   from a 1.7.x version it could be disabled on upgrade due to inheriting
+   older default settings.
+
+.. _ping:
+
+Pinging the |RCE| Server
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+You can check the IP Address of your |RCE| instance using the
+following URL: ``{instance-URL}/_admin/ping``.
+
+.. code-block:: bash
+
+   $ curl https://your.rhodecode.url/_admin/ping
+   pong[rce-7880] => 203.0.113.23
+
+.. _Markdown: http://daringfireball.net/projects/markdown/
+.. _reStructured Text: http://docutils.sourceforge.net/docs/index.html

docs/admin/apache-conf-examples.rst

@@ -0,0 +1,114 @@
+.. _apache-conf-eg:
+
+Apache Configuration Examples
+-----------------------------
+
+Use the following example to securely configure your Apache HTTP virtual hosts
+file.
+
+.. code-block:: apache
+
+    <VirtualHost *:80>
+        ServerName hg.myserver.com
+        ServerAlias hg.myserver.com
+
+        <Proxy *>
+          Order allow,deny
+          Allow from all
+        </Proxy>
+
+        # important !
+        # Directive to properly generate url (clone url) for pylons
+
+        ProxyPreserveHost On
+
+        #rhodecode instance
+        ProxyPass / http://127.0.0.1:5000/
+        ProxyPassReverse / http://127.0.0.1:5000/
+
+        # Set strict HTTPS
+        Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
+
+        # Set x-frame options
+        Header always append X-Frame-Options SAMEORIGIN
+
+        # To enable https use line below
+        # SetEnvIf X-Url-Scheme https HTTPS=1
+
+        # Secure your Diffie-hellmann deployment
+        SSLProtocol             all -SSLv2 -SSLv3
+        SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+        SSLHonorCipherOrder     on
+        SSLOpenSSLConfCmd DHParameters "{path to dhparams.pem}"
+
+    </VirtualHost>
+
+Use the following example to configure Apache for a multi-node setup. The
+timeout setting should be increased if you experience timeouts when working
+with large |repos|.
+
+.. code-block:: apache
+
+    #
+    # Timeout: The number of seconds before receives and sends time out.
+    #
+    Timeout 600
+
+    <VirtualHost *:80>
+
+            ProxyRequests off
+
+            #important !
+            #Directive to properly generate url (clone url) for pylons
+            ProxyPreserveHost On
+
+            ServerName your.rce.com
+            ServerAlias your.rce.com
+
+            <Proxy balancer://mycluster>
+                    # WebHead1
+                    BalancerMember http://10.58.1.171:10002 route=1
+                    # WebHead2
+                    BalancerMember http://10.58.1.172:10001 route=2
+
+                    # Security "technically we aren't blocking
+                    # anyone but this the place to make those
+                    # chages
+                    Order Deny,Allow
+                    Deny from none
+                    Allow from all
+
+                    # Load Balancer Settings
+                    # We will be configuring a simple Round
+                    # Robin style load balancer. This means
+                    # that all webheads take an equal share of
+                    # of the load.
+                    ProxySet stickysession=ROUTEID
+
+            </Proxy>
+
+            # balancer-manager
+            # This tool is built into the mod_proxy_balancer
+            # module and will allow you to do some simple
+            # modifications to the balanced group via a gui
+            # web interface.
+            <Location /balancer-manager>
+                    SetHandler balancer-manager
+
+                    # recommend locking this one down to your
+                    # your office
+                   Order deny,allow
+                    Allow from all
+            </Location>
+
+            # Point of Balance
+            # This setting will allow to explicitly name the
+            # the location in the site that we want to be
+            # balanced, in this example we will balance "/"
+            # or everything in the site.
+            ProxyPass /balancer-manager !
+            ProxyPass / balancer://mycluster/
+
+            ProxyPassReverse / balancer://mycluster/
+
+    </VirtualHost>

docs/admin/apache-config.rst

@@ -0,0 +1,15 @@
+.. _apache-ws-ref:
+
+Apache HTTP Server Configuration
+--------------------------------
+
+To set up your Apache Web Server for optimal performance and security, use
+the information in the following sections.
+
+.. toctree::
+
+   apache-diffie-hellman
+   apache-conf-examples
+   apache-subdirectory
+   apache-reverse-proxy
+   apache-wsgi-coding

docs/admin/apache-diffie-hellman.rst

@@ -0,0 +1,34 @@
+.. _dh-apache:
+
+Diffie-Hellman Security
+-----------------------
+
+To secure your web server, the `Guide to Deploying Diffie-Hellman for TLS`_
+contains important information worth reading. This link contains some good
+`secure Apache configuration`_ examples.
+
+To secure your deployment of Diffie-Hellman, configure the following:
+
+1. Generate a strong Diffie-hellman group, 2048-bit or stronger.
+
+.. code-block:: bash
+
+    # to generate your dhparam.pem file, run in the terminal
+    openssl dhparam -out /etc/apache/ssl/dhparam.pem 2048
+
+2. Configure your server to only use modern, secure cipher suites in the
+   virtual hosts configuration file.
+
+.. code-block:: apache
+
+    # Set the protocol to only use modern, secure cipher suites.
+    SSLProtocol             all -SSLv2 -SSLv3
+    SSLHonorCipherOrder     on
+    SSLCipherSuite          ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
+
+    # Specify your DH params file as follows
+    SSLOpenSSLConfCmd DHParameters "{path to dhparams.pem}"
+
+
+.. _Guide to Deploying Diffie-Hellman for TLS: https://weakdh.org/sysadmin.html
+.. _secure Apache configuration: http://www.apache-ssl.org/httpd.conf.example

docs/admin/apache-reverse-proxy.rst

@@ -0,0 +1,33 @@
+Apache Reverse Proxy
+^^^^^^^^^^^^^^^^^^^^
+
+Here is a sample configuration file for using Apache as a reverse proxy.
+
+.. code-block:: apache
+
+    <VirtualHost *:80>
+            ServerName hg.myserver.com
+            ServerAlias hg.myserver.com
+
+            ## uncomment root directive if you want to serve static files by nginx
+            ## requires static_files = false in .ini file
+            DocumentRoot /path/to/installation/rhodecode/public
+
+            <Proxy *>
+              Order allow,deny
+              Allow from all
+            </Proxy>
+
+            #important !
+            #Directive to properly generate url (clone url) for pylons
+            ProxyPreserveHost On
+
+            #rhodecode instance
+            ProxyPass / http://127.0.0.1:5000/
+            ProxyPassReverse / http://127.0.0.1:5000/
+
+            #to enable https use line below
+            #SetEnvIf X-Url-Scheme https HTTPS=1
+
+    </VirtualHost>
+

docs/admin/apache-subdirectory.rst

@@ -0,0 +1,32 @@
+.. _apache-sub-ref:
+
+Apache URL Prefix Configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Use the following example to configure Apache to use a URL prefix.
+
+.. code-block:: apache
+
+    <Location /<someprefix> > # Change <someprefix> into your chosen prefix
+      ProxyPass http://127.0.0.1:5000/<someprefix>
+      ProxyPassReverse http://127.0.0.1:5000/<someprefix>
+      SetEnvIf X-Url-Scheme https HTTPS=1
+    </Location>
+
+In addition to the regular Apache setup you will need to add the following
+lines into the ``rhodecode.ini`` file.
+
+* In the the ``[app:main]`` section of your ``rhodecode.ini`` file add the
+  following line.
+
+.. code-block:: ini
+
+    filter-with = proxy-prefix
+
+* At the end of the ``rhodecode.ini`` file add the following section.
+
+.. code-block:: ini
+
+    [filter:proxy-prefix]
+    use = egg:PasteDeploy#prefix
+    prefix = /<someprefix> # Change <someprefix> into your chosen prefix

docs/admin/apache-wsgi-coding.rst

@@ -0,0 +1,55 @@
+.. _apache-wsgi-ref:
+
+Apache WSGI Configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+|RCM| can also be set up with Apache under ``mod_wsgi``. To configure this
+use the following steps.
+
+1. Install ``mod_wsgi`` using the following command:
+   ``aptitude install libapache2-mod-wsgi``.
+2. Enable ``mod_wsgi`` using the following command: ``a2enmod wsgi``
+3. Create a ``wsgi`` dispatch script, using the following examples.
+
+.. code-block:: bash
+
+   WSGIDaemonProcess pylons \
+   threads=4 \
+   # check the python virtual env location
+   python-path=/home/web/rhodecode/pyenv/lib/python2.6/site-packages
+   # Check the install location
+   WSGIScriptAlias / /home/web/rhodecode/dispatch.wsgi
+   WSGIPassAuthorization On
+     # user=www-data group=www-data # Enable if running Apache as root
+
+.. note::
+
+   Do not set ``processes=num`` in this configuration file. Running |RCE| in
+   multiprocess mode with Apache is not supported.
+
+The following is an example ``wsgi`` dispatch script.
+
+.. code-block:: python
+
+    import os
+    os.environ["HGENCODING"] = "UTF-8"
+    os.environ['PYTHON_EGG_CACHE'] = '/home/web/rhodecode/.egg-cache'
+
+    # Set the current dir
+    os.chdir('/home/web/rhodecode/')
+
+    import site
+    site.addsitedir("/home/web/rhodecode/pyenv/lib/python2.6/site-packages")
+
+    from paste.deploy import loadapp
+    from paste.script.util.logging_config import fileConfig
+
+    fileConfig('/home/web/rhodecode/production.ini')
+    application = loadapp('config:/home/web/rhodecode/production.ini')
+
+.. note::
+
+   When using `mod_wsgi` the same version of |hg| must be running in your
+   system's |PY| environment and on |RCM|. To check the |RCM| version,
+   on the interface go to
+   :menuselection:`Admin --> Settings --> System Info`

docs/admin/backup-restore.rst

@@ -0,0 +1,127 @@
+.. _backup-ref:
+
+Backup and Restore
+==================
+
+*“The condition of any backup is unknown until a restore is attempted.”*
+`Schrödinger's Backup`_
+
+To snapshot an instance of |RCE|, and save its settings, you need to backup the
+following parts of the system at the same time.
+
+* The |repos| managed by the instance.
+* The |RCE| database.
+* Any configuration files or extensions that you've configured.
+
+.. important::
+
+   Ideally you should script all of these functions so that it creates a
+   backup snapshot of your system at a particular timestamp and then run that
+   script regularly.
+
+Backup Details
+--------------
+
+To backup the relevant parts of |RCE| required to restore your system, use
+the information in this section to identify what is important to you.
+
+Repository Backup
+^^^^^^^^^^^^^^^^^
+
+To back up your |repos|, use the API to get a list of all |repos| managed,
+and then clone them to your backup location.
+
+Use the ``get_repos`` method to list all your managed |repos|,
+and use the ``clone_uri`` information that is returned. See the :ref:`api`
+for more information.
+
+.. important::
+
+   This will not work for |svn| |repos|. Currently the only way to back up
+   your |svn| |repos| is to make a copy of them.
+
+   It is also important to note, that you can only restore the |svn| |repos|
+   using the same version as they were saved with.
+
+Database Backup
+^^^^^^^^^^^^^^^
+
+The instance database contains all the |RCE| permissions settings,
+and user management information. To backup your database,
+export it using the following appropriate example, and then move it to your
+backup location:
+
+.. code-block:: bash
+
+   # For MySQL DBs
+   $ mysqldump -u <uname> -p <pass> db_name > mysql-db-backup
+
+   # For PostgreSQL DBs
+   $ pg_dump dbname > postgresql-db-backup
+
+   # For SQLlite
+   $ sqlite3 rhodecode.db ‘.dump’ > sqlite-db-backup
+
+
+The default |RCE| SQLite database location is
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.db`
+
+If running MySQL or PostgreSQL databases, you will have configured these
+separately, for more information see :ref:`rhodecode-database-ref`
+
+Configuration File Backup
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Depending on your setup, you could have a number of configuration files that
+should be backed up. You may have some, or all of the configuration files
+listed in the :ref:`config-rce-files` section. Ideally you should back these
+up at the same time as the database and |repos|.
+
+Gist Backup
+^^^^^^^^^^^
+
+To backup the gists on your |RCE| instance you can use the ``get_users`` and
+``get_gists`` API methods to fetch the gists for each user on the instance.
+
+Extension Backups
+^^^^^^^^^^^^^^^^^
+
+You should also backup any extensions added in the
+:file:`home/{user}/.rccontrol/{instance-id}/rcextensions` directory.
+
+Full-text Search Backup
+^^^^^^^^^^^^^^^^^^^^^^^
+
+You may also have full text search set up, but the index can be rebuild from
+re-imported |repos| if necessary. You will most likely want to backup your
+:file:`mapping.ini` file if you've configured that. For more information, see
+the :ref:`indexing-ref` section.
+
+Restoration Steps
+-----------------
+
+To restore an instance of |RCE| from its backed up components, use the
+following steps.
+
+1. Install a new instance of |RCE|.
+2. Once installed, configure the instance to use the backed up
+   :file:`rhodecode.ini` file. Ensure this file points to the backed up
+   database, see the :ref:`config-database` section.
+3. Restart |RCE| and remap and rescan your |repos|, see the
+   :ref:`remap-rescan` section.
+
+Post Restoration Steps
+^^^^^^^^^^^^^^^^^^^^^^
+
+Once you have restored your |RCE| instance to basic functionality, you can
+then work on restoring any specific setup changes you had made.
+
+* To recreate the |RCE| index, use the backed up :file:`mapping.ini` file if
+  you had made changes and rerun the indexer. See the
+  :ref:`indexing-ref` section for details.
+* To reconfigure any extensions, copy the backed up extensions into the
+  :file:`/home/{user}/.rccontrol/{instance-id}/rcextensions` and also specify
+  any custom hooks if necessary. See the :ref:`integrations-ref` section for
+  details.
+
+.. _Schrödinger's Backup: http://novabackup.novastor.com/blog/schrodingers-backup-good-bad-backup/

docs/admin/cleanup-cmds.rst

@@ -0,0 +1,23 @@
+.. _clean-up-cmds:
+
+|RCT| Clean Up Commands
+=======================
+
+|RCT| comes with a number of functions which can be used to administer your
+|RCE| instances. Two of these can be used to automate the cleanup of gists
+and |repos|
+
+rhodecode-cleanup-gists
+-----------------------
+
+Use this command to delete gists within RhodeCode Enterprise. It takes a
+number of options for specifying the kind of gists you want deleted, and it
+is possible to run these commands from a cron job or cleanup script. For more
+information, see the :ref:`tools-cli`
+
+rhodecode-cleanup-repos
+-----------------------
+
+Use this command to delete |repos| from your |RCE| instances. It takes
+a number of options specifying the kind of |repos| you want deleted. For more
+information, see the :ref:`tools-cli`

docs/admin/config-files-overview.rst

@@ -0,0 +1,74 @@
+.. _config-files:
+
+Configuration Files Overview
+============================
+
+|RCE| and |RCC| have a number of different configuration files. The following
+is a brief explanation of each, and links to their associated configuration
+sections.
+
+.. rst-class:: dl-horizontal
+
+    \- **rhodecode.ini**
+        Default location:
+        :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
+
+        This is the main |RCE| configuration file and controls much of its
+        default behaviour. It is also used to configure certain customer
+        settings. Here are some of the most common reasons to make changes to
+        this file.
+
+        * :ref:`config-database`
+        * :ref:`set-up-mail`
+        * :ref:`increase-gunicorn`
+        * :ref:`x-frame`
+
+    \- **mapping.ini**
+        Default location:
+        :file:`/home/{user}/.rccontrol/{instance-id}/mapping.ini`
+
+        This file is used to control the |RCE| indexer. It comes configured
+        to index your instance. To change the default configuration, see
+        :ref:`advanced-indexing`.
+
+    \- **vcsserver.ini**
+        Default location:
+        :file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini`
+
+        The VCS Server handles the connection between your |repos| and |RCE|.
+        See the :ref:`vcs-server` section for configuration options and more
+        detailed information.
+
+    \- **supervisord.ini**
+        Default location:
+        :file:`/home/{user}/.rccontrol/supervisor/supervisord.ini`
+
+        |RCC| uses Supervisor to monitor and manage installed instances of
+        |RCE| and the VCS Server. |RCC| will manage this file completely,
+        unless you install |RCE| in self-managed mode. For more information,
+        see the :ref:`Supervisor Setup<control:supervisor-setup>` section.
+
+    \- **.rccontrol.ini**
+        Default location: :file:`/home/{user}/.rccontrol.ini`
+
+        This file contains the instances that |RCC| starts at boot, which is all
+        by default, but for more information, see
+        the :ref:`Manually Start At Boot <control:set-start-boot>` section.
+
+    \- **.rhoderc**
+        Default location: :file:`/home/{user}/.rhoderc`
+
+        This file is used by the |RCE| API when accessing an instance from a
+        remote machine. The API checks this file for connection and
+        authentication details. For more details, see the :ref:`config-rhoderc`
+        section.
+
+    \- **MANIFEST**
+        Default location: :file:`/home/{user}/.rccontrol/cache/MANIFEST`
+
+        |RCC| uses this file to source the latest available builds from the
+        secure |RC| download channels. The only reason to mess with this file
+        is if you need to do an offline installation,
+        see the :ref:`Offline Installation<control:offline-installer-ref>`
+        instructions, otherwise |RCC| will completely manage this file.
+

docs/admin/default-user-perms.rst

@@ -0,0 +1,32 @@
+.. _default-perms:
+
+Default User Permissions
+------------------------
+
+There are two ways in which the default user settings work:
+
+System-wide Level
+^^^^^^^^^^^^^^^^^
+
+On a system-wide level, you can set the default user permissions so that
+all new users are given a certain set of permissions unless individually
+tailored, or added to a user group. For more information about system-wide
+default permissions, see the :ref:`permissions-info-anon-ref` and
+:ref:`permissions-default-ref` sections.
+
+User Group Level
+^^^^^^^^^^^^^^^^
+
+On a user group level, you can set the default user settings for the user
+group, and all users within that group will get those default permissions
+unless individually tailored. For more information about setting default
+permissions for all the different entities, see the
+:ref:`permissions-default-ref` section.
+
+For more detailed information about managing the different permissions
+settings, see the following sections:
+
+* :ref:`permissions-info-anon-ref`
+* :ref:`permissions-add-user`
+* :ref:`permissions-default-ref`
+* :ref:`permissions-info-add-group-ref`

docs/admin/enable-debug.rst

@@ -0,0 +1,136 @@
+.. _debug-mode:
+
+Enabling Debug Mode
+-------------------
+
+To enable debug mode on a |RCE| instance you need to set the debug property
+in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. To
+do this, use the following steps
+
+1. Open the file and set the ``debug`` line to ``true``
+2. Restart you instance using the ``rccontrol restart`` command,
+   see the following example:
+
+You can also set the log level, the follow are the valid options;
+``debug``, ``info``, ``warning``, or ``fatal``.
+
+.. code-block:: ini
+
+    [DEFAULT]
+    debug = true
+    pdebug = false
+
+.. code-block:: bash
+
+    # Restart your instance
+    $ rccontrol restart enterprise-1
+    Instance "enterprise-1" successfully stopped.
+    Instance "enterprise-1" successfully started.
+
+Debug and Logging Configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Further debugging and logging settings can also be set in the
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+
+In the logging section, the various packages that run with |RCE| can have
+different debug levels set. If you want to increase the logging level change
+``level = DEBUG`` line to one of the valid options.
+
+You also need to change the log level for handlers. See the example
+``##handler`` section below. The ``handler`` level takes the same options as
+the ``debug`` level.
+
+.. code-block:: ini
+
+    ################################
+    ### LOGGING CONFIGURATION   ####
+    ################################
+    [loggers]
+    keys = root, routes, rhodecode, sqlalchemy, beaker, pyro4, templates, whoosh_indexer
+
+    [handlers]
+    keys = console, console_sql, file, file_rotating
+
+    [formatters]
+    keys = generic, color_formatter, color_formatter_sql
+
+    #############
+    ## LOGGERS ##
+    #############
+    [logger_root]
+    level = NOTSET
+    handlers = console
+
+    [logger_routes]
+    level = DEBUG
+    handlers =
+    qualname = routes.middleware
+    ## "level = DEBUG" logs the route matched and routing variables.
+    propagate = 1
+
+    [logger_beaker]
+    level = DEBUG
+    handlers =
+    qualname = beaker.container
+    propagate = 1
+
+    [logger_pyro4]
+    level = DEBUG
+    handlers =
+    qualname = Pyro4
+    propagate = 1
+
+    [logger_templates]
+    level = INFO
+    handlers =
+    qualname = pylons.templating
+    propagate = 1
+
+    [logger_rhodecode]
+    level = DEBUG
+    handlers =
+    qualname = rhodecode
+    propagate = 1
+
+    [logger_sqlalchemy]
+    level = INFO
+    handlers = console_sql
+    qualname = sqlalchemy.engine
+    propagate = 0
+
+    [logger_whoosh_indexer]
+    level = DEBUG
+    handlers =
+    qualname = whoosh_indexer
+    propagate = 1
+
+    ##############
+    ## HANDLERS ##
+    ##############
+
+    [handler_console]
+    class = StreamHandler
+    args = (sys.stderr,)
+    level = INFO
+    formatter = generic
+
+    [handler_console_sql]
+    class = StreamHandler
+    args = (sys.stderr,)
+    level = WARN
+    formatter = generic
+
+    [handler_file]
+    class = FileHandler
+    args = ('rhodecode.log', 'a',)
+    level = INFO
+    formatter = generic
+
+    [handler_file_rotating]
+    class = logging.handlers.TimedRotatingFileHandler
+    # 'D', 5 - rotate every 5days
+    # you can set 'h', 'midnight'
+    args = ('rhodecode.log', 'D', 5, 10,)
+    level = INFO
+    formatter = generic

docs/admin/glossary.rst

@@ -0,0 +1,50 @@
+.. _glossary:
+
+Glossary
+========
+
+.. glossary::
+
+    DVCS
+        Distributed Version Control System, usually referring to |git| or |hg|.
+
+    Extension
+        An extension extends the capabilities of, or the data available to,
+        an existing software application.
+
+    Full-text Search
+        Indexing all files and |repos| managed by |RCE| and
+        making this data searchable from the interface.
+
+    Gist
+        A note that can only be edited by the author and shared using its
+        link within others. The sharing permissions can be set during
+        its creation.
+
+    Gunicorn
+        A Python WSGI HTTP Server used by |RCE|.
+
+    Hook
+        A hook intercepts function calls, messages, or events passed between
+        software components and can be used to trigger plugins, or their
+        extensions.
+
+    Horizontal scaling
+        Adding more machines or workers into your pool of resources.
+
+    Instance
+        A single installed version of one of the |RC| products. It could
+        refer to |RCE| or the VCS server depending on the context.
+
+    Plugin
+        A Plugin is software that adds a specific feature to an existing
+        software application.
+
+    tmpfs
+        Temporary file storage kept in volatile memory instead of persistent
+        storage.
+
+    VCS Server
+        The VCS Server handles the abstraction layer between the
+        supported version control systems and RhodeCode Enterprise.
+

docs/admin/indexing.rst

@@ -0,0 +1,235 @@
+.. _indexing-ref:
+
+Full-text Search
+----------------
+
+By default |RCM| uses `Whoosh`_ to index |repos| and provide full-text search.
+To run the indexer you need to use an |authtoken| with admin rights to all
+|repos|.
+
+To index new content added, you have the option to set the indexer up in a
+number of ways, for example:
+
+* Call the indexer via a cron job. We recommend running this nightly,
+  unless you need everything indexed immediately.
+* Set the indexer to infinitely loop and reindex as soon as it has run its
+  cycle.
+* Hook the indexer up with your CI server to reindex after each push.
+
+The indexer works by indexing new commits added since the last run. If you
+wish to build a brand new index from scratch each time,
+use the ``force`` option in the configuration file.
+
+.. important::
+
+   You need to have |RCT| installed, see :ref:`install-tools`. Since |RCE|
+   3.5.0 they are installed by default.
+
+To set up indexing, use the following steps:
+
+1. :ref:`config-rhoderc`, if running tools remotely.
+2. :ref:`run-index`
+3. :ref:`set-index`
+4. :ref:`advanced-indexing`
+
+.. _config-rhoderc:
+
+Configure the ``.rhoderc`` File
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+|RCT| uses the :file:`/home/{user}/.rhoderc` file for connection details
+to |RCM| instances. If this file is not automatically created,
+you can configure it using the following example. You need to configure the
+details for each instance you want to index.
+
+.. code-block:: bash
+
+    # Check the instance details
+    # of the instance you want to index
+    $ rccontrol status
+
+     - NAME: enterprise-1
+     - STATUS: RUNNING
+     - TYPE: Momentum
+     - VERSION: 1.5.0
+     - URL: http://127.0.0.1:10000
+
+To get your API Token, on the |RCM| interface go to
+:menuselection:`username --> My Account --> Auth tokens`
+
+.. code-block:: ini
+
+    # Configure .rhoderc with matching details
+    # This allows the indexer to connect to the instance
+    [instance:enterprise-1]
+    api_host = http://127.0.0.1:10000
+    api_key = <auth token goes here>
+    repo_dir = /home/<username>/repos
+
+.. _run-index:
+
+Run the Indexer
+^^^^^^^^^^^^^^^
+
+Run the indexer using the following command, and specify the instance you
+want to index:
+
+.. code-block:: bash
+
+   # From inside a virtualevv
+   (venv)$ rhodecode-index --instance-name=enterprise-1
+
+   # Using default installation
+   $ /home/user/.rccontrol/enterprise-4/profile/bin/rhodecode-index \
+       --instance-name=enterprise-4
+
+   # Using a custom mapping file
+   $ /home/user/.rccontrol/enterprise-4/profile/bin/rhodecode-index \
+       --instance-name=enterprise-4 \
+       --mapping=/home/user/.rccontrol/enterprise-4/mapping.ini
+
+.. note::
+
+   |RCT| require |PY| 2.7 to run.
+
+.. _set-index:
+
+Schedule the Indexer
+^^^^^^^^^^^^^^^^^^^^
+
+To schedule the indexer, configure the crontab file to run the indexer inside
+your |RCT| virtualenv using the following steps.
+
+1. Open the crontab file, using ``crontab -e``.
+2. Add the indexer to the crontab, and schedule it to run as regularly as you
+   wish.
+3. Save the file.
+
+.. code-block:: bash
+
+    $ crontab -e
+
+    # The virtualenv can be called using its full path, so for example you can
+    # put this example into the crontab
+
+    # Run the indexer daily at 4am using the default mapping settings
+    * 4 * * * /home/ubuntu/.virtualenv/rhodecode-venv/bin/rhodecode-index \
+    --instance-name=enterprise-1
+
+    # Run the indexer every Sunday at 3am using default mapping
+    * 3 * * 0 /home/ubuntu/.virtualenv/rhodecode-venv/bin/rhodecode-index \
+    --instance-name=enterprise-1
+
+    # Run the indexer every 15 minutes
+    # using a specially configured mapping file
+    */15 * * * * ~/.rccontrol/enterprise-4/profile/bin/rhodecode-index \
+       --instance-name=enterprise-4 \
+       --mapping=/home/user/.rccontrol/enterprise-4/mapping.ini
+
+.. _advanced-indexing:
+
+Advanced Indexing
+^^^^^^^^^^^^^^^^^
+
+|RCT| indexes based on the :file:`mapping.ini` file. To configure your index,
+you can specify different options in this file. The default location is:
+
+* :file:`/home/{user}/.rccontrol/{instance-id}/mapping.ini`, using default
+  |RCT|.
+* :file:`~/venv/lib/python2.7/site-packages/rhodecode_tools/templates/mapping.ini`,
+  when using ``virtualenv``.
+
+.. note::
+
+    If you need to create the :file:`mapping.ini` file, use the |RCT|
+    ``rhodecode-index --create-mapping path/to/file`` API call. For details,
+    see the :ref:`tools-cli` section.
+
+The indexer runs in a random order to prevent a failing |repo| from stopping
+a build. To configure different indexing scenarios, set the following options
+inside the :file:`mapping.ini` and specify the altered file using the
+``--mapping`` option.
+
+* ``index_files`` : Index the specified file types.
+* ``skip_files`` : Do not index the specified file types.
+* ``index_files_content`` : Index the content of the specified file types.
+* ``skip_files_content`` : Do not index the content of the specified files.
+* ``force`` : Create a fresh index on each run.
+* ``max_filesize`` : Files larger than the set size will not be indexed.
+* ``commit_parse_limit`` : Set the batch size when indexing commit messages.
+  Set to a lower number to lessen memory load.
+* ``repo_limit`` : Set the maximum number or |repos| indexed per run.
+* ``[INCLUDE]`` : Set |repos| you want indexed. This takes precedent over
+  ``[EXCLUDE]``.
+* ``[EXCLUDE]`` : Set |repos| you do not want indexed. Exclude can be used to
+  not index branches, forks, or log |repos|.
+
+At the end of the file you can specify conditions for specific |repos| that
+will override the default values. To configure your indexer,
+use the following example :file:`mapping.ini` file.
+
+.. code-block:: ini
+
+    [__DEFAULT__]
+    # default patterns for indexing files and content of files.
+    # Binary files are skipped by default.
+
+    # Index python and markdown files
+    index_files = *.py, *.md
+
+    # Do not index these file types
+    skip_files = *.svg, *.log, *.dump, *.txt
+
+    # Index both file types and their content
+    index_files_content = *.cpp, *.ini, *.py
+
+    # Index file names, but not file content
+    skip_files_content = *.svg,
+
+    # Force rebuilding an index from scratch. Each repository will be rebuild
+    # from scratch with a global flag. Use local flag to rebuild single repos
+    force = false
+
+    # Do not index files larger than 385KB
+    max_filesize = 385KB
+
+    # Limit commit indexing to 500 per batch
+    commit_parse_limit = 500
+
+    # Limit each index run to 25 repos
+    repo_limit = 25
+
+    # __INCLUDE__ is more important that __EXCLUDE__.
+
+    [__INCLUDE__]
+    # Include all repos with these names
+
+    docs/* = 1
+    lib/* = 1
+
+    [__EXCLUDE__]
+    # Do not include the following repo in index
+
+    dev-docs/* = 1
+    legacy-repos/* = 1
+    *-dev/* = 1
+
+    # Each repo that needs special indexing is a separate section below.
+    # In each section set the options to override the global configuration
+    # parameters above.
+    # If special settings are not configured, the global configuration values
+    # above are inherited. If no special repositories are
+    # defined here RhodeCode will use the API to ask for all repositories
+
+    # For this repo use different settings
+    [special-repo]
+    commit_parse_limit = 20,
+    skip_files = *.idea, *.xml,
+
+    # For another repo use different settings
+    [another-special-repo]
+    index_files = *,
+    max_filesize = 800MB
+    commit_parse_limit = 20000
+
+.. _Whoosh: https://pypi.python.org/pypi/Whoosh/

docs/admin/lab-settings.rst

@@ -0,0 +1,41 @@
+.. _lab-settings:
+
+Lab Settings
+============
+
+|RCE| Lab Settings is for delivering features which may require an additional
+level of support to optimize for production scenarios. To enable lab settings,
+use the following instructions:
+
+1. Open the |RCE| configuration file,
+   :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
+
+2. Add the following configuration option in the ``[app:main]`` section.
+
+.. code-block:: bash
+
+   [app:main]
+
+   ## Display extended labs settings
+   labs_settings_active = true
+
+3. Restart your |RCE| instance
+
+.. code-block:: bash
+
+   $ rccontrol restart enterprise-1
+
+4. You will see the labs setting on the
+   :menuselection:`Admin --> Settings --> labs` page.
+
+.. image:: ../images/lab-setting.png
+
+Available Lab Extras
+--------------------
+
+Once lab settings are enabled, the following features are available.
+
+.. toctree::
+   :maxdepth: 1
+
+   svn-http

docs/admin/nginx-config-example.rst

@@ -0,0 +1,71 @@
+Nginx Configuration Example
+---------------------------
+
+Use the following example to configure Nginx as a your web server.
+
+.. code-block:: nginx
+
+    upstream rc {
+
+        server 127.0.0.1:5000;
+
+        # add more instances for load balancing
+        # server 127.0.0.1:5001;
+        # server 127.0.0.1:5002;
+    }
+
+    ## gist alias
+
+    server {
+        listen          443;
+        server_name     gist.myserver.com;
+        access_log      /var/log/nginx/gist.access.log;
+        error_log       /var/log/nginx/gist.error.log;
+
+        ssl on;
+        ssl_certificate     gist.rhodecode.myserver.com.crt;
+        ssl_certificate_key gist.rhodecode.myserver.com.key;
+
+        ssl_session_timeout 5m;
+
+        ssl_protocols SSLv3 TLSv1;
+        ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5;
+        ssl_prefer_server_ciphers on;
+        add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
+
+        # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+        ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+
+        rewrite ^/(.+)$ https://rhodecode.myserver.com/_admin/gists/$1;
+        rewrite (.*)    https://rhodecode.myserver.com/_admin/gists;
+    }
+
+    server {
+        listen          443;
+        server_name     rhodecode.myserver.com;
+        access_log      /var/log/nginx/rhodecode.access.log;
+        error_log       /var/log/nginx/rhodecode.error.log;
+
+        ssl on;
+        ssl_certificate     rhodecode.myserver.com.crt;
+        ssl_certificate_key rhodecode.myserver.com.key;
+
+        ssl_session_timeout 5m;
+
+        ssl_protocols SSLv3 TLSv1;
+        ssl_ciphers DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:EDH-RSA-DES-CBC3-SHA:AES256-SHA:DES-CBC3-SHA:AES128-SHA:RC4-SHA:RC4-MD5;
+        ssl_prefer_server_ciphers on;
+
+        ## uncomment root directive if you want to serve static files by nginx
+        ## requires static_files = false in .ini file
+        # root /path/to/installation/rhodecode/public;
+
+        include         /etc/nginx/proxy.conf;
+            location / {
+                try_files $uri @rhode;
+            }
+
+       location @rhode {
+            proxy_pass      http://rc;
+            }
+    }

docs/admin/nginx-config.rst

@@ -0,0 +1,14 @@
+.. _nginx-ws-ref:
+
+Nginx Configuration
+===================
+
+To set up your Nginx Web Server for optimal performance and security, use
+the information in the following sections.
+
+.. toctree::
+
+   nginx-diffie-hellman
+   nginx-config-example
+   nginx-tuning
+   nginx-url-prefix

docs/admin/nginx-diffie-hellman.rst

@@ -0,0 +1,34 @@
+.. _dh-nginx:
+
+Diffie-Hellman Security
+-----------------------
+
+To secure your web server, the `Guide to Deploying Diffie-Hellman for TLS`_
+contains important information worth reading. This link contains a good
+`nginx secure configuration`_ example. The documentation below also contains
+good security settings with some additional |RCE| specific examples.
+
+To secure your deployment of Diffie-Hellman, configure the following:
+
+* Generate a strong Diffie-hellman group, 2048-bit or stronger.
+
+.. code-block:: bash
+
+    # to generate your dhparam.pem file, run in the terminal
+    openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048
+
+* Configure your server to only use modern, secure cipher suites in the
+  virtual hosts configuration file.
+
+.. code-block:: nginx
+
+    # Set the TLS protocols and to only use modern, secure cipher suites.
+    ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_prefer_server_ciphers on;
+
+    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
+    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+
+.. _Guide to Deploying Diffie-Hellman for TLS: https://weakdh.org/sysadmin.html
+.. _nginx secure configuration: https://gist.github.com/plentz/6737338

docs/admin/nginx-tuning.rst

@@ -0,0 +1,33 @@
+.. _nginx-tuning:
+
+Nginx Tuning
+------------
+
+Set the following properties in your ``/etc/nginx/proxy.conf`` so it does not
+timeout during large pushes.
+
+.. code-block:: nginx
+
+    proxy_redirect              off;
+    proxy_set_header            Host $host;
+
+    ## needed for container auth
+    # proxy_set_header            REMOTE_USER $remote_user;
+    # proxy_set_header            X-Forwarded-User $remote_user;
+
+    proxy_set_header            X-Url-Scheme $scheme;
+    proxy_set_header            X-Host $http_host;
+    proxy_set_header            X-Real-IP $remote_addr;
+    proxy_set_header            X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header            Proxy-host $proxy_host;
+    proxy_buffering             off;
+    proxy_connect_timeout       7200;
+    proxy_send_timeout          7200;
+    proxy_read_timeout          7200;
+    proxy_buffers               8 32k;
+    # Set this to a larger number if you experience timeouts
+    client_max_body_size        1024m;
+    client_body_buffer_size     128k;
+    large_client_header_buffers 8 64k;
+    add_header X-Frame-Options SAMEORIGIN;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

docs/admin/nginx-url-prefix.rst

@@ -0,0 +1,33 @@
+.. _nginx_url-pre:
+
+Nginx URL Prefix Configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Use the following example to configure Nginx to use a URL prefix.
+
+.. code-block:: nginx
+
+    location  /foo {
+      rewrite /foo(.*) /$1  break;
+      proxy_pass         http://localhost:3200;
+      proxy_redirect     off;
+      proxy_set_header   Host $host;
+    }
+
+In addition to the Nginx configuration you will need to add the following
+lines into the ``rhodecode.ini`` file.
+
+* In the the ``[app:main]`` section of your ``rhodecode.ini`` file add the
+  following line.
+
+.. code-block:: ini
+
+    filter-with = proxy-prefix
+
+* At the end of the ``rhodecode.ini`` file add the following section.
+
+.. code-block:: ini
+
+    [filter:proxy-prefix]
+    use = egg:PasteDeploy#prefix
+    prefix = /<someprefix> # Change <someprefix> into your chosen prefix

docs/admin/public-access.rst

@@ -0,0 +1,12 @@
+.. _public-access:
+
+Public Access
+-------------
+
+By default |RCM| allows users to read all **public** |repos|. User
+permissions and |repo| access can be configured explicitly,
+and those permissions will override any default settings. The default
+settings can be found under the following section:
+
+* :menuselection:`Admin --> Permissions --> Object`
+* :menuselection:`Admin --> Permissions --> Global`

docs/admin/repo-extra-fields.rst

@@ -0,0 +1,68 @@
+.. _repo-xtra:
+
+Repository Extra Fields
+=======================
+
+Extra fields attached to a |repo| allow you to configure additional actions for
+|RCX|. To install and read more about |RCX|, see the :ref:`install-rcx` section.
+
+Enabling Extra Fields
+---------------------
+
+To enable extra fields on |repos|, use the following steps:
+
+1. Go to the :menuselection:`Admin --> Settings --> Visual` page.
+2. Check the :guilabel:`Use repository extra fields` box.
+3. Save your changes.
+
+
+Configuring Extra Fields
+------------------------
+
+To configure extra fields per repository, use the following steps:
+
+1. Go to :menuselection:`Admin --> Repositories` and select :guilabel:`Edit`
+   beside the |repo| to which you wish to add extra fields.
+2. On the |repo| settings page, select the :guilabel:`Extra fields` tab.
+
+.. image:: ../images/extra-repo-fields.png
+
+
+Example Usage
+-------------
+
+To use the extra fields in an extension, see the example below. For more
+information and examples, see the :ref:`integrations-ref` section.
+
+.. code-block:: python
+
+    call = load_extension('http_notify.py')
+    if call:
+        url = 'http://default.url' # <url for post data>
+
+        # possibly extract the URL from extra fields
+        call = load_extension('extra_fields.py')
+        if call:
+            repo_extra_fields = call(**kwargs)
+            # now update if we have extra fields, they have precedence
+            # this way users can store any configuration inside the database per
+            # repo
+            for key, data in repo_extra_fields.items():
+                kwargs[key] = data['field_value']
+
+        # an endpoint url data will be sent to, fetched from extra fields
+        # if exists, or fallback to default
+        kwargs['URL'] = kwargs.pop('webhook_url', None) or url
+
+        # fetch pushed commits, from commit_ids list
+        call = load_extension('extract_commits.py')
+        extracted_commits = {}
+        if call:
+            extracted_commits = call(**kwargs)
+            # store the commits for the next call chain
+        kwargs['COMMITS'] = extracted_commits
+
+        # set additional keys and values to be sent via POST to given URL
+        kwargs['caller_type'] = 'rhodecode'
+        kwargs['date'] = time.time() # import time before
+        call(**kwargs)

docs/admin/repo-hooks.rst

@@ -0,0 +1,56 @@
+.. _repo-hooks:
+
+|RCE| Repository Hooks
+======================
+
+|RCE| installs hooks inside each of the |repos| that it manages. These
+hooks enable users to execute custom actions based on certain events.
+This is the complete list of |repos| hooks and the events which trigger them:
+
+.. rst-class:: dl-horizontal
+
+    \--CREATE_REPO_HOOK
+        Any time a |repo| is created.
+
+    \--CREATE_REPO_GROUP_HOOK
+        Any time a |repo| group is created.
+
+    \--CREATE_USER_HOOK
+        Any time a user is created.
+
+    \--DELETE_REPO_HOOK
+        Any time a |repo| is created.
+
+    \--DELETE_USER_HOOK
+        Any time a user is deleted.
+
+    \--PRE_CREATE_USER_HOOK
+        Any time a user is created but before the action is executed by |RCE|.
+
+    \--PRE_PULL
+        Any pull from a |repo| but before the action is executed by |RCE|.
+
+    \--PRE_PUSH
+        Any push to a |repo| but before the action is executed by |RCE|.
+
+    \--POST_PUSH
+        After any push to a |repo|.
+
+    \--PUSH_HOOK
+        Any push to a |repo|, including editing tags or branches.
+        Commits via API actions that update references are also counted.
+
+    \--PULL_HOOK
+        Any pull from a Repository.
+
+Using Repository Hooks
+----------------------
+
+To use these hooks you need to install |RCX|. For more information, see the
+:ref:`install-rcx` section.
+
+Creating Extensions
+-------------------
+
+To create your own extensions using these hooks, see the :ref:`dev-plug`
+section.

docs/admin/repo-issue-tracker.rst

@@ -0,0 +1,30 @@
+.. _repo-it:
+
+Repository Issue Tracker
+========================
+
+You can set an issue tracker connection in two ways with |RCE|.
+
+* At instance level, for more information see the
+  :ref:`rhodecode-issue-trackers-ref` section.
+* At |repo| level. This allows you to configure a |repo| to use a different
+  issue tracker to the default one.
+
+Set an Issue Tracker per Repository
+-----------------------------------
+
+To configure a |repo| to work with a different issue tracker to the default one,
+use the following steps:
+
+1. Open :menuselection:`Admin --> Repositories --> repo name --> Edit --> Issue Tracker`
+2. Uncheck the :guilabel:`Inherit from default settings` box.
+3. Click :guilabel:`Add New`.
+4. Fill in the following settings:
+
+    * :guilabel:`Description`: A name for this set of rules.
+    * :guilabel:`Pattern`: The regular expression that will match issues
+      tagged in commit messages, or more see :ref:`issue-tr-eg-ref`.
+    * :guilabel:`URL`: The URL to your issue tracker.
+    * :guilabel:`Prefix`: The prefix with which you want to mark issues.
+
+5. Click :guilabel:`Save`.

docs/admin/repo-perm-steps.rst

@@ -0,0 +1,45 @@
+.. _set-repo-perms:
+
+Setting Repository Permissions
+------------------------------
+
+To set the permissions on an individual |repo|, use the following steps:
+
+1. Open :menuselection:`Admin --> Repositories` and select
+   :guilabel:`edit` beside the |repo| you wish to configure.
+2. On the |repo| settings page you will see a number of tabs. Exploring these
+   you will find the following main configuration options for a |repo|.
+3. Once you make changes, select :guilabel:`Save`
+
+* :guilabel:`Repository group`: Lets you to add a |repo| to a |repo| group.
+* :guilabel:`Owner`: Lets you change the |repo| owner. Useful when users are
+  moving roles within an organisation.
+* :guilabel:`Enable automatic locking`: For more information,
+  see :ref:`repo-locking`
+* :guilabel:`User Access`: On the permissions tab you can add users,
+  or user groups, and set the permissions each has for that |repo|.
+* :guilabel:`Invalidate repository cache`: On the Caches tab you can delete
+  the |repo| cache, sometimes needed when mirroring.
+
+.. _set-repo-group-perms:
+
+Setting Repository Group Permissions
+------------------------------------
+
+To set the permissions on a Repository Group, use the following steps:
+
+1. Open :menuselection:`Admin --> Repository groups` and select
+   :guilabel:`edit` beside the |repo| you wish to configure.
+2. On the |repo| group settings page you will see a number of tabs. Exploring
+   these you will find the following main configuration options:
+
+* :guilabel:`Owner`: Lets you change the group owner. Useful when users are
+  moving roles within an organisation.
+* :guilabel:`Group parent`: Lets you add the |repo| group as a sub-group
+  of a larger group, i.e. :guilabel:`QA-Repos >> QA-Repos-Berlin`
+* :guilabel:`Enable automatic locking`: For more information,
+  see :ref:`repo-locking`
+* :guilabel:`User Access`: On the permissions tab you can add users,
+  or user groups, and set the permissions each has for that |repo| group.
+* :guilabel:`Add Child Group`: Allows you to add sub-repository-groups
+  that will all share the same permissions.

docs/admin/repo-vcs.rst

@@ -0,0 +1,48 @@
+.. _per-repo-vcs:
+
+Repository VCS Settings
+=======================
+
+You can configure |repo| VCS (Version Control System) settings at a global
+level, and individually per |repo|. Global settings are applied by default.
+If you configure individual settings per |repo|, these will remain unaffected
+by any subsequent global changes.
+
+Set Global Repository Settings
+------------------------------
+
+To configure |repo| settings across your |RCE| instance use the following steps:
+
+1. Go to to the :menuselection:`Admin --> Settings --> VCS` page.
+2. Configure the following |repo| options:
+
+    * :guilabel:`Web`: Require SSL if necessary.
+    * :guilabel:`Hooks`: Enable built in hooks.
+    * :guilabel:`Mercurial Settings`: Configure |hg| specific settings.
+    * :guilabel:`Repositories Location`: Set the file system |repos| location.
+    * :guilabel:`Subversion Settings`: Configure |svn| specific settings.
+    * :guilabel:`Pull Request Settings`: Enable the listed additional |pr|
+      features.
+
+3. Click :guilabel:`Save`.
+
+
+Set Individual Repository Settings
+----------------------------------
+
+To configure specific VCS settings for an individual |repo|, use the following
+steps:
+
+1. Go to to the :menuselection:`Admin --> Repositories --> Edit --> VCS` page.
+2. Uncheck the :guilabel:`Inherit from global settings` box.
+3. Configure the following |repo| options:
+
+    * :guilabel:`Hooks`: Enable built in hooks.
+    * :guilabel:`Mercurial Settings` (|hg| Only): Configure |hg| specific
+      settings.
+    * :guilabel:`Subversion Settings` (|svn| Only): Configure |svn| specific
+      settings.
+    * :guilabel:`Pull Request Settings` (|git| and |hg| Only): Enable the
+      listed additional |pr| features.
+
+3. Click :guilabel:`Save`.

docs/admin/reset-information.rst

@@ -0,0 +1,95 @@
+.. _rhodecode-reset-ref:
+
+Settings Management
+-------------------
+
+All |RCE| settings can be set from the user interface, but in the event that
+it somehow becomes unavailable you can use ``ishell`` inside your |RCE|
+``virtualenv`` to carry out emergency measures.
+
+.. warning::
+
+   Logging into the |RCE| database with ``iShell`` should only be done by an
+   experienced and knowledgeable database administrator.
+
+Reset Admin Account Privileges
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+If you accidentally remove your admin privileges from the admin account you
+can restore them using ``ishell``. Use the following example to reset your
+account permissions.
+
+.. code-block:: bash
+
+    # Open iShell from the terminal
+    $ .rccontrol/enterprise-5/profile/bin/paster \
+        ishell .rccontrol/enterprise-5/rhodecode.ini
+
+.. code-block:: mysql
+
+    # Use this example to change user permissions
+    In [1]: adminuser = User.get_by_username('username')
+    In [2]: adminuser.admin = True
+    In [3]: Session.add(adminuser);Session().commit()
+    In [4]: exit()
+
+Set to read global ``.hgrc`` file
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+By default, |RCE| does not read global ``hgrc`` files in
+``/etc/mercurial/hgrc`` or ``/etc/mercurial/hgrc.d`` because it
+can lead to issues. This is set in the ``rhodecode_ui`` table for which
+there is no UI. If you need to edit this you can
+manually change the settings using SQL statements with ``ishell``. Use the
+following example to make changes to this table.
+
+.. code-block:: bash
+
+  # Open iShell from the terminal
+  $ .rccontrol/enterprise-5/profile/bin/paster \
+      ishell.rccontrol/enterprise-5/rhodecode.ini
+
+.. code-block:: mysql
+
+  # Use this example to enable global .hgrc access
+  In [4]: new_option = RhodeCodeUi()
+  In [5]: new_option.ui_section='web'
+  In [6]: new_option.ui_key='allow_push'
+  In [7]: new_option.ui_value='*'
+  In [8]: Session().add(new_option);Session().commit()
+
+Manually Reset Password
+^^^^^^^^^^^^^^^^^^^^^^^
+
+If you need to manually reset a user password, use the following steps.
+
+1. Navigate to your |RCE| install location.
+2. Run the interactive ``ishell`` prompt.
+3. Set a new password.
+
+Use the following code example to carry out these steps.
+
+.. code-block:: bash
+
+    # starts the ishell interactive prompt
+    $ .rccontrol/enterprise-5/profile/bin/paster \
+        ishell .rccontrol/enterprise-5/rhodecode.ini
+
+.. code-block:: mysql
+
+    from rhodecode.lib.auth import generate_auth_token
+    from rhodecode.lib.auth import get_crypt_password
+
+    # Enter the user name whose password you wish to change
+    my_user = 'USERNAME'
+    u = User.get_by_username(my_user)
+
+    # If this fails then the user does not exist
+    u.auth_token = generate_auth_token(my_user)
+
+    # Set the new password
+    u.password = get_crypt_password('PASSWORD')
+
+    Session().add(u)
+    Session().commit()
+    exit

docs/admin/rhodecode-backup.rst

@@ -0,0 +1,26 @@
+.. _backup:
+
+====================
+Backing up RhodeCode
+====================
+
+
+Settings
+--------
+
+Just copy your .ini file, it contains all RhodeCode settings.
+
+Whoosh index
+------------
+
+Whoosh index is located in **/data/index** directory where you installed
+RhodeCode ie. the same place where the ini file is located
+
+
+Database
+--------
+
+When using sqlite just copy rhodecode.db.
+Any other database engine requires a manual backup operation.
+
+Database backup will contain all gathered statistics

docs/admin/sec-instance-basics.rst

@@ -0,0 +1,31 @@
+.. _instance-basics:
+
+3 Basic User Security Steps
+===========================
+
+By implementing the following user configuration tasks, you will help to
+secure your |RCE| instances.
+
+
+Define the Instance Wide Default User
+-------------------------------------
+
+The default user settings are applied across the whole instance. You should
+define the default user so that newly created users immediately have
+permission settings attached to their profile. For more information about
+defining the default user settings, see the :ref:`default-perms` section.
+
+Configure Specific User Groups
+------------------------------
+
+By defining user groups, it allows you to put users into them and
+have the group permissions applied to their profile. For more information about
+defining the default user settings, see the :ref:`user-admin-set` section.
+
+Define the Default User in Each Group
+-------------------------------------
+
+Apart from the system wide user permissions, each user group can apply its
+settings to the default user permissions within the scope of the group. To
+set the default user's permissions inside a user group, see the
+:ref:`permissions-info-repo-group-access` section.

docs/admin/sec-ip-white.rst

@@ -0,0 +1,19 @@
+.. _settip-ip-white:
+
+Setting IP Restrictions
+=======================
+
+To restrict access to your |RCE| instance you can set an IP Whitelist that
+will only allow access from specific IP Addresses. This is useful for
+ensuring only users on the company VPN can access the instance.
+
+To set this, go to
+:menuselection:`Username --> Permissions --> IP Whitelist`, and add the safe
+range of IP Addresses to the list.
+
+.. important::
+
+   Add the IP Address that you are currently using first,
+   otherwise you'll lock yourself out of the instance.
+
+.. image:: ../images/ip-whitey.png

docs/admin/sec-x-frame.rst

@@ -0,0 +1,57 @@
+.. _x-frame:
+
+Securing HTTPS Connections
+--------------------------
+
+* To secure your |RCE| instance against `Cross Frame Scripting`_ exploits, you
+  should configure your webserver ``x-frame-options`` setting.
+
+* To configure your instance for `HTTP Strict Transport Security`_, you need to
+  configure the ``Strict-Transport-Security`` setting.
+
+Nginx
+^^^^^
+
+In your nginx configuration, add the following lines in the correct files. For
+more detailed information see the :ref:`nginx-ws-ref` section.
+
+.. code-block:: nginx
+
+    # Add this line to the nginx.conf file
+    add_header X-Frame-Options SAMEORIGIN;
+
+    # This line needs to be added inside your virtual hosts block/file
+    add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
+
+Apache
+^^^^^^
+
+In your :file:`apache2.conf` file, add the following line. For more detailed
+information see the :ref:`apache-ws-ref` section.
+
+.. code-block:: apache
+
+    # Add this to your virtual hosts file
+    Header always append X-Frame-Options SAMEORIGIN
+
+    # Add this line in your virtual hosts file
+    Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
+
+|RCE| Configuration
+^^^^^^^^^^^^^^^^^^^
+
+|RCE| can also be configured to force strict *https* connections and Strict
+Transport Security. To set this, configure the following options to ``true``
+in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+
+.. code-block:: ini
+
+    ## force https in RhodeCode, fixes https redirects, assumes it's always https
+    force_https = false
+
+    ## use Strict-Transport-Security headers
+    use_htsts = false
+
+
+.. _Cross Frame Scripting: https://www.owasp.org/index.php/Cross_Frame_Scripting
+.. _HTTP Strict Transport Security: https://www.owasp.org/index.php/HTTP_Strict_Transport_Security

docs/admin/sec-your-server.rst

@@ -0,0 +1,179 @@
+.. _sec-your-server:
+
+Securing Your Server
+--------------------
+
+|RCE| runs on your hardware, and while it is developed with security in mind
+it is also important that you ensure your servers are well secured. In this
+section we will cover some basic security practices that are best to
+configure when setting up your |RCE| instances.
+
+SSH Keys
+^^^^^^^^
+
+Using SSH keys to access your server provides more security than using the
+standard username and password combination. To set up your SSH Keys, use the
+following steps:
+
+1. On your local machine create the public/private key combination. The
+   private key you will keep, and the matching public key is copied to the
+   server. Setting a passphrase here is optional, if you set one you will
+   always be prompted for it when logging in.
+
+.. code-block:: bash
+
+    # Generate SSH Keys
+    user@ubuntu:~$ ssh-keygen -t rsa
+
+.. code-block:: bash
+
+    Generating public/private rsa key pair.
+    Enter file in which to save the key (/home/user/.ssh/id_rsa):
+    Created directory '/home/user/.ssh'.
+    Enter passphrase (empty for no passphrase):
+    Enter same passphrase again:
+    Your identification has been saved in /home/user/.ssh/id_rsa.
+    Your public key has been saved in /home/user/.ssh/id_rsa.pub.
+    The key fingerprint is:
+    02:82:38:95:e5:30:d2:ad:17:60:15:7f:94:17:9f:30 user@ubuntu
+    The key's randomart image is:
+    +--[ RSA 2048]----+
+
+2. SFTP to your server, and copy the public key to the ``~/.ssh`` folder.
+
+.. code-block:: bash
+
+    # SFTP to your server
+    $ sftp user@hostname
+
+    # copy your public key
+    sftp> mput /home/user/.ssh/id_rsa.pub /home/user/.ssh
+    Uploading /home/user/.ssh/id_rsa.pub to /home/user/.ssh/id_rsa.pub
+    /home/user/.ssh/id_rsa.pub      100%  394     0.4KB/s   00:00
+
+3. On your server, add the public key to the :file:`~/.ssh/authorized_keys`
+   file.
+
+.. code-block:: bash
+
+    $ cat /home/user/.ssh/id_rsa.pub > /home/user/.ssh/authorized_keys
+
+You should now be able to log into your server using your SSH
+Keys. If you've added a passphrase you'll be asked for it. For more
+information about using SSH keys with |RCE| |repos|, see the
+:ref:`ssh-connection` section.
+
+VPN Whitelist
+^^^^^^^^^^^^^
+
+Most company networks will have a VPN. If you need to set one up, there are
+many tutorials online for how to do that. Getting it right requires good
+knowledge and attention to detail. Once set up, you can configure your
+|RCE| instances to only allow user access from the VPN, to do this see the
+:ref:`settip-ip-white` section.
+
+Public Key Infrastructure and SSL/TLS Encryption
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+Public key infrastructure (PKI) is a system that creates, manages, and
+validates certificates for identifying nodes on a network and encrypting
+communication between them. SSL or TLS certificates can be used to
+authenticate different entities with one another. To read more about PKIs,
+see the `OpenSSL PKI tutorial`_ site, or this `Cloudflare PKI post`_.
+
+If the network you are running is SSL/TLS encrypted, you can configure |RCE|
+to always use secure connections using the ``force_https`` and ``use_htsts``
+options in the :file:`/home/user/.rccontrol/instance-id/rhodecode.ini` file.
+For more details, see the :ref:`x-frame` section.
+
+FireWalls and Ports
+^^^^^^^^^^^^^^^^^^^
+
+Setting up a network firewall for your internal traffic is a good way
+of keeping it secure by blocking off any ports that should not be used.
+Additionally, you can set non-default ports for certain functions which adds
+an extra layer of security to your setup.
+
+A well configured firewall will restrict access to everything except the
+services you need to remain open. By exposing fewer services you reduce the
+number of potential vulnerabilities.
+
+There are a number of different firewall solutions, but for most Linux systems
+using the built in `IpTables`_ firewall should suffice. On BSD systems you
+can use `IPFILTER`_ or `IPFW`_. Use the following examples, and the IpTables
+documentation to configure your IP Tables on Ubuntu.
+
+Changing the default SSH port.
+
+.. code-block:: bash
+
+    # Open SSH config file and change to port 10022
+    vi /etc/ssh/sshd_config
+
+    # What ports, IPs and protocols we listen for
+    Port 10022
+
+Setting IP Table rules for SSH traffic. It is important to note that the
+default policy of your IpTables can differ and it is worth checking how each
+is configured. The options are *ACCEPT*, *REJECT*, *DROP*, or *LOG*. The
+usual practice is to block access on all ports and then enable access only on
+the ports you with to expose.
+
+.. code-block:: bash
+
+    # Check iptables policy
+    $ sudo iptables -L
+
+    Chain INPUT (policy ACCEPT)
+    target     prot opt source               destination
+
+    Chain FORWARD (policy ACCEPT)
+    target     prot opt source               destination
+
+    Chain OUTPUT (policy ACCEPT)
+    target     prot opt source               destination
+
+    # Close all ports by default
+    $ sudo iptables -P INPUT DROP
+
+    $ sudo iptables -L
+    Chain INPUT (policy DROP)
+    target     prot opt source               destination
+    DROP       all  --  anywhere             anywhere
+
+    Chain FORWARD (policy ACCEPT)
+    target     prot opt source               destination
+
+    Chain OUTPUT (policy ACCEPT)
+    target     prot opt source               destination
+
+.. code-block:: bash
+
+    # Deny outbound SSH traffic
+    sudo iptables -A OUTPUT -p tcp --dport 10022 -j DROP
+
+    # Allow incoming SSH traffic on port 10022
+    sudo iptables -A INPUT -p tcp --dport 10022 -j ACCEPT
+
+    # Allow incoming HTML traffic on port 80 and 443
+    iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
+    iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
+
+Saving your IP Table rules, and restoring them from file.
+
+.. code-block:: bash
+
+    # Save you IP Table Rules
+    iptables-save
+
+    # Save your IP Table Rules to a file
+    sudo sh -c "iptables-save > /etc/iptables.rules"
+
+    # Restore your IP Table rules from file
+    iptables-restore < /etc/iptables.rules
+
+.. _OpenSSL PKI tutorial: https://pki-tutorial.readthedocs.org/en/latest/#
+.. _Cloudflare PKI post: https://blog.cloudflare.com/how-to-build-your-own-public-key-infrastructure/
+.. _IpTables: https://help.ubuntu.com/community/IptablesHowTo
+.. _IPFW: https://www.freebsd.org/doc/handbook/firewalls-ipfw.html
+.. _IPFILTER: https://www.freebsd.org/doc/handbook/firewalls-ipf.html

docs/admin/security-tips.rst

@@ -0,0 +1,15 @@
+.. _sec-tips:
+
+=============
+Security Tips
+=============
+
+The following section contains security tips for ensuring your |RCE|
+instances are configured in as secure a manner as possible.
+
+.. toctree::
+
+   sec-your-server
+   sec-x-frame
+   sec-instance-basics
+   sec-ip-white

docs/admin/setting-default-permissions.rst

@@ -0,0 +1,69 @@
+.. _permissions-default-ref:
+
+Setting Default Permissions
+---------------------------
+
+Default permissions allow you to configure |RCM| so that when a new |repo|, user group,
+or user is created their permissions are already defined. To set default permissions you need administrator
+privileges. See the following sections for setting up your permissions system:
+
+* :ref:`user-default-ref`
+* :ref:`user-group-default-ref`
+* :ref:`repo-default-ref`
+* :ref:`repo-group-default-ref`
+
+.. _user-default-ref:
+
+Setting User defaults
+^^^^^^^^^^^^^^^^^^^^^
+
+To set default user permissions, use the following steps.
+
+1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`
+2. Select the :guilabel:`Global` tab from the left-hand menu. The permissions
+   set on this screen apply to users and user-groups across the whole instance.
+3. Save your changes
+
+.. _user-group-default-ref:
+
+Setting User Group defaults
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To set default user group permissions, use the following steps.
+
+1. From the |RCM| interface, select :menuselection:`Admin --> User groups`
+2. Select :guilabel:`Permissions`, and configure the default user
+   permissions. All users will get these permissions unless
+   individually set.
+3. Select :guilabel:`Global permissions`, and if you wish to configure
+   non-standard behaviour, uncheck the
+   :guilabel:`inherit from default settings` box and configure the desired
+   permissions
+4. Save your changes
+
+.. _repo-default-ref:
+
+Setting Repository defaults
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To set default |repo| permissions, use the following steps.
+
+1. From the |RCM| interface, select :menuselection:`Admin --> Permissions`
+2. Select the :guilabel:`Object` tab from the left-hand menu and set the
+   |perm| permissions
+3. Save your changes
+
+.. _repo-group-default-ref:
+
+Setting Repository Group defaults
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To set default Repository Group permissions, use the following steps.
+
+1. From the |RCM| interface, select :menuselection:`Admin --> Repository Groups`
+2. Select :guilabel:`Edit` beside the |repo| group you wish to configure
+3. On the left-hand pane select :guilabel:`Permissions`
+4. Set the default permissions for all |repos| created in this group
+5. Save your changes
+
+.. |perm| replace:: :guilabel:`None, Read, Write, or Admin`

docs/admin/setting-repo-perms.rst

@@ -0,0 +1,26 @@
+.. _permissions-info-add-group-ref:
+
+Repository Administration
+=========================
+
+Repository permissions in |RCM| can be managed in a number of different ways.
+This overview should give you an insight into how you could adopt particular
+settings for your needs:
+
+* Global |repo| permissions: This allows you to set the default permissions
+  for each new |repo| created within |RCM|, see :ref:`repo-default-ref`. All
+  |repos| created will inherit these permissions unless explicitly configured.
+* Individual |repo| permissions: To set individual |repo| permissions,
+  see :ref:`set-repo-perms`.
+* Repository Group permissions: This allows you to define the permissions for
+  a group, and all |repos| created within that group will inherit the same
+  permissions.
+
+.. toctree::
+
+    repo-perm-steps
+    repo-extra-fields
+    repo-hooks
+    repo-issue-tracker
+    repo-vcs
+

docs/admin/setting-usergroup-permissions.rst

@@ -0,0 +1,25 @@
+.. _permissions-info-repo-group-access:
+
+Setting User Group Permissions
+------------------------------
+
+To set User Group |repo| permissions, use follow these steps:
+
+1. From the |RCE| interface, select
+   :menuselection:`Admin --> User Group --> Add User Group`
+2. Enter a group name and description, and select :guilabel:`Save`
+3. Select :guilabel:`edit` beside the new User Group. On the following
+   screen you will see a number of tabs. Exploring these
+   you will find the following most used options:
+
+* :guilabel:`Owner`: This allows you to change the User Group owner. As
+  super-admin you will still have access to this, but changing the owner lets
+  you delegate the user group management to another manager.
+* :guilabel:`Members`: This allows you to added or remove users from the
+  group.
+* :guilabel:`User Permissions`: On the permissions tab you can set the
+  permissions for each member. If not individually set, the members will
+  inherit the default user permissions.
+* :guilabel:`Inherit from default settings`: On the Global Permissions tab
+  you can uncheck this option and explicitly configure the permissions for
+  the group.

docs/admin/svn-http.rst

@@ -0,0 +1,84 @@
+.. _svn-http:
+
+|svn| With Write Over HTTP
+--------------------------
+
+To use |svn| with write access, the currently supported method is over HTTP.
+This requires you to configure your local machine so that it can access your
+|RCE| instance.
+
+Prerequisites
+^^^^^^^^^^^^^
+
+- Enable lab setting on your |RCE| instance, see :ref:`lab-settings`.
+- You need to install the following tools on your local machine: ``Apache`` and
+  ``mod_dav_svn``. Use the following Ubuntu as an example.
+
+.. code-block:: bash
+
+    $ sudo apt-get install apache2 libapache2-mod-svn
+
+Once installed you need to enable ``dav_svn``:
+
+.. code-block:: bash
+
+    $ sudo a2enmod dav_svn
+
+Configuring Apache Setup
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+.. tip::
+
+   It is recommended to run Apache on a port other than 80, due to possible
+   conflicts with other HTTP servers like nginx. To do this, set the
+   ``Listen`` parameter in the ``/etc/apache2/ports.conf`` file, for example
+   ``Listen 8090``
+
+   It is also recommended to run apache as the same user as |RCE|, otherwise
+   permission issues could occur. To do this edit the ``/etc/apache2/envvars``
+
+   .. code-block:: apache
+
+      export APACHE_RUN_USER=ubuntu
+      export APACHE_RUN_GROUP=ubuntu
+
+1. To configure Apache, create and edit a virtual hosts file, for example
+   :file:`/etc/apache2/sites-available/default.conf`, or create another
+   virtual hosts file and add a location section inside the
+   ``<VirtualHost>`` section.
+
+.. code-block:: apache
+
+    <Location />
+        DAV svn
+        # Must be explicit path, relative not supported
+        SVNParentPath /PATH/TO/REPOSITORIES
+        SVNListParentPath On
+        Allow from all
+        Order allow,deny
+    </Location>
+
+.. note::
+
+   Once configured, check that you can see the list of repositories on your
+   |RCE| instance.
+
+2. Go to the :menuselection:`Admin --> Settings --> Labs` page, and
+   enable :guilabel:`Proxy Subversion HTTP requests`, and specify the
+   :guilabel:`Subversion HTTP Server URL`.
+
+Using |svn|
+^^^^^^^^^^^
+
+Once |svn| has been enabled on your instance, you can use it using the
+following examples. For more |svn| information, see the `Subversion Red Book`_
+
+.. code-block:: bash
+
+    # To clone a repository
+    svn clone http://my-svn-server.example.com/my-svn-repo
+
+    # svn commit
+    svn commit
+
+.. _Subversion Red Book: http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.ref.svn

docs/admin/system-admin.rst

@@ -0,0 +1,29 @@
+.. _rhodecode-admin-ref:
+
+System Administration
+=====================
+
+The following are the most common system administration tasks.
+
+.. only:: latex
+
+    * :ref:`vcs-server`
+    * :ref:`apache-ws-ref`
+    * :ref:`nginx-ws-ref`
+    * :ref:`rhodecode-tuning-ref`
+    * :ref:`indexing-ref`
+    * :ref:`rhodecode-reset-ref`
+
+.. toctree::
+
+    config-files-overview
+    vcs-server
+    apache-config
+    nginx-config
+    backup-restore
+    tuning-rhodecode
+    indexing
+    reset-information
+    enable-debug
+    admin-tricks
+    cleanup-cmds

docs/admin/system-overview.rst

@@ -0,0 +1,163 @@
+.. _system-overview-ref:
+
+System Overview
+===============
+
+Latest Version
+--------------
+
+* |release| on Unix and Windows systems.
+
+System Architecture
+-------------------
+
+The following diagram shows a typical production architecture.
+
+.. image:: ../images/architecture-diagram.png
+  :align: center
+
+Supported Operating Systems
+---------------------------
+
+Linux
+^^^^^
+
+* Ubuntu 14.04
+* CentOS 6.2 and 7
+* Debian 7.8
+* RedHat Fedora
+* Arch Linux
+* SUSE Linux
+
+Windows
+^^^^^^^
+
+* Windows Vista Ultimate 64bit
+* Windows 7 Ultimate 64bit
+* Windows 8 Professional 64bit
+* Windows 8.1 Enterprise 64bit
+* Windows Server 2008 64bit
+* Windows Server 2008-R2 64bit
+* Windows Server 2012 64bit
+
+Supported Databases
+-------------------
+
+* SQLite
+* MySQL
+* MariaDB
+* PostgreSQL
+
+Supported Browsers
+------------------
+
+* Chrome
+* Safari
+* Firefox
+* Internet Explorer 10 & 11
+
+System Requirements
+-------------------
+
+|RCM| performs best on machines with ultra-fast hard disks. Generally disk
+performance is more important than CPU performance. In a corporate production
+environment handling 1000s of users and |repos| you should deploy on a 12+
+core 64GB RAM server. In short, the more RAM the better.
+
+.. _config-rce-files:
+
+Configuration Files
+-------------------
+
+* :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
+* :file:`/home/{user}/.rccontrol/{instance-id}/mapping.ini`
+* :file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini`
+* :file:`/home/{user}/.rccontrol/supervisor/supervisord.ini`
+* :file:`/home/{user}/.rccontrol.ini`
+* :file:`/home/{user}/.rhoderc`
+* :file:`/home/{user}/.rccontrol/cache/MANIFEST`
+
+For more information, see the :ref:`config-files` section.
+
+Log Files
+---------
+
+* :file:`/home/{user}/.rccontrol/{instance-id}/enterprise.log`
+* :file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.log`
+* :file:`/home/{user}/.rccontrol/supervisor/supervisord.log`
+* :file:`/tmp/rccontrol.log`
+* :file:`/tmp/rhodecode_tools.log`
+
+Storage Files
+-------------
+
+* :file:`/home/{user}/.rccontrol/{instance-id}/data/index/{index-file.toc}`
+* :file:`/home/{user}/repos/.rc_gist_store`
+* :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.db`
+* :file:`/opt/rhodecode/store/{unique-hash}`
+
+Default Repositories Location
+-----------------------------
+
+* :file:`/home/{user}/repos`
+
+Connection Methods
+------------------
+
+* HTTPS
+* SSH
+* |RCM| API
+
+Internationalization Support
+----------------------------
+
+Currently available in the following languages, see `Transifex`_ for the
+latest details. If you want a new language added, please contact us. To
+configure your language settings, see the :ref:`set-lang` section.
+
+.. hlist::
+
+  * Belorussian
+  * Chinese
+  * French
+  * German
+  * Italian
+  * Japanese
+  * Portuguese
+  * Polish
+  * Russian
+  * Spanish
+
+Licencing Information
+---------------------
+
+* See licencing information `here`_
+
+Peer-to-peer Failover Support
+-----------------------------
+
+* Yes
+
+Additional Binaries
+-------------------
+
+* Yes, see :ref:`rhodecode-nix-ref` for full details.
+
+Remote Connectivity
+-------------------
+
+* Available
+
+Executable Files
+----------------
+
+Windows: :file:`RhodeCode-installer-{version}.exe`
+
+Deprecated Support
+------------------
+
+- Internet Explorer 8 support deprecated since version 3.7.0.
+- Internet Explorer 9 support deprecated since version 3.8.0.
+
+.. _here: https://rhodecode.com/licenses/
+.. _Transifex: https://www.transifex.com/projects/p/RhodeCode/

docs/admin/tuning-change-encoding.rst

@@ -0,0 +1,22 @@
+.. _change-encoding:
+
+Change Default Encoding
+-----------------------
+
+|RCE| uses ``utf8`` encoding by default. You can change the default encoding
+in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. To
+change the default encoding used by |RCE|, set a new value for the
+``default_encoding``.
+
+.. code-block:: ini
+
+        # default encoding used to convert from and to unicode
+        # can be also a comma separated list of encoding in case of mixed
+        # encodings
+        default_encoding = utf8
+
+.. note::
+
+       Changing the default encoding will affect many parts of your |RCE|
+       installation, including committers names,
+       file names, and the encoding of commit messages.

docs/admin/tuning-change-large-file-dir.rst

@@ -0,0 +1,32 @@
+.. _hg-lrg-loc:
+
+Change the |hg| Large Files Location
+------------------------------------
+
+|RCE| manages |hg| larges files from the following default location
+:file:`/home/{user}/repos/.cache/largefiles`. If you wish to change this, use
+the following steps:
+
+1. Open ishell from the terminal and use it to log into the |RCE| database by
+   specifying the instance :file:`rhodecode.ini` file.
+
+.. code-block:: bash
+
+    # Open iShell from the terminal and set ini file
+    $ .rccontrol/enterprise-1/profile/bin/paster ishell .rccontrol/enterprise-1/rhodecode.ini
+
+2. Run the following commands, and ensure that |RCE| has write access to the
+   new directory:
+
+.. code-block:: mysql
+
+    # Once logged into the database, use SQL to redirect
+    # the large files location
+    In [1]: from rhodecode.model.settings import SettingsModel
+    In [2]: SettingsModel().get_ui_by_key('usercache')
+    Out[2]: <RhodeCodeUi[largefiles]usercache=>/mnt/hgfs/shared/workspace/xxxx/.cache/largefiles]>
+
+    In [3]: largefiles_cache = SettingsModel().get_ui_by_key('usercache')
+    In [4]: largefiles_cache.ui_value = '/new/path’
+    In [5]: Session().add(largefiles_cache);Session().commit()
+

docs/admin/tuning-gunicorn.rst

@@ -0,0 +1,111 @@
+.. _increase-gunicorn:
+
+Increase Gunicorn Workers
+-------------------------
+
+.. important::
+
+   If you increase the number of :term:`Gunicorn` workers, you also need to
+   increase the threadpool size of the VCS Server. The recommended size is
+   6 times the number of Gunicorn workers. To set this, see
+   :ref:`vcs-server-config-file`.
+
+|RCE| comes with `Gunicorn`_ packaged in its Nix environment. To improve
+performance you can increase the number of workers. To do this, use the
+following steps:
+
+1. Open the :file:`home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+2. In the ``[server:main]`` section, increase the number of Gunicorn
+   ``workers`` using the following formula :math:`(2 * Cores) + 1`.
+
+.. code-block:: ini
+
+    [server:main]
+    host = 127.0.0.1
+    port = 10002
+    use = egg:gunicorn#main
+    workers = 1
+    threads = 1
+    proc_name = RhodeCodeEnterprise
+    worker_class = sync
+    max_requests = 1000
+    timeout = 3600
+
+3. In the ``[app:main]`` section, set the ``instance_id`` property to ``*``.
+
+.. code-block:: ini
+
+    # In the [app:main] section
+    [app:main]
+    # You must set `instance_id = *`
+    instance_id = *
+
+4. Save your changes.
+5. Restart your |RCE| instance, using the following command:
+
+.. code-block:: bash
+
+    $ rccontrol restart enterprise-1
+
+If you scale across different machines, each |RCM| instance
+needs to store its data on a shared disk, preferably together with your
+|repos|. This data directory contains template caches, a whoosh index,
+and is used for task locking to ensure safety across multiple instances.
+To do this, set the following properties in the :file:`rhodecode.ini` file to
+set the shared location across all |RCM| instances.
+
+.. code-block:: ini
+
+    cache_dir = /file/path           # set to shared location
+    search.location = /file/path           # set to shared location
+
+    ####################################
+    ###         BEAKER CACHE        ####
+    ####################################
+    beaker.cache.data_dir = /file/path       # set to shared location
+    beaker.cache.lock_dir = /file/path       # set to shared location
+
+
+
+Gunicorn SSL support
+--------------------
+
+
+:term:`Gunicorn` wsgi server allows users to use HTTPS connection directly
+without a need to use HTTP server like Nginx or Apache. To Configure
+SSL support directly with :term:`Gunicorn` you need to simply add the key
+and certificate paths to your configuration file.
+
+1. Open the :file:`home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+2. In the ``[server:main]`` section, add two new variables
+   called `certfile` and `keyfile`.
+
+.. code-block:: ini
+
+    [server:main]
+    host = 127.0.0.1
+    port = 10002
+    use = egg:gunicorn#main
+    workers = 1
+    threads = 1
+    proc_name = RhodeCodeEnterprise
+    worker_class = sync
+    max_requests = 1000
+    timeout = 3600
+    # adding ssl support
+    certfile = /home/ssl/my_server_com.pem
+    keyfile = /home/ssl/my_server_com.key
+
+4. Save your changes.
+5. Restart your |RCE| instance, using the following command:
+
+.. code-block:: bash
+
+    $ rccontrol restart enterprise-1
+
+After this is enabled you can *only* access your instances via https://
+protocol. Check out more docs here `Gunicorn SSL Docs`_
+
+
+.. _Gunicorn: http://gunicorn.org/
+.. _Gunicorn SSL Docs: http://docs.gunicorn.org/en/stable/settings.html#ssl

docs/admin/tuning-hg-auth-loop.rst

@@ -0,0 +1,17 @@
+.. _hg-auth-loop:
+
+|hg| Authentication Tuning
+--------------------------
+
+When using external authentication tools such as LDAP with |hg|, a
+password retry loop in |hg| can result in users being locked out due to too
+many failed password attempts. To prevent this from happening, add the
+following setting to your
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file, in the
+``[app:main]`` section.
+
+
+.. code-block:: ini
+
+   [app:main]
+   auth_ret_code_detection = true

docs/admin/tuning-increase-cache-size.rst

@@ -0,0 +1,17 @@
+.. _cache-size:
+
+Increase Cache Size
+-------------------
+
+When managing hundreds of |repos| from the main |RCE| interface the system
+can become slow when the cache expires. Increasing the cache expiration
+option improves the response times of the main user interface.
+To increase your cache size, change the following default value in the
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file. The value
+is specified in seconds.
+
+.. code-block:: ini
+
+      beaker.cache.long_term.expire=3600  # day (86400) week (604800)
+
+.. note:: The |RCE| cache automatically expires for changed |repos|.

docs/admin/tuning-increase-db-performance.rst

@@ -0,0 +1,23 @@
+.. _db-session-ref:
+
+Increase Database Performance
+-----------------------------
+
+To increase database performance switch to database-based user sessions.
+File-based sessions are only suitable for smaller setups. The most common
+issue being file limit errors which occur if there are lots of session files.
+Therefore, in a large scale deployment, to give better performance,
+scalability, and maintainability we recommend switching from file-based
+sessions to database-based user sessions.
+
+To switch to database-based user sessions uncomment the following section in
+your :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+
+.. code-block:: ini
+
+      # db session
+      beaker.session.type = ext:database
+
+      # adjust this property to include your database credentials
+      beaker.session.sa.url = postgresql://postgres:<pass>@localhost/rhodecode
+      beaker.session.table_name = db_session

docs/admin/tuning-mount-cache-memory.rst

@@ -0,0 +1,42 @@
+.. _data-mem:
+
+Mount Cache Folders To Memory
+-----------------------------
+
+To increase the performance of folders containing cache data, you can mount
+them to memory. The following folders specified in the :file:`rhodecode.ini`
+file would benefit from this.
+
+.. code-block:: ini
+
+    cache_dir = %(here)s/data
+    search.location = %(here)s/data/index
+
+Use the following Ubuntu example to mount these to memory, or see your
+particular |os| instructions. The expected performance benefit is
+approximately 5%. You should ensure you allocate an adequate amount of memory
+depending on your available resources.
+
+.. code-block:: bash
+
+    # mount to memory with 2GB limit and 755 write permissions
+    mount -t tmpfs -o size=2G,mode=0755 tmpfs /home/user/.rccontrol/enterprise-1/data
+    mount -t tmpfs -o size=2G,mode=0755 tmpfs /home/user/.rccontrol/enterprise-1/data/index
+
+.. _move-tmp:
+
+Move ``tmp`` to TMPFS
+---------------------
+
+|RCE| components heavily use the :file:`/tmp` folder, so moving your
+:file:`/tmp` folder into to a RAM-based TMPS can lead to a noticeable
+performance boost.
+
+.. code-block:: bash
+
+    # mount tmp to memory with 2GB limit and 755 write permissions
+    mount -t tmpfs -o size=2G,mode=0755 tmpfs /tmp
+
+For more information about TMPFS, see the documentation `here`_.
+
+.. _here: https://wiki.archlinux.org/index.php/Tmpfs

docs/admin/tuning-rhodecode.rst

@@ -0,0 +1,20 @@
+.. _rhodecode-tuning-ref:
+
+Tuning |RCE|
+============
+
+To customize your |RCE| |version| installation for maximum performance you
+may find some of the following methods useful.
+
+.. toctree::
+
+   tuning-gunicorn
+   tuning-vcs-memory-cache
+   tuning-increase-db-performance
+   tuning-scale-horizontally
+   tuning-increase-cache-size
+   tuning-mount-cache-memory
+   tuning-change-encoding
+   tuning-change-large-file-dir
+   tuning-hg-auth-loop
+

docs/admin/tuning-scale-horizontally.rst

@@ -0,0 +1,51 @@
+.. _scale-horizontal:
+
+Scale Horizontally
+------------------
+
+Horizontal scaling means adding more machines or workers into your pool of
+resources. Horizontally scaling |RCE| gives a huge performance increase,
+especially under large traffic scenarios with a high number of requests. This
+is very beneficial when |RCE| is serving many users simultaneously,
+or if continuous integration servers are automatically pulling and pushing code.
+
+To horizontally scale |RCE| you should use the following steps:
+
+1. In the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file,
+   set ``instance_id = *``. This enables |RCE| to use multiple nodes.
+2. Define the number of worker threads using the formula
+   :math:`(2 * Cores) + 1`. For example 4 CPU cores would lead to
+   :math:`(2 * 4) + 1 = 9` workers. In some cases it's ok to increase number of
+   workers even beyond this formula. Generally the more workers, the more
+   simultaneous connections the system can handle.
+
+It is recommended to create another dedicated |RCE| instance to handle
+traffic from build farms or continuous integration servers.
+
+.. note::
+
+   You should configure your load balancing accordingly. We recommend writing
+   load balancing rules that will separate regular user traffic from
+   automated process traffic like continuous servers or build bots.
+
+If you scale across different machines, each |RCE| instance needs to store
+its data on a shared disk, preferably together with your repositories. This
+data directory contains template caches, a whoosh index,
+and is used for task locking to ensure safety across multiple instances. To
+do this, set the following properties in the
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file to set
+the shared location across all |RCE| instances.
+
+.. code-block:: ini
+
+         cache_dir = /file/path               # set to shared directory location
+         search.location = /file/path               # set to shared directory location
+         beaker.cache.data_dir = /file/path   # set to shared directory location
+         beaker.cache.lock_dir = /file/path   # set to shared directory location
+
+.. note::
+
+     If Celery is used on each instance then you should run separate Celery
+     instances, but the message broker should be the same for all of them.
+     This excludes one RabbitMQ shared server.
+

docs/admin/tuning-vcs-memory-cache.rst

@@ -0,0 +1,8 @@
+.. _adjust-vcs-mem-cache:
+
+Adjusting VCS Memory Cache
+--------------------------
+
+The VCS Server mamory cache can be adjusted to work best with the resources
+available to your |RCE| instance. If you find that memory resources are under
+pressure, see the :ref:`vcs-server-maintain` section for details.

docs/admin/user-admin.rst

@@ -0,0 +1,23 @@
+.. _user-admin-set:
+
+User Administration
+===================
+
+|RCM| enables you to define permissions for the following entities within the
+system; **users**, **user groups**, **repositories**, **repository groups**.
+
+Within each one of these entities you can set default settings,
+and then all users or |repos| inherit those default permission settings
+unless individually defined. Each of these entities can have the following
+permissions applied to it; |perm|.
+
+.. toctree::
+
+    public-access
+    default-user-perms
+    adding-anonymous-user
+    adding-new-user
+    setting-default-permissions
+    setting-usergroup-permissions
+
+.. |perm| replace:: **None**, **Read**, **Write**, or **Admin**

docs/admin/vcs-server.rst

@@ -0,0 +1,301 @@
+.. _vcs-server:
+
+VCS Server Management
+---------------------
+
+The VCS Server handles |RCM| backend functionality. You need to configure
+a VCS Server to run with a |RCM| instance. If you do not, you will be missing
+the connection between |RCM| and its |repos|. This will cause error messages
+on the web interface. You can run your setup in the following configurations,
+currently the best performance is one VCS Server per |RCM| instance:
+
+* One VCS Server per |RCM| instance.
+* One VCS Server handling multiple instances.
+
+.. important::
+
+   If your server locale settings are not correctly configured,
+   |RCE| and the VCS Server can run into issues. See this `Ask Ubuntu`_ post
+   which explains the problem and gives a solution.
+
+For more information, see the following sections:
+
+* :ref:`install-vcs`
+* :ref:`config-vcs`
+* :ref:`vcs-server-options`
+* :ref:`vcs-server-versions`
+* :ref:`vcs-server-maintain`
+* :ref:`vcs-server-config-file`
+
+.. _install-vcs:
+
+VCS Server Installation
+^^^^^^^^^^^^^^^^^^^^^^^
+
+To install a VCS Server, see
+:ref:`Installing a VCS server <control:install-vcsserver>`.
+
+.. _config-vcs:
+
+Hooking |RCE| to its VCS Server
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To configure a |RCE| instance to use a VCS server, see
+:ref:`Configuring the VCS Server connection <control:manually-vcsserver-ini>`.
+
+.. _vcs-server-options:
+
+|RCE| VCS Server Options
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+The following list shows the available options on the |RCM| side of the
+connection to the VCS Server. The settings are configured per
+instance in the
+:file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.
+
+.. rst-class:: dl-horizontal
+
+    \vcs.backends <available-vcs-systems>
+        Set a comma-separated list of the |repo| options available from the
+        web interface. The default is ``hg, git, svn``,
+        which is all |repo| types available.
+
+    \vcs.connection_timeout <seconds>
+        Set the length of time in seconds that the VCS Server waits for
+        requests to process. After the timeout expires,
+        the request is closed. The default is ``3600``. Set to a higher
+        number if you experience network latency, or timeout issues with very
+        large push/pull requests.
+
+    \vcs.server.enable <boolean>
+        Enable or disable the VCS Server. The available options are ``true`` or
+        ``false``. The default is ``true``.
+
+    \vcs.server <host:port>
+        Set the host, either hostname or IP Address, and port of the VCS server
+        you wish to run with your |RCM| instance.
+
+.. code-block:: ini
+
+    ##################
+    ### VCS CONFIG ###
+    ##################
+    # set this line to match your VCS Server
+    vcs.server = 127.0.0.1:10004
+    # Set to False to disable the VCS Server
+    vcs.server.enable = True
+    vcs.backends = hg, git, svn
+    vcs.connection_timeout = 3600
+
+
+.. _vcs-server-versions:
+
+VCS Server Versions
+^^^^^^^^^^^^^^^^^^^
+
+An updated version of the VCS Server is released with each |RCE| version. Use
+the VCS Server number that matches with the |RCE| version to pair the
+appropriate ones together. For |RCE| versions pre 3.3.0,
+VCS Server 1.X.Y works with |RCE| 3.X.Y, for example:
+
+* VCS Server 1.0.0 works with |RCE| 3.0.0
+* VCS Server 1.2.2 works with |RCE| 3.2.2
+
+For |RCE| versions post 3.3.0, the VCS Server and |RCE| version numbers
+match, for example:
+
+* VCS Server |release| works with |RCE| |release|
+
+.. _vcs-server-maintain:
+
+VCS Server Memory Optimization
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To configure the VCS server to manage the cache efficiently, you need to
+configure the following options in the
+:file:`/home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini` file. Once
+configured, restart the VCS Server.
+
+.. rst-class:: dl-horizontal
+
+    \beaker.cache.repo_object.type = memorylru
+        Configures the cache to discard the least recently used items.
+        This setting takes the following valid options:
+
+        * ``memorylru``: The default setting, which removes the least recently
+          used items from the cache.
+        * ``memory``: Runs the VCS Server without clearing the cache.
+        * ``nocache``: Runs the VCS Server without a cache. This will
+          dramatically reduce the VCS Server performance.
+
+    \beaker.cache.repo_object.max_items = 100
+        Sets the maximum number of items stored in the cache, before the cache
+        starts to be cleared.
+
+        As a general rule of thumb, running this value at 120 resulted in a
+        5GB cache. Running it at 240 resulted in a 9GB cache. Your results
+        will differ based on usage patterns and |repo| sizes.
+
+        Tweaking this value to run at a fairly constant memory load on your
+        server will help performance.
+
+To clear the cache completely, you can restart the VCS Server.
+
+.. important::
+
+   While the VCS Server handles a restart gracefully on the web interface,
+   it will drop connections during push/pull requests. So it is recommended
+   you only perform this when there is very little traffic on the instance.
+
+Use the following example to restart your VCS Server,
+for full details see the :ref:`RhodeCode Control CLI <control:rcc-cli>`.
+
+.. code-block:: bash
+
+    $ rccontrol status
+
+.. code-block:: vim
+
+    - NAME: vcsserver-1
+    - STATUS: RUNNING
+    - TYPE: VCSServer
+    - VERSION: 1.0.0
+    - URL: http://127.0.0.1:10001
+
+    $ rccontrol restart vcsserver-1
+    Instance "vcsserver-1" successfully stopped.
+    Instance "vcsserver-1" successfully started.
+
+.. _vcs-server-config-file:
+
+VCS Server Configuration
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+You can configure settings for multiple VCS Servers on your
+system using their individual configuration files. Use the following
+properties inside the configuration file to set up your system. The default
+location is :file:`home/{user}/.rccontrol/{vcsserver-id}/vcsserver.ini`.
+For a more detailed explanation of the logger levers, see :ref:`debug-mode`.
+
+.. rst-class:: dl-horizontal
+
+    \host <ip-address>
+        Set the host on which the VCS Server will run.
+
+    \port <int>
+        Set the port number on which the VCS Server will be available.
+
+    \locale <locale_utf>
+        Set the locale the VCS Server expects.
+
+    \threadpool_size <int>
+        Set the size of the threadpool used to communicate
+        with the WSGI workers. This should be at least 6 times the number of
+        WSGI worker processes.
+
+    \timeout <seconds>
+        Set the timeout for RPC communication in seconds.
+
+.. note::
+
+   After making changes, you need to restart your VCS Server to pick them up.
+
+.. code-block:: ini
+
+    ################################################################################
+    # RhodeCode VCSServer - configuration                                          #
+    #                                                                              #
+    ################################################################################
+
+    [DEFAULT]
+    host = 127.0.0.1
+    port = 9900
+    locale = en_US.UTF-8
+    # number of worker threads, this should be set based on a formula threadpool=N*6
+    # where N is number of RhodeCode Enterprise workers, eg. running 2 instances
+    # 8 gunicorn workers each would be 2 * 8 * 6 = 96, threadpool_size = 96
+    threadpool_size = 16
+    timeout = 0
+
+    # cache regions, please don't change
+    beaker.cache.regions = repo_object
+    beaker.cache.repo_object.type = memorylru
+    beaker.cache.repo_object.max_items = 1000
+
+    # cache auto-expires after N seconds
+    beaker.cache.repo_object.expire = 10
+    beaker.cache.repo_object.enabled = true
+
+
+    ################################
+    ### LOGGING CONFIGURATION   ####
+    ################################
+    [loggers]
+    keys = root, vcsserver, pyro4, beaker
+
+    [handlers]
+    keys = console
+
+    [formatters]
+    keys = generic
+
+    #############
+    ## LOGGERS ##
+    #############
+    [logger_root]
+    level = NOTSET
+    handlers = console
+
+    [logger_vcsserver]
+    level = DEBUG
+    handlers =
+    qualname = vcsserver
+    propagate = 1
+
+    [logger_beaker]
+    level = DEBUG
+    handlers =
+    qualname = beaker
+    propagate = 1
+
+    [logger_pyro4]
+    level = DEBUG
+    handlers =
+    qualname = Pyro4
+    propagate = 1
+
+
+    ##############
+    ## HANDLERS ##
+    ##############
+
+    [handler_console]
+    class = StreamHandler
+    args = (sys.stderr,)
+    level = DEBUG
+    formatter = generic
+
+    [handler_file]
+    class = FileHandler
+    args = ('vcsserver.log', 'a',)
+    level = DEBUG
+    formatter = generic
+
+    [handler_file_rotating]
+    class = logging.handlers.TimedRotatingFileHandler
+    # 'D', 5 - rotate every 5days
+    # you can set 'h', 'midnight'
+    args = ('vcsserver.log', 'D', 5, 10,)
+    level = DEBUG
+    formatter = generic
+
+    ################
+    ## FORMATTERS ##
+    ################
+
+    [formatter_generic]
+    format = %(asctime)s.%(msecs)03d %(levelname)-5.5s [%(name)s] %(message)s
+    datefmt = %Y-%m-%d %H:%M:%S
+
+
+.. _Ask Ubuntu: http://askubuntu.com/questions/162391/how-do-i-fix-my-locale-issue

docs/auth/auth.rst

@@ -0,0 +1,37 @@
+.. _authentication-ref:
+
+Authentication Options
+======================
+
+|RCE| provides a built in authentication plugin
+``rhodecode.lib.auth_rhodecode``. This is enabled by default and accessed
+through the administrative interface. Additionally,
+|RCE| provides a Pluggable Authentication System (PAS). This gives the
+administrator greater control over how users authenticate with the system.
+
+.. important::
+
+  You can disable the built in |RCM| authentication plugin
+  ``rhodecode.lib.auth_rhodecode`` and force all authentication to go
+  through your authentication plugin. However, if you do this,
+  and your external authentication tools fails, you will be unable to
+  access |RCM|.
+
+|RCM| comes with the following user authentication management plugins:
+
+.. only:: latex
+
+    * :ref:`config-ldap-ref`
+    * :ref:`config-pam-ref`
+    * :ref:`config-crowd-ref`
+    * :ref:`config-token-ref`
+
+.. toctree::
+
+    ldap-config-steps
+    crowd-auth
+    pam-auth
+    token-auth
+    ssh-connection
+
+

docs/auth/crowd-auth.rst

@@ -0,0 +1,15 @@
+.. _config-crowd-ref:
+
+Crowd
+-----
+
+To enable Crowd authentication, use the following steps:
+
+1. From the |RCM| interface, go to :menuselection:`Admin --> Authentication`
+2. Enable the ``rhodecode.lib.auth_modules.auth_crowd`` library and select
+   :guilabel:`Save`
+3. On the Crowd plugin settings section, do the following:
+
+   * Check the :guilabel:`Enable` checkbox
+   * Enter your Crowd server settings
+   * Select :guilabel:`Save`

docs/auth/ldap-active-directory.rst

@@ -0,0 +1,22 @@
+.. _ldap-act-dir-ref:
+
+Active Directory
+----------------
+
+|RCM| can use Microsoft Active Directory for user authentication. This is
+done through an LDAP or LDAPS connection to Active Directory. Use the
+following example LDAP configuration setting to set your Active Directory
+authentication.
+
+.. code-block:: ini
+    
+    # Set the Base DN
+    Base DN              = OU=SBSUsers,OU=Users,OU=MyBusiness,DC=v3sys,DC=local
+    # Set the Active Directory SAM-Account-Name
+    Login Attribute      = sAMAccountName
+    # Set the Active Directory user name
+    First Name Attribute = usernameame
+    # Set the Active Directory user surname
+    Last Name Attribute  = user_surname
+    # Set the Active Directory user email
+    E-mail Attribute     = userEmail

docs/auth/ldap-authentication.rst

@@ -0,0 +1,107 @@
+.. _ldap-gloss-ref:
+
+|LDAP| Glossary
+---------------
+
+This topic aims to give you a concise overview of the different settings and
+requirements that enabling |LDAP| on |RCE| requires.
+
+Required settings
+^^^^^^^^^^^^^^^^^
+
+The following LDAP attributes are required when enabling |LDAP| on |RCE|.
+
+* **Hostname** or **IP Address**: Use a comma separated list for failover
+  support.
+* **First Name**
+* **Surname**
+* **Email**
+* **Port**: Port `389` for unencrypted LDAP or port `636` for SSL-encrypted
+  LDAP (LDAPS).
+* **Base DN (Distinguished Name)**: The Distinguished Name (DN)
+  is how searches for users will be performed, and these searches can be
+  controlled by using an LDAP Filter or LDAP Search Scope. A DN is a sequence of
+  relative distinguished names (RDN) connected by commas. For example,
+      
+.. code-block:: vim
+    
+    DN: cn='Monty Python',ou='people',dc='example',dc='com'
+            
+* **Connection security level**: The following are the valid types:
+   
+  * *No encryption*: This connection type uses a plain non-encrypted connection.
+  * *LDAPS connection*: This connection type uses end-to-end SSL. To enable
+    an LDAPS connection you must set the following requirements:
+
+      * You must specify port `636`
+      * Certificate checks are required.
+      * To enable ``START_TLS`` on LDAP connection, set the path to the SSL
+        certificate in the default LDAP configuration file. The default
+        `ldap.conf` file is located in `/etc/openldap/ldap.conf`.
+
+.. code-block:: vim
+    
+   TLS_CACERT	/etc/ssl/certs/ca.crt
+
+* The LDAP username or account used to connect to |RCE|. This will be added
+  to the LDAP filter for locating the user object.
+* For example, if an LDAP filter is specified as `LDAPFILTER`,
+  the login attribute is specified as `uid`, and the user connects as
+  `jsmith`, then the LDAP Filter will be like the following example.
+      
+.. code-block:: vim
+                      
+   (&(LDAPFILTER)(uid=jsmith))
+    
+* The LDAP search scope must be set. This limits how far LDAP will search for
+  a matching object.
+
+  * ``BASE`` Only allows searching of the Base DN.
+  * ``ONELEVEL`` Searches all entries under the Base DN,
+    but not the Base DN itself.
+  * ``SUBTREE`` Searches all entries below the Base DN, but not Base DN itself.
+      
+.. note::
+            
+   When using ``SUBTREE`` LDAP filtering it is useful to limit object location.
+ 
+Optional settings
+^^^^^^^^^^^^^^^^^
+
+The following are optional when enabling LDAP on |RCM|
+ 
+* An LDAP account is only required if the LDAP server does not allow
+  anonymous browsing of records.
+* An LDAP password is only required if the LDAP server does not allow
+  anonymous browsing of records
+* Using an LDAP filter is optional. An LDAP filter defined by `RFC 2254`_. This
+  is more useful that the LDAP Search Scope if set to `SUBTREE`. The filter
+  is useful for limiting which LDAP objects are identified as representing
+  Users for authentication. The filter is augmented by Login Attribute
+  below. This can commonly be left blank.
+* Certificate Checks are only required if you need to use LDAPS.
+  You can use the following levels of LDAP service with RhodeCode Enterprise:
+
+   * **NEVER** : A serve certificate will never be requested or checked.
+   * **ALLOW** : A server certificate is requested. Failure to provide a
+     certificate or providing a bad certificate will not terminate the session.
+   * **TRY** : A server certificate is requested. Failure to provide a
+     certificate does not halt the session; providing a bad certificate
+     halts the session.
+   * **DEMAND** : A server certificate is requested and must be provided
+     and authenticated for the session to proceed.
+   * **HARD** : The same as DEMAND.
+
+.. note::
+
+   Only **DEMAND** or **HARD** offer full SSL security while the other
+   options are vulnerable to man-in-the-middle attacks.
+
+   |RCE| uses ``OPENLDAP`` libraries. This allows **DEMAND** or
+   **HARD** LDAPS connections to use self-signed certificates or
+   certificates that do not have traceable certificates of authority.
+   To enable this functionality install the SSL certificates in the
+   following directory: `/etc/openldap/cacerts`
+
+
+.. _RFC 2254: http://www.rfc-base.org/rfc-2254.html

docs/auth/ldap-config-steps.rst

@@ -0,0 +1,88 @@
+.. _config-ldap-ref:
+
+LDAP
+----
+
+|RCM| supports LDAP (Lightweight Directory Access Protocol) authentication.
+All LDAP versions are supported, with the following |RCM| plugins managing each:
+
+* For LDAPv3 use ``rhodecode.lib.auth_modules.auth_ldap_group``
+* For older LDAP versions use ``rhodecode.lib.auth_modules.auth_ldap``
+
+.. important::
+
+   The email used with your |RCE| super-admin account needs to match the email
+   address attached to your admin profile in LDAP. This is because
+   within |RCE| the user email needs to be unique, and multiple users
+   cannot share an email account.
+
+   Likewise, if as an admin you also have a user account, the email address
+   attached to the user account needs to be different.
+
+LDAP Configuration Steps
+^^^^^^^^^^^^^^^^^^^^^^^^
+
+To configure |LDAP|, use the following steps:
+
+1. From the |RCM| interface, select
+   :menuselection:`Admin --> Authentication`
+2. Enable the required plugin and select :guilabel:`Save`
+3. Select the :guilabel:`Enabled` check box in the plugin configuration section
+4. Add the required LDAP information and :guilabel:`Save`, for more details,
+   see :ref:`config-ldap-examples`
+
+For a more detailed description of LDAP objects, see :ref:`ldap-gloss-ref`:
+
+.. _config-ldap-examples:
+
+Example LDAP configuration
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+.. code-block:: bash
+
+        # Auth Cache TTL
+        3600
+        # Host
+        https://ldap1.server.com/ldap-admin/,https://ldap2.server.com/ldap-admin/
+        # Port
+        389
+        # Account
+        cn=admin,dc=rhodecode,dc=com
+        # Password
+        ldap-user-password
+        # LDAP connection security
+        LDAPS
+        # Certificate checks level
+        DEMAND
+        # Base DN
+        cn=Rufus Magillacuddy,ou=users,dc=rhodecode,dc=com
+        # User Search Base
+        ou=groups,ou=users
+        # LDAP search filter
+        (objectClass=person)
+        # LDAP search scope
+        SUBTREE
+        # Login attribute
+        rmagillacuddy
+        # First Name Attribute
+        Rufus
+        # Last Name Attribute
+        Magillacuddy
+        # Email Attribute
+        LDAP-Registered@email.ac
+        # User Member of Attribute
+        Organizational Role
+        # Group search base
+        cn=users,ou=groups,dc=rhodecode,dc=com
+        # LDAP Group Search Filter
+        (objectclass=posixGroup)
+        # Group Name Attribute
+        users
+        # Group Member Of Attribute
+        cn
+        # Admin Groups
+        admin,devops,qa
+
+.. toctree::
+
+   ldap-active-directory
+   ldap-authentication

docs/auth/ldap-configuration-example.rst

@@ -0,0 +1,13 @@
+    LDAP Host hostname1,hostname2 # testing here
+    Port port
+    Account: `uid=admin,cn=users,cn=accounts,dc=localdomain,dc=tld`
+    Password: userpassword #Testing this here
+    Connection Security LDAPS
+    Certificate Checks ``NEVER``
+    Base DN cn=users,cn=accounts,dc=localdomain,dc=tld
+    LDAP Search Filter (objectClass=person)
+    LDAP Search Scope SUBTREE
+    Login Attribute uid
+    First Name Attribute givenname
+    Last Name Attribute sn
+    Email Attribute mail

docs/auth/pam-auth.rst

@@ -0,0 +1,14 @@
+.. _config-pam-ref:
+
+PAM
+---
+
+To enable PAM authentication, use the following steps:
+
+1. From the |RCM| interface, go to :menuselection:`Admin --> Authentication`
+2. Enable the ``rhodecode.lib.auth_modules.auth_pam`` library and select save
+3. On the PAM plugin settings section, do the following:
+
+   * Check the :guilabel:`Enable` checkbox
+   * Enter your PAM server settings
+   * Select :guilabel:`Save`

docs/auth/ssh-connection.rst

@@ -0,0 +1,129 @@
+.. _ssh-connection:
+
+SSH Connection
+--------------
+
+If you wish to connect to your Git or Mercurial |repos| using SSH, use the
+following instructions.
+
+.. note::
+
+   SSH access with full |RCE| permissions will require an Admin |authtoken|.
+
+   You need to install the |RC| SSH tool on the server which is running
+   the |RCE| instance.
+
+1. Gather the following information about the instance you wish to connect to:
+
+   * *Hostname*: Use the ``rccontrol status`` command to view instance details.
+   * *API key*: From the |RCE|, go to
+     :menuselection:`username --> My Account --> Auth Tokens`
+   * *Configuration file*: Identify the configuration file for that instance,
+     the default is :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini`
+   * Identify which |git| and |hg| packages your |RCM| instance is using.
+
+       * For |git|, see
+         :menuselection:`Admin --> Settings --> System Info`
+       * For |hg|, use the ``which hg`` command.
+
+2. Clone the |RC| SSH script,
+   ``hg clone https://code.rhodecode.com/rhodecode-ssh``
+3. Copy the ``sshwrapper.sample.ini``, and save it as ``sshwrapper.ini``
+4. Configure the :file:`sshwrapper.ini` file using the following example:
+
+.. code-block:: ini
+
+    [api]
+    host=http://localhost:10005
+    key=24a67076d69c84670132f55166ac79d1faafd660
+
+    [shell]
+    shell=/bin/bash -l
+
+    [vcs]
+    root=/path/to/repos/
+
+    [rhodecode]
+    config=/home/user/.rccontrol/enterprise-3/rhodecode.ini
+
+    [vcs:hg]
+    path=/usr/bin/hg
+
+    # should be a base dir for all git binaries, i.e. not ../bin/git
+    [vcs:git]
+    path=/usr/bin
+
+    [keys]
+    path=/home/user/.ssh/authorized_keys
+
+5. Add the public key to your |RCE| instance server using the
+   :file:`addkey.py` script. This script automatically creates
+   the :file:`authorized_keys` file which was specified in your
+   :file:`sshwrapper.ini` configuration. Use the following example:
+
+.. code-block:: bash
+
+   $ ./addkey.py --user username --shell --key /home/username/.ssh/id_rsa.pub
+
+.. important::
+
+   To give SSH access to all users, you will need to maintain
+   each users |authtoken| in the :file:`authorized_keys` file.
+
+6. Connect to your server using SSH from your local machine.
+
+.. code-block:: bash
+
+    $ ssh user@localhost
+    Enter passphrase for key '/home/username/.ssh/id_rsa':
+
+If you need to manually configure the ``authorized_keys`` file,
+add a line for each key using the following example:
+
+.. code-block:: vim
+
+   command="/home/user/.rhodecode-ssh/sshwrapper.py --user username --shell",
+   no-port-forwarding,no-X11-forwarding,no-agent-forwarding ssh-rsa yourpublickey
+
+.. tip::
+
+   Best practice would be to create a special SSH user account with each
+   users |authtoken| attached.
+
+   |RCE| will manage the user permissions based on the |authtoken| supplied.
+   This would allow you to immediately revoke all SSH access by removing one
+   user from your server if you needed to.
+
+See the following command line example of setting this up. These steps
+take place on the server.
+
+.. code-block:: bash
+
+    # On the RhodeCode Enterprise server
+    # set up user and clone SSH tool
+    $ sudo adduser testuser
+    $ sudo su - testuser
+    $ hg clone https://code.rhodecode.com/rhodecode-ssh
+    $ cd rhodecode-ssh
+
+    # Copy and modify the sshwrapper.ini as explained in step 4
+    $ cp sshwrapper.sample.ini sshwrapper.ini
+
+    $ cd ~
+    $ mkdir .ssh
+    $ touch .ssh/authorized_keys
+
+    # copy your ssh public key, id_rsa.pub, from your local machine
+    # to the server. We’ll use it in the next step
+
+    $ python addkey.py --user testuser --shell --key /path/to/id_rsa.pub
+
+    # Note: testssh - user on the rhodecode instance
+    $ chmod 755 sshwrapper.py
+
+Test the connection from your local machine using the following example:
+
+.. code-block:: bash
+
+    # Test connection using the ssh command from the local machine
+    $ ssh testuser@my-server.example.com

docs/auth/token-auth.rst

@@ -0,0 +1,76 @@
+.. _config-token-ref:
+
+Authentication Tokens
+---------------------
+
+|RCE| has 4 different kinds of authentication tokens.
+
+* *API tokens*: API tokens can only be used to execute |RCE| API operations.
+  You can store your API token and assign it to each instance in
+  the :file:`/home/{user}/.rhoderc` file. See the
+  example in :ref:`indexing-ref` section for more details.
+
+* *Feed tokens*: The feed token can only be used to access the RSS feed.
+   Usually those are safe to store inside your RSS feed reader.
+
+* *VCS tokens*: You can use these to authenticate with |git|, |hg| and |svn|
+  operations instead of a password. They are designed to be used with
+  CI Servers or other third party tools that require |repo| access.
+  They are also a good replacement for SSH based access.
+  To use these tokens you need be enabled special authentication method on
+  |RCE|, as they are disabled by default.
+  See :ref:`enable-vcs-tokens`.
+
+* *Web Interface tokens*: These token allows users to access the web
+  interface of |RCE| without logging in.
+
+  You can add these tokens to an |RCE| server url, to expose the page content
+  based on the given token.
+
+  This is useful to integrate 3rd party systems, good example is to expose
+  raw diffs to another code-review system without having to worry about
+  authentication.
+
+  These tokens only work if a certain view is whitelisted
+  under `api_access_controllers_whitelist` inside
+  the :file:`rhodecode.ini` file.
+
+.. code-block:: bash
+
+   # To download a repo without logging into Web UI
+   https://rhodecode.com/repo/archive/tip.zip?auth_token=<web-api-token>
+
+   # To show commit diff without logging into Web UI
+   https://rhodecode.com/repo/changeset-diff/<sha>?auth_token=<web-api-token>
+
+.. _enable-vcs-tokens:
+
+Enabling VCS Tokens
+^^^^^^^^^^^^^^^^^^^
+
+To enable VCS Tokens, use the following steps:
+
+1. Go to :menuselection:`Admin --> Authentication`.
+2. Enable the ``rhodecode.lib.auth_modules.auth_token`` plugin.
+3. Click :guilabel:`Save`.
+
+Authentication Token Tips
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Use Authentication Tokens instead of your password with external services.
+* Create multiple Authentication Tokens on your account to enable
+  access to your |repos| with a different |authtoken| per method used.
+* Set an expiry limit on certain tokens if you think it would be a good idea.
+
+Creating Tokens
+^^^^^^^^^^^^^^^
+
+To create authentication tokens for an user, use the following steps:
+
+1. From the |RCM| interface go to
+   :menuselection:`Username --> My Account --> Auth tokens`.
+
+2. Label and Add the tokens you wish to use with |RCE|.
+
+.. image:: ../images/tokens.png
+

docs/code-review/approve-changes.rst

@@ -0,0 +1,13 @@
+.. _code-approve-changes-ref:
+
+Approve Code Changes
+--------------------
+
+To approve commits, use the following steps:
+
+1. Open the commit for review
+2. Leave your comments inline or in the message box.
+3. Set the review status from the drop-down menu and select :guilabel:`Comment`
+
+.. image:: ../images/set-ci-status.png
+   :alt: Setting Commit Status

docs/code-review/code-review.rst

@@ -0,0 +1,27 @@
+.. _code-review-ref:
+
+Code Review
+===========
+
+|RCM| provides two ways in which you can review code. You can review |prs| or
+commits. To better understand |prs|, see the :ref:`pull-requests-ref`
+and :ref:`collaborate-ref` sections. For more information about why
+code review matters, see these posts on the topic:
+
+* `Code Review - Fix Bugs Early and Often`_
+* `Code Review - How to Convince a Skeptic`_
+* `Code Review - Learn How NASA Codes`_
+
+You can also use the |RCE| API set up continuous integration servers to leave
+comments from a test suite. See the :ref:`api` and
+:ref:`integrations-ref` sections for examples on how to set this up.
+
+.. toctree::
+
+   review-diffs
+   approve-changes
+   reviewing-best-practices
+
+.. _Code Review - Fix Bugs Early and Often: https://rhodecode.com/blog/code-review-fix-bugs-early-often/
+.. _Code Review - How to Convince a Skeptic: https://rhodecode.com/blog/code-review-convince-skeptic/
+.. _Code Review - Learn How NASA Codes: https://rhodecode.com/blog/code-review-learn-nasa-codes/

docs/code-review/review-diffs.rst

@@ -0,0 +1,42 @@
+.. _code-diff-side-ref:
+
+Reviewing Diffs
+---------------
+
+Diffs are representations of changes made between different changesets of
+a file. |RCE| provides 4 different types of diffs for each commit or
+changeset, and depending on your preference you can use whichever for code
+review purposes.
+
+* Plain diff
+* Full diff
+* Side-by-side diff
+* Raw diff
+
+Reviewing Changes
+-----------------
+
+|RCM| displays all code changes made with each commit. Removed content is
+marked in red and new content in green.
+
+.. image:: ../images/plain-diff.png
+   :alt: Plain Diff
+
+Side-By-Side Diffs
+------------------
+
+To review code with a side-by-side diff, use the following steps:
+
+1. Open the repository in which you wish to review a file
+2. Select the revision you wish to review
+3. Select the side-by-side diff icon beside the file name
+
+.. image:: ../images/side-by-side-diff.png
+   :alt: Side by side diff
+
+
+Notifying Users
+---------------
+
+To notify other users of you comments, or requests for feedback,
+see :ref:`review-notifications-ref`

docs/code-review/reviewing-best-practices.rst

@@ -0,0 +1,21 @@
+.. _code-best-practices-ref:
+
+Code Review - Best Practices
+----------------------------
+
+The following is a list of best practices for reviewing code gathered from
+various sources:
+
+* **Implement a Core Review standard**, because the yield of the Code Review
+  phase is 50 to 80% better than that of the Test phase.
+* Review between **100 and 300 lines of code** at a time and spend 30-60 minutes
+  doing it for best results.
+* **Avoid code review meetings**, because meetings contributed only 4% of the
+  defects found in the code inspections.
+* Slow down to a comfortable pace, as reviewers **slower than 400 lines per
+  hour are above average** in their ability to uncover defects. But when faster
+  than 450 lines/hour the defect density is below average in 87% of the cases.
+* Take a time-out, because defects are found at relatively constant rates
+  through the first **60 minutes of inspection**. At that point the
+  checklist-style review levels off sharply; the other review styles level
+  off slightly later. In no case is a defect discovered after 90 minutes.

docs/collaboration/approve-pull-request.rst

@@ -0,0 +1,19 @@
+Approve |prs|
+-------------
+
+To approve a |pr|, use the following steps:
+
+1. Select :menuselection:`username --> Notifications --> Pull Requests`
+   and open the |pr| you with to approve
+2. Leave your review comments inline, or in the commit message.
+3. Leave a commit message that outlines the review.
+4. Set the review status to :guilabel:`Approved`
+5. Select :guilabel:`Comment`
+
+If you approve the |pr|, you will be able to merge automatically if |RCM|
+detects that it can do so safely. You will see this message:
+
+:guilabel:`This pull request can be automatically merged.`
+
+Otherwise you will need to merge the |pr| locally and push your changes, see
+:ref:`manual-merge-requests-ref`.

docs/collaboration/collaboration.rst

@@ -0,0 +1,24 @@
+.. _collaborate-ref:
+
+Collaboration
+=============
+
+.. note::
+
+   Forking and branching does not work with |svn| |repos|.
+
+Collaboration in |RCM| is accomplished through a combination of the following
+functions:
+
+.. only:: latex
+
+    * :ref:`review-notifications-ref`
+    * :ref:`forks-branches-ref`
+    * :ref:`pull-requests-ref`
+
+.. toctree::
+
+    workflow
+    forks-branches
+    repo-locking
+

docs/collaboration/fixing-common-commits.rst

@@ -0,0 +1,31 @@
+.. _merging-empty-repo-ref:
+
+Merging Forks with an Empty Repository
+======================================
+
+When a new repository is created, it has no commits. If the empty repository is
+forked, neither |repo| will have any shared information to link them together,
+making it impossible to create a |pr| to merge them.
+
+To avoid this problem, create an initial commit on the new repository before
+forking it. It can be accomplished, for example, by adding a README file to the
+master repository and commiting it to the server before forking.
+
+In case the fork was already made and you are unable to push or merge due to the
+lack of a common commit between both repositories, the following steps would
+enable you to fix this problem.
+
+1. Create a commit on the master repository.
+2. Pull the changes from the fork to the master repository, and rebase them
+   on top of the new commit.
+
+    .. code-block:: bash
+
+       #pull from the fork into master
+       $ hg pull -r fork-commit-id
+
+3. If the changes were made locally, push the changes to the server.
+4. On the forked repository, pull the changes from master.
+
+Now you should be able to create a |pr| or merge between both repositories.
+

docs/collaboration/forks-branches.rst

@@ -0,0 +1,101 @@
+.. _forks-branches-ref:
+
+Forking and Branching
+---------------------
+
+Forking clones the original |repo| and creates an independent |repo|.
+Branching allows you to develop independently
+of the main branch based on the changeset branched, but remains linked to the
+main |repo|.
+
+Both provide excellent collaboration functionality,
+and do not differ greatly, but you can find many online discussions
+where people fight about the differences.
+
+Fork a |repo|
+^^^^^^^^^^^^^
+
+To fork a |repo|, use the following steps:
+
+1. Select :menuselection:`Admin --> repositories`
+2. Select the |repo| you wish to fork.
+3. Select :menuselection:`Options --> Fork`
+4. On the :guilabel:`Create fork` page, set the following properties:
+
+   * The fork name
+   * The fork description
+   * If the fork is private or public
+   * The copy permissions
+
+Branch a |git| |repo|
+^^^^^^^^^^^^^^^^^^^^^
+
+Currently branching is only supported from the command line but is picked up
+on the web interface. To branch a |git| |repo| use the following example:
+
+.. code-block:: bash
+
+    # branch and checkout
+    git branch new-branch
+    git checkout new-branch
+
+    # same function shorthand
+    git checkout -b new-branch
+
+    # Example usage
+    $ git checkout -b example-branch
+    Switched to a new branch 'example-branch'
+
+    $ git status
+    On branch example-branch
+    Initial commit
+    nothing to commit (create/copy files and use "git add" to track)
+    $ vi example-script.sh
+    $ git add example-script.sh
+    $ git commit -a -m "ghost script: initial file"
+    $ git push
+
+Once it is pushed to the |RCM| server, you can switch to the newly created
+branch using the following steps:
+
+1. Select :menuselection:`Admin --> Repositories`.
+2. Select the |repo| you branched.
+3. Select :menuselection:`Switch To --> Branches` and choose the new branch.
+
+For more information, your can read more here on the Git website,
+`Git Branching`_.
+
+Branch a |hg| |repo|
+^^^^^^^^^^^^^^^^^^^^
+
+.. note::
+
+    To use branches in |hg| like |git|, use the `hg bookmark` option instead.
+    Also see the :ref:`bvb` section for more information.
+
+To branch a |hg| |repo|, use the following example and push your changes to
+the main |repo|. Once pushed, you can view the new branch in |RCE| by
+selecting :menuselection:`Switch To --> Branches` from the |repo| page.
+
+.. code-block:: bash
+
+    $ hg branch example-456
+    $ hg ci -m "branch: ticket #456"
+    $ hg push --new-branch
+
+Bookmark a |hg| |repo|
+^^^^^^^^^^^^^^^^^^^^^^
+
+Bookmarks are used in |hg| in much the same way as branches are in |git|. See
+the `Mercurial Bookmarks`_ documentation for more information.
+
+.. code-block:: bash
+
+    $ hg bookmark example-456
+    $ hg ci -m "branch: ticket #456"
+    $ hg push -B example-456
+
+.. image:: ../images/branch-example.png
+
+.. _Git Branching: http://git-scm.com/book/en/v2/Git-Branching-Basic-Branching-and-Merging
+.. _Mercurial Bookmarks: https://mercurial.selenic.com/wiki/Bookmarks

docs/collaboration/mention-reviewer-function.rst

@@ -0,0 +1,39 @@
+.. _user-notify-ref:
+
+Using Notifications
+-------------------
+
+To notify users of items that require their attention you can use the mention
+function. The mention function allows you to use ``@username`` within |RCM|.
+The notification function can be used within the following
+items to highlight their need for attention:
+  
+* Commit messages
+* Pull requests
+* Inline comments
+* Code review
+
+.. note::
+  
+     Mentioned users will receive an email and a notification.
+
+Pull Request Notifications
+--------------------------
+
+To notify a user of a pull request, use the following steps.
+
+1. Open the repository fork
+2. Select :guilabel:`Open new pull request`
+3. Add the :guilabel:`@username` in the :guilabel:`Pull request viewers`
+   input field.
+4. Select :guilabel:`Submit Pull Request`
+
+Commit Message Notifications
+----------------------------
+
+To notify a user in a commit message, use the following steps.
+
+1. Open a repository with commits in it.
+2. Click on the commit message or revision number.
+3. Add an :guilabel:`@username` in an inline comment or in your approval
+   comment and commit.

docs/collaboration/merge-pull-request.rst

@@ -0,0 +1,35 @@
+.. _merge-requests-ref:
+
+Merge a |pr|
+------------
+
+|RCM| can detect if it can automatically merge the changes in a |pr|. If it
+can, you will see the following message:
+:guilabel:`This pull request can be automatically merged.` To merge,
+click the big blue button! To enable this feature, see :ref:`server-side-merge`.
+
+.. image:: ../images/merge-pr-button.png
+
+If you cannot automatically merge a |pr|, you will see one of the following
+messages:
+
+* :guilabel:`This pull request cannot be merged because of conflicts`
+* :guilabel:`Reviewer approval is pending`
+
+.. _manual-merge-requests-ref:
+
+Manual Merge a |PR|
+^^^^^^^^^^^^^^^^^^^
+
+If |RCM| cannot safely merge the changes in a |pr|,
+usually due to conflicts, you need to manually merge the changes on the
+command line. You can see more information for each |repo| type at the
+following links:
+
+* `Git Manual Merging`_
+* `Mercurial Manual Merging`_
+* `Subversion Manual Merging`_
+
+.. _Git Manual Merging: http://git-scm.com/book/en/v2/Git-Branching-Basic-Branching-and-Merging
+.. _Mercurial Manual Merging: http://hgbook.red-bean.com/read/a-tour-of-mercurial-merging-work.html
+.. _Subversion Manual Merging: http://svnbook.red-bean.com/en/1.7/svn.branchmerge.basicmerging.html

docs/collaboration/notifications-overview.rst

@@ -0,0 +1,22 @@
+Notifications Overview
+----------------------
+
+|RCM| has an integrated notification system which alerts users to requests
+that they have received. Notifications can occur for the following reasons:
+
+* Pull request reviews
+* Commit message mentions
+
+When someone opens a |pr| on one of your |repos|, or adds you as a |pr|
+reviewer, you will receive a notification in |RCE| and an email,
+if not configured see :ref:`set-up-mail`. Also, during the review process you
+receive notifications on the following actions:
+
+* New comments
+* Status changes
+* Inline code review comments
+
+Each notifications provides a link to take you directly to the issue.
+
+.. image:: ../images/notifications.png
+   :alt: Notifying Colleagues

docs/collaboration/open-pull-request.rst

@@ -0,0 +1,34 @@
+.. _open-requests-ref:
+
+Open a |pr|
+-----------
+
+.. important::
+
+   To open a |pr|, it is necessary that the source and the target repositories
+   have at least one commit in common. For more information,
+   see :ref:`merging-empty-repo-ref`.
+
+
+Once you have finished your work on a fork and want your work merged with the
+original |repo|, you need to open a |pr|. To open a |pr| and send for
+review, use the following steps:
+
+1. Select
+   :menuselection:`Admin --> repositories --> repo name --> Options --> Create Pull Request`
+2. On the :guilabel:`New Pull Request` page, enter the following information:
+
+   * The |pr| name.
+   * The |pr| description.
+   * Add the reviewer names in the :guilabel:`Pull Request Reviewer` field.
+
+3. Review the changesets that make up the |pr|.
+4. Select :guilabel:`Submit Pull Request`.
+
+.. image:: ../images/open-pr.png
+   :alt: Open a pull request
+
+The pull request can either be merged into the original repository,
+or it can be declined due to issues during the review process. If issues
+arise, you can fix them and update the |pr|. For more,
+see :ref:`update-requests-ref`.

docs/collaboration/pr-flow.rst

@@ -0,0 +1,7 @@
+Pull Request Workflow
+---------------------
+
+The following diagram represents a standard pull request workflow.
+
+.. image:: ../images/pull-request-flow.png
+   :align: center