Configuring Subversion (revision 1.2)

Introduction

This page describes how Alexis Huxley installed and configured his front-end Apache web server to manage multiple Subversion repositories.

Procedure

  1. Set some environment variables: 
    WEBSITENAME=<name-of-website>  #  e.g. WEBSITENAME=svn.pasta.freemyip.com
  2. Clone the template components and create the log directory by running: 
    cp -ar /var/www/WEBSITENAME /var/www/$WEBSITENAME
sed "s/WEBSITENAME/$WEBSITENAME/g" \
        < /etc/apache2/sites-available/WEBSITENAME.conf \
        > /etc/apache2/sites-available/$WEBSITENAME.conf
sed "s/WEBSITENAME/$WEBSITENAME/g" \
        < /etc/apache2/sites-available/WEBSITENAME-ssl.conf \
        > /etc/apache2/sites-available/$WEBSITENAME-ssl.conf
mkdir /var/log/apache2/$WEBSITENAME
chown www-data:www-data /var/log/apache2/$WEBSITENAME
  3. For each Subversion respository, migrate repository content as follows:
    1. On the old subversion server run: 
      mv  <repo-path> <repo-path>.old
svnadmin dump <repo-path>.old > <repo-name>.dump
    2. Transfer the dump file from the server to the new one.
    3. On the new subversion server run: 
      svnadmin create <repo-path>.new
svnadmin load <repo-path>.new < <repo-name>.dump
chown -R www-data:www-data <repo-path>.new
mv <repo-path>.new <repo-path>
    4. Note that dumping is pretty quick but loading can take several hours.
  4. To block people checking what repositories exist, add something like the following to /etc/apache2/sites-available/$WEBSITENAME: 
    <LocationMatch ^/$>
    Deny from all
    Options None
    ErrorDocument 403 Forbidden.
</LocationMatch>
  5. For each public repositories (read-only unless authenticated), add something like the following to /etc/apache2/sites-available/$WEBSITENAME: 
    <Location /main>
    DAV svn
    SVNPath /svn/main
    <LimitExcept GET PROPFIND OPTIONS REPORT>
        AuthType Digest
        AuthName "Subversion Service"
        AuthBasicProvider file
        AuthUserFile /etc/apache2/subversion.htdigest
        Require valid-user
     </LimitExcept>
</Location>
  6. For each private repositories (no access unless authenticated), add something like the following to /etc/apache2/sites-available/$WEBSITENAME: 
    <Location /private>
    DAV svn
    SVNPath /svn/private
    AuthType Digest
    AuthName "Subversion Service"
    AuthBasicProvider file
    AuthUserFile /etc/apache2/subversion.htdigest
    Require valid-user
</Location>
  7. f you want to use LDAP authentication, then:
    1. Replace: 
      AuthType Digest
AuthName "Subversion Service"
AuthBasicProvider file
AuthUserFile /etc/apache2/subversion.htdigest
Require valid-user

      with:

      AuthType Basic
AuthName "Subversion Service"
AuthBasicProvider ldap
AuthLDAPUrl ldap://ziti.pasta.net/ou=Users,dc=pasta,dc=net?uid
Require valid-user
    2. Adjust AuthLDAPUrl accordingly (see here for more details)
    3. Run: 
      a2enmod authnz_ldap ldap
  8. Check that the repository paths, as mentioned in the Apache configuration are accessible.
  9. Create /var/www/$WEBSITENAME/robots.txt containing: 
    User-agent: *
Disallow: /svn/
  10. Enable the required modules and the website with: 
    apt -y install subversion libapache2-mod-svn
a2enmod auth_digest
a2ensite $WEBSITENAME
a2ensite $WEBSITENAME-ssl
systemctl restart apache2
  11. Before proceeding, make sure that:
    1. the old repositories are renamed so as to be inaccessible
    2. the svnadmin load commands have finished
    3. the chown commands on the new repositories have been run

    (This reminder is here because it is probable that I would continue with this installation with the svadmin load commands running in parallel).

  12. Configure HTTPS access as described at Setting up Lets Encrypt (revision 2.1).
  13. As a test attempt to update all working copies.

A note on client-side plain-text password stores

In Subversion 1.12, support for plain-text password stores was disabled by default at compile time. This is extensively discussed here. The upshot is that if you want to cache a password in plain-text then you should:

  1. Run: 
    cd /tmp
wget https://svn.pasta.freemyip.com/main/smalltools/trunk/bin/svn-cache-passwd
chmod 755 svn-cache-passwd
./svn-cache-passwd <repo-url>

    and follow the prompts.

See also