Tuesday, January 15, 2013

Apache with SSL, Subversion over HTTP / HTTPs, and Trac

IT will guide you through installation of Apache, HTTPS, Subversion and Trac, in order to have an (almost) complete development environment for your team.
It is divided in following steps
1. Installing Subversion
2. Installing Apache
3. Configuring Apache with SSL
4. Configuring Subversion with Apache (and SSL)
5. Installing Trac
Steps are voluntary isolated, and will require more operations than, for instance, issuing an "apt-get install trac" that will download and install all the packages in one step; but this will
Hopefully allow the readers to choose picking one section and forget about unneeded components.
I'll not explain what Subversion is, or what SSL is, etc. Ask google, for this info: I just say that for your software project you may need a server with those tools ready for your team.
Requirements
You need Ubuntu 9.04, in my case I used the "server edition" 64bit, while installing I used the minimal server mode pressing F4 to have a system as lighter as possible. But possibly
this tutorial should be valid for Debian and previous Ubuntu version; but I have not verified that: if you do, post a comment to report your experience.
Preparation
After installing your server you have to ensure that apt system is up to date with available software on the repositories. Type the following command:
$ sudo apt-get update
Upgrading installed packages may be a good idea to do now:
$ sudo apt-get upgrade
Answer yes if asked to download and install the upgrades.
1. Installing Subversion
From the command line type the command:
$ sudo apt-get install subversion
If everything went fine you should able to verify the Subversion version installed with following command:
$ svn --version
svn, version 1.5.4 (r33841)
compiled Aug 7 2009, 02:02:06
Copyright (C) 2000-2008 CollabNet.
Subversion is open source software, see http://subversion.tigris.org/
This product includes software developed by CollabNet (http://www.Collab.Net/).
The following repository access (RA) modules are available:
* ra_neon : Module for accessing a repository via WebDAV protocol using Neon.
- handles 'http' scheme
- handles 'https' scheme
* ra_svn : Module for accessing a repository using the svn network protocol.
- with Cyrus SASL authentication
- handles 'svn' scheme
* ra_local : Module for accessing a repository on local disk.
- handles 'file' scheme
en.newinstance.it/2009/08/27/tutorial-ubuntu-904-apache-with-ssl-subversion-over-http-https-and-trac/ 2/13
For now, let's stop here: how to create the Subversion repository, configure the users etc. something on how to deal with svnserver, svnadmin, and user access control, in another article.
Later we will see how to create a repository, configure it with apache and HTTP basic authentication.
2. Installing Apache
To install apache 2 type the command:
$ sudo apt-get install apache2
When finished you should be able to connect with the browser at http://localhost and see the message "It works!". Or you may verify that at the command line installing and using curl:
$ sudo apt-get install curl
$ curl http://localhost
<html><body><h1>It works!</h1></body></html>
3. Configuring Apache with SSL
Now we want to configure apache to run HTTPs.
Following command will enable ssl Apache2 module with a2enmod (cryptic name for "Apache2 enable module":
$ sudo a2enmod ssl
The previous command will suggest you to restart apache to let it to reload the configuration; ignore that message for now.
We need to enable the HTTPS port (443). Edit /etc/apache2/ports.conf and ensure that port 443 is defined as follows:
$ sudo vi /etc/apache2/ports.conf
# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default
# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
# README.Debian.gz



NameVirtualHost *:80
Listen 80
<IfModule mod_ssl.c>
# SSL name based virtual hosts are not yet supported, therefore no
# NameVirtualHost statement here

NameVirtualHost *:443
Listen 443
</IfModule>
I added the clause NameVirtualHost *:443 in the for SSL; this is not strictly necessary but it will be useful later if you want to have a VirtualHost for trac and other development
Services.
Now we need to configure the SSL site. Fortunately we have already the configuration file for that, we just need to enable it with a2ensite (cryptic name for "apache2 enable site")
$ sudo a2ensite default-ssl
Again, the above command will suggest to reload apache configuration to activate the changes. This time the suggestion is almost right. As we made several changes I prefer to restart
apache with following command:
$ sudo /etc/init.d/apache2 restart
* Restarting web server apache2 apache2: Could not ... waiting apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName
If everything went fine you should see the above warning. You can ignore it, unless you want to configure the ServerName for your server. But this is out of scope, so do a search on
Google, or consult an Apache expert.
So, if everything went fine, now we should be able to connect to our server through SSL.
You can use firefox or curl, as before, but this time the URL will be https://localhost
$ curl -k https://localhost
<html><body><h1>It works!</h1></body></html>
The -k option is to ignore certification validation. Also firefox will complain that our certificate is invalid, but you can add it to exceptions and it will nomore bug you with those
Messages.
If everything went fine, now we should have Apache2, HTTP and HTTPs ready.
4. Configuring Subversion with Apache (and SSL)
First of all, we need to install the Subversion modules for Apache2.
$ sudo apt-get install libapache2-svn
They will be enabled by default. So you don't need to run a2enmod.
en.newinstance.it/2009/08/27/tutorial-ubuntu-904-apache-with-ssl-subversion-over-http-https-and-trac/ 3/13
We only need to configure a repository. Let' say our project is called 'myproject'.
First of all, let's decide where our svn repositories will be created. I like /var/local/svn :
$ sudo mkdir /var/local/svn
Then let's create the repository using following procedure:
$ sudo mkdir /var/local/svn/myproject
$ sudo chown www-data:www-data /var/local/svn/myproject
$ sudo -u www-data svnadmin create /var/local/svn/myproject
Above commands will ensure that the user www-data (which is the apache user) can fully access the repository for reading and updating it.
We need to configure the repository in Apache. Edit /etc/apache2/mods-available/dav_svn.conf using:
$ sudo vi /etc/apache2/mods-available/dav_svn.conf
And add a section like the following one:



<Location /svn/myproject>
DAV svn
SVNPath /var/local/svn/myproject
AuthType Basic
AuthName "My Project Subversion Repository"
AuthUserFile /etc/subversion/myproject.passwd
<LimitExcept GET PROPFIND OPTIONS REPORT>
Require valid-user
</LimitExcept>
</Location>

In the above file we indicated that, at the location svn our repository should respond. And for updating the repository we want a valid user. As per above configuration anonymous
consultation is allowed; but you can disable it commenting with a leading '#' the lines <LimitExcept ... and </LimitExcept> or just removing them as in following example:
<Location /svn/myproject>
DAV svn
SVNPath /var/local/svn/myproject
AuthType Basic
AuthName "My Project Subversion Repository"
AuthUserFile /etc/subversion/myproject.passwd
#<LimitExcept GET PROPFIND OPTIONS REPORT>
Require valid-user
#</LimitExcept>
</Location>

The above configuration indicates to Apache that even for consulting the repository we want a valid user.
But valid users need a password, and in fact we indicated a password file for our repository called /etc/subversion/myproject.passwd. So let's create a password file with a couple of
Users:
$ sudo htpasswd -c /etc/subversion/myproject.passwd luigi
$ sudo htpasswd /etc/subversion/myproject.passwd mario
The -c option indicates that the password file should be created as new; and it is only necessary for the first user. Be aware of the fact that -c overwrites the existing password file
Without asking anything. Personally I think this is a quite stupid behavior, but that's the way it is.
Now we should be ready.
Let's reload apache configuration to make the changes effective:
$ sudo /etc/init.d/apache2 reload
and let's test with the browser that our svn repository is now accessible through HTTP and HTTPs at following urls:
http://localhost/svn/myproject/
https://localhost/svn/myproject/
We can also use curl to verify it is working:
$ curl http://username:password@localhost/svn/myproject/
<html><head><title>myproject - Revision 0: /</title></head>
<body>
<h2>myproject - Revision 0: /</h2>
<ul>
</ul>
<hr noshade><em>Powered by <a href="http://subversion.tigris.org/">Subversion</a> version 1.5.4 (r33841).</em>
</body></html>
$ curl -k https://username:password@localhost/svn/myproject/
<html><head><title>myproject - Revision 0: /</title></head>
<body>
<h2>myproject - Revision 0: /</h2>
<ul>
</ul>
<hr noshade><em>Powered by <a href="http://subversion.tigris.org/">Subversion</a> version 1.5.4 (r33841).</em>
</body></html>
en.newinstance.it/2009/08/27/tutorial-ubuntu-904-apache-with-ssl-subversion-over-http-https-and-trac/ 4/13
Now we can also download our project using svn
$ svn co https://localhost/svn/myproject myproject --username luigi
"luigi" is obviously my username, substitute it with yours.
The first time it will prompt for accepting the SSL certificate, answer to accept it permanently (p). Then it will optionally ask you for the password, type it.
We can also test that modifying the remote repository is working with:
$ svn mkdir -m "created the trunk for the project" https://localhost/svn/myproject/trunk --username luigi
It will answer: Committed revision 1. If so, we've done.
5. Installing Trac
To install trac files and required dependencies, type the following command:
$ sudo apt-get install trac
$ sudo apt-get install libapache2-mod-python
Let's create the directories for trac web folder:
$ sudo mkdir /var/local/trac
$ sudo chown www-data:www-data /var/local/trac
edit Apache configuration file for one of your enabled sites (in this example I modify the default http one, but you can choose to put trac on HTTPS modifying default-ssl)
$ sudo vi /etc/apache2/sites-enabled/000-default
and add the following lines at the end of the file, before the </VirtualHost> tag:
<Location /projects>
SetHandler mod_python
PythonInterpreter main_interpreter
PythonHandler trac.web.modpython_frontend
PythonOption TracEnvParentDir /var/local/trac
PythonOption TracUriRoot /projects
PythonOption PYTHON_EGG_CACHE /tmp
</Location>
# use the following for one authorization for all projects
# (names containing "-" are not detected):
<LocationMatch "/projects/[[:alnum:]]+/login">
AuthType Basic
AuthName "trac"
AuthUserFile /etc/trac/trac.passwd
Require valid-user
</LocationMatch>
Create a password file for trac users (if you want you can reuse or link the passwd file used for subversion repositories)
$ sudo htpasswd -c /etc/trac/trac.passwd luigi
$ sudo htpasswd /etc/trac/trac.passwd Mario

... continue this way for all your users.
Create the trac environment for your project:
$ sudo -u www-data trac-admin /var/local/trac/myproject initenv
It will ask you some questions related to your project. Here's my answers in blue
Project Name [My Project]> My Project
Database connection string [sqlite:db/trac.db]> [Just press Enter to accept the default]
Repository type [svn]> [Just press Enter to accept the default]
Path to repository [/path/to/repos]> /var/local/svn/myproject
Now let's restart apache:
$ sudo /etc/init.d/apache2 restart
Check that trac works properly connecting the browser to http://localhost/projects or use curl to verify that the url is responding properly as we did before. This url should display a
Link to "My Project", click on it and you should see the project home page. Clicking on login the browser should ask you to provide username and password as recently defined with
htpasswd command.
Last thing to do: add yourself as administrator for Trac. This will enable the Admin menu and allow to do much of the administration operations from the web, that you could also do
At the command line with trac-admin tool.
Execute the following command:
$ sudo -u www-data trac-admin /var/local/trac/myproject permission add luigi TRAC_ADMIN
This will make the username 'luigi' administrator for the project