Howto Nginx + git-http-backend + fcgiwrap (Debian Squeeze)

Question

I am trying to setup git-http-backend with Nginx but after 24 hours wasting time and reading everything I could I think this config should work but doesn't.

server {
   listen   80;
   server_name  mydevserver;
   access_log /var/log/nginx/dev.access.log;
   error_log /var/log/nginx/dev.error.log;

location / {
   root  /var/repos;
}

location ~ /git(/.*) {
   gzip off;
   root /usr/lib/git-core;

   fastcgi_pass  unix:/var/run/fcgiwrap.socket;
   include /etc/nginx/fastcgi_params2;

   fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
   fastcgi_param DOCUMENT_ROOT /usr/lib/git-core/;
   fastcgi_param SCRIPT_NAME git-http-backend;

   fastcgi_param GIT_HTTP_EXPORT_ALL "";
   fastcgi_param GIT_PROJECT_ROOT /var/repos;
   fastcgi_param PATH_INFO $1;
   #fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
}
}

Content of /etc/nginx/fastcgi_params2

    fastcgi_param  QUERY_STRING       $query_string;
    fastcgi_param  REQUEST_METHOD     $request_method;
    fastcgi_param  CONTENT_TYPE       $content_type;
    fastcgi_param  CONTENT_LENGTH     $content_length;

    fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
    fastcgi_param  REQUEST_URI        $request_uri;
    fastcgi_param  DOCUMENT_URI       $document_uri;
    fastcgi_param  DOCUMENT_ROOT      $document_root;
    fastcgi_param  SERVER_PROTOCOL    $server_protocol;

    fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
    fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

    fastcgi_param  REMOTE_ADDR        $remote_addr;
    fastcgi_param  REMOTE_PORT        $remote_port;
    fastcgi_param  SERVER_ADDR        $server_addr;
    fastcgi_param  SERVER_PORT        $server_port;
    fastcgi_param  SERVER_NAME        $server_name;
    fastcgi_param  REMOTE_USER        $remote_user;

    # required if PHP was built with --enable-force-cgi-redirect
    fastcgi_param  REDIRECT_STATUS    200;

but config seems not working

    $ git clone http://mydevserver/git/myprojectname/
    Cloning into myprojectname...
    warning: remote HEAD refers to nonexistent ref, unable to checkout.

and I can request an unexistant project and I will get the same answer

    $ git clone http://mydevserver/git/thisprojectdoesntexist/
    Cloning into thisprojectdoesntexist...
    warning: remote HEAD refers to nonexistent ref, unable to checkout.

If I change root to /usr/lib I will get a 403 error and this will be reported to nginx error log:

    2011/11/23 15:52:46 [error] 5224#0: *55 FastCGI sent in stderr: "Cannot get script
    name, is DOCUMENT_ROOT and SCRIPT_NAME set and is the script executable?" while
    reading response header from upstream, client: 198.168.0.4, server: mydevserver,
    request: "GET /git/myprojectname/info/refs HTTP/1.1", upstream:
    "fastcgi://unix:/var/run/fcgiwrap.socket:", host: "mydevserver"

My main trouble is with the correct root value with this configuration. Maybe there are some permissions problems.

Notes:

• /var/repos/ is owned by www-data and contains folders bit git bare repos.

• All this works perfectly using ssh.

• If I go with my browser to http://mydevserver/git/myproject/info/refs it is answered by git-http-backend asking me to send a command.

• /var/run/fcgiwrap.socket has 777 permissions.

Solution 1

move down fastcgi_pass ; it should be the latest line.

First you should set parameters, only then fastcgi_pass, otherwise you will not get set environment.

fastcgi_pass unix:/var/run/fcgiwrap.socket;

Solution 2

Try to change the order between the two lines in your config file:

include /etc/nginx/fastcgi_params2;

fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;

Solution 3

This is probably a bug with the version of fcgiwrap found on debian squeeze (1.0-1+squeeze1). See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698071

Upgrading to fcgiwrap 1.0.3-3 (found in debian testing) solved the issue for me. Here is the config I used (note I did not need to define "root"):

server {
    listen   80;
    server_name  mydevserver;
    access_log /var/log/nginx/dev.access.log;
    error_log /var/log/nginx/dev.error.log;

    location ~ /git(/.*) {
        gzip off;
        fastcgi_pass  unix:/var/run/fcgiwrap.socket;
        include /etc/nginx/fastcgi_params2;
        fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
        fastcgi_param GIT_HTTP_EXPORT_ALL "";
        fastcgi_param GIT_PROJECT_ROOT /var/repos;
        fastcgi_param PATH_INFO $1;
    }
}

Comments

[Derek Mahar]

In case you're curious, stackoverflow.com/a/40313590/107158 illustrates how to configure git-http-backend to enable anonymous read access but authenticated write access.

[vicTROLLA]

This is not true, and is incongruent with how nginx works.