setup gerrit/git server in centos 7

gerrit_server_setup.txt
Longbin <beangr@163.com>
2014-10-23

+------------------------------------------------+
| Install mysql database and setup gerrit server |
+------------------------------------------------+

1. install git, openjdk-6-jdk, apache2(httpd), mysql-server, openssl

2. install postfix /* a mail server */

3. config database mysql;
    # install mariadb-server
    /* for CentOS 7 the mariadb had replaced the mysql as the default db */
    # systemctl enable mariadb.service
    # systemctl start mariadb.service
    first of all initialize root user's passwd;
    $ /usr/bin/mysqladmin -u root password 'new-password'
    then copy the file mysql_cfg_script.txt to the terminal to configure the mysql, note that replace the passwd of the real passwd phrase;
    $ mysql -u root -p
-----------------------------/*
CREATE USER 'gerrit2'@'localhost' IDENTIFIED BY 'Gerrit2_passwd';
CREATE DATABASE reviewdb;
ALTER DATABASE reviewdb charset = latin1;
GRANT ALL ON reviewdb.* TO 'gerrit2'@'localhost';
FLUSH PRIVILEGES;
exit;
-----------------------------*/
/*
To delete the database created by above step, can use command
> drop user 'gerrit2'@'localhost';
> drop database reviewdb;
OR delete the /var/lib/mysql, then initialize the mysql database again;
*/

4. setup gerrit server

A create a group and user for gerrit:
    #groupadd gerrit2
    #useradd -r -m -d /home/gerrit2 -s /bin/bash -g gerrit2 gerrit2
    ##passwd gerrit2 #please do not excute this line, or you will be regretful for what you have done.

B install gerrit server
    #sudo su gerrit2
    #cd
    /* download the installation source file gerrit-*.war */
    #wget http://gerrit.google.com/files/gerrit-full-2.5.2.war

可以到以下地址直接下载 http://pan.baidu.com/s/1qWr0wxA 密码：u5lz

直接将该文件复制到对应目录，并将bcprov-jdk16-144.jar和mysql-connector-java-5.1.10.jar复制到gerrit server将要安装的目录的lib文件夹

    #java -jar gerrit-full-2.5.2.war init -d /home/gerrit2/review_site

--------------------------------------------------------------------------------/*
*** Gerrit Code Review 2.9.1
***
*** Git Repositories
***
Location of Git repositories   [git]:
*** SQL Database
***
Database server type           [h2]: MYSQL
Server hostname                [localhost]:
Server port                    [(mysql default)]:
Database name                  [reviewdb]:
Database username              [gerrit2]:
gerrit2's password             :
              confirm password :
*** Index
***
Type                           [LUCENE/?]:
The index must be rebuilt before starting Gerrit:
  java -jar gerrit.war reindex -d site_path
*** User Authentication
***
Authentication method          [OPENID/?]: HTTP
Get username from custom HTTP header [y/N]?
SSO logout URL                 :
*** Review Labels
***
Install Verified label         [y/N]?
*** Email Delivery
***
SMTP server hostname           [localhost]:
SMTP server port               [(default)]:
SMTP encryption                [NONE/?]:
SMTP username                  :
*** Container Process
***
Run as                         [gerrit2]:
Java runtime
[/usr/lib/jvm/java-1.7.0-openjdk-1.7.0.65.x86_64/jre]:
Upgrade /home/gerrit2/review_site/bin/gerrit.war [Y/n]?
Copying gerrit-2.9.1.war to /home/gerrit2/review_site/bin/gerrit.war
*** SSH Daemon
***
Listen on address              [*]:
Listen on port                 [29418]:
Generating SSH host key ... rsa(simple)... done
*** HTTP Daemon
***
Behind reverse proxy           [y/N]? y
Proxy uses SSL (https://)      [y/N]?
Subdirectory on proxy server   [/]:
Listen on address              [*]:
Listen on port                 [8081]: 8080
Canonical URL                  [http://localhost/]:
*** Plugins
***
Install plugin commit-message-length-validator version v2.9.1 [y/N]?
Install plugin download-commands version v2.9.1 [y/N]?
Install plugin replication version v2.9.1 [y/N]?
Install plugin reviewnotes version v2.9.1 [y/N]?
Install plugin singleusergroup version v2.9.1 [y/N]?
Initialized /home/gerrit2/review_site
--------------------------------------------------------------------------------*/
    note that:
Database server type           [H2/?:]: MYSQL
gerrit2's password                       /* input the passwd created by mysql when creating reviewdb */
Authentication method          [OPENID/?:]: HTTP
Behind reverse proxy           [y/N]? Y /* set reverse proxy */
Proxy uses SSL (https:)        [y/N]?    /* select yes is not essential for us */
Canonical URL                  [http://localhost/]: /* not http://localhost:8080 */

------------/home/gerrit2/etc/gerrit.config------------------------------------------
[gerrit]
        basePath = git
        canonicalWebUrl=http://localhost/
[database]
        type = MYSQL
        hostname = localhost
        database = reviewdb
        username = gerrit2
[auth]
        type = HTTP
[sendemail]
        smtpServer = localhost
[container]
        user = gerrit2
        javaHome = /usr/lib/jvm/java-1.7.0-openjdk-1.7.0.71-2.5.3.1.el7_0.x86_64/jre
[sshd]
        listenAddress = *:29418
[httpd]
        listenUrl = proxy-http://*:8081/
[cache]
        directory = cache
-------------------------------------------------------------------------------------
    
then rebuild index of db for gerrit-2.9
    $ java -jar /home/gerrit2/review_site/bin/gerrit.war reindex -d /home/gerrit2/review_site/

B generate a default configure file for gerrit and fullfill the information "GERRIT_SITE=/home/gerrit2";
    #vi /etc/default/gerritcodereview

--------------------------------------/*
GERRIT_SITE=/home/gerrit2/review_site/
--------------------------------------*/

C check the gerrit server
    gerrit2@localhost $ ./bin/gerrit.sh start
    Starting Gerrit Code Review: OK
    If you could see the message above, the gerrit server works correctly;

D check gerrit ssh port and gerrit web port
    #netstat -ltpn | grep -i gerrit
tcp    0   0 :::8080     :::*    LISTEN   3185/GerritCodeRevi
tcp    0   0 :::29418    :::*    LISTEN   3185/GerritCodeRevi

5.config web server apache

A install web server and set reverse proxy;

--------------ubuntu-----------------------------/*
$ sudo a2enmod ssl
$ sudo a2enmod proxy_http
$ sudo mkdir /etc/apache2/ssl
$ sudo openssl req -new -x509 -days 365 -nodes -out
/etc/apache2/ssl/apache.pem -keyout /etc/apache2/ssl/apache.key

configure web server for gerrit
    modify the default file /etc/apache2/httpd.conf
-------------------------------------------------*/

---------------centos-----------------------/*
    # yum install httpd
    # touch /etc/httpd/conf.d/gerrit_proxy.conf
    # vim /etc/httpd/conf.d/gerrit_proxy.conf
******************************
ServerName localhost
<VirtualHost *:80>
    ProxyRequests Off
    ProxyVia Off
    ProxyPreserveHost On
<Proxy *>
    Order deny,allow
    Allow from all
</Proxy>
<Location /login/>
    AuthType Basic
    AuthName "Gerrit Code Review"
    Require valid-user
    AuthBasicProvider file
    AuthUserFile /etc/httpd/.passwords
</Location>
    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/
</VirtualHost>
******************************
    then restart the apache, as CentOS 7 # systemctl restart httpd.service
    check the error_log file /etc/httpd/logs/error_log
    set the security level settings
    #/usr/sbin/setsebool -P httpd_can_network_connect 1
-------------------------------------------*/

B create accounts for http authentication, or we will see "Internal server error"
    $ sudo su gerrit2
    $ cd
    $ cd review_site
    /* create the /etc/httpd/.passwords file and create the first account */
    $ htpasswd -cb /etc/httpd/.passwords username userpasswd
    /* the -c optional means create a new file; */
    /* add a new account to the passwords file */
    $ htpasswd /etc/httpd/.passwords username
    /* the optional -b means Use the password from the command line rather than prompting for it; */
    OR
    $ htpasswd –b /etc/httpd/.passwords username userpasswd

C test web server
    http://localhost

D test web server for gerrit use the account created by step 5-B;

6. set email for user
    $ sudo su gerrit2
    $ cd
    $ cd review_site
    $ java -jar bin/gerrit.war gsql
    gerrit> select * from account_external_ids; /* get the information of gerrit database; */
    /* configure Admin's email */
    gerrit> update account_external_ids set email_address = 'email@xx.com' where account_id = your_acc_id ;

    /* configure Admin's passwd, this step can be ignored; bacause the
     * authencation could be NULL, and user login the web by the passwd
     * generated by htpasswd */
    gerrit> update account_external_ids set password = 'admin' where account_id = 1;
    gerrit> \d    /* display all table of the database */
    gerrit> insert into account_group_members (account_id, group_id) values (1, 1); /* add member to a group */
    gerrit> \q

7. use the account to login the website and fullfill information;
    the first login account is the http authentication account, then close the web brawser and open it again; the current account is the administrator account of the gerrit server;


+-----------------------+
| How to add a new user |
+-----------------------+

1. Admin user this command to generate passwd
    #htpasswd /etc/httpd/.passwords newuser

2. user uses the account created by above step to open http://localhost
    then fullfill fullname, and contact infomation, that is email;

3. Admin login mysql to add email to the database following step 6;


+-----------------------------+
| add ssl certificate support |
+-----------------------------+
These steps are not essential, if you select no when notice "Proxy uses SSL (https://)      [y/N]?";

1. install openssl

2. verify if the configure file /etc/httpd/conf/httpd.conf include mod_ssl.so module;
    # yum -y install mod_ssl mod_wsgi
    then verify the conf.d/ssl.conf file, if there exists the following sentence
    LoadModule ssl_module modules/mod_ssl.so

3. generate ithe key and ceriticate file
    # cd /etc/httpd/
    # mkdir ssl
    # cd ssl
A generate a key
    $ openssl genrsa 1024 > server.key
B create to request file
    $ openssl req -new -key server.key > server.csr
C generate a certificate file
    $ openssl req -x509 -days 365 -key server.key -in server.csr > server.crt

4. verify following sentences in /etc/httpd/conf.d/ssl.conf
-------------------------------------------------/*
SSLCertificateFile /etc/httpd/ssl/server.crt
SSLCertificateKeyFile /etc/httpd/ssl/server.key
-------------------------------------------------*/
    add following sentences to conf.d/ssl.conf file
-------------------------------------------------/*
<Location /login/>
    AuthType Basic
    AuthName "Gerrit Code Review"
    Require valid-user
    AuthBasicProvider file
    AuthUserFile /etc/httpd/.passwords
</Location>
    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/
-------------------------------------------------*/

notice
    Log file and "man" are very important for us working under Linux;