From aae1a14ea756102251351d96e2567b4986d30e2b Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 16:17:27 +0200 Subject: Adding upstream version 3.6.12. Signed-off-by: Daniel Baumann --- contrib/lib/Apache/gitolite.conf | 47 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 contrib/lib/Apache/gitolite.conf (limited to 'contrib/lib/Apache/gitolite.conf') diff --git a/contrib/lib/Apache/gitolite.conf b/contrib/lib/Apache/gitolite.conf new file mode 100644 index 0000000..87ba843 --- /dev/null +++ b/contrib/lib/Apache/gitolite.conf @@ -0,0 +1,47 @@ +# Apache Gitolite smart-http install Active Directory Authentication + +# Author: Jonathan Gray + +# It is assumed you already have mod_ssl, mod_ldap, & mod_authnz configured for apache +# It is also assumed you are disabling http on port 80 and requiring the use of https on port 443 + +# Boiler plate configuration from the smart-http deployment documentation script +# Adjust paths if you use something other than the default +SetEnv GIT_PROJECT_ROOT /var/www/gitolite-home/repositories +ScriptAlias /git/ /var/www/gitolite-home/gitolite-source/src/gitolite-shell/ +ScriptAlias /gitmob/ /var/www/gitolite-home/gitolite-source/src/gitolite-shell/ +SetEnv GITOLITE_HTTP_HOME /var/www/gitolite-home +SetEnv GIT_HTTP_EXPORT_ALL + +# Setup LDAP trusted root certificate from your domain +LDAPTrustedGlobalCert CA_BASE64 /etc/httpd/conf.d/domain.ca.cer + +# In case you havn't setup proper SSL certificates in ssl.conf, go ahead and do it here to save headache later with git +SSLCertificateFile /etc/httpd/conf.d/gitolite.server.crt +SSLCertificateKeyFile /etc/httpd/conf.d/gitolite.server.key +SSLCertificateChainFile /etc/httpd/conf.d/DigiCertCA.crt + + + Order deny,allow + # In case you want to restrict access to a given ip/subnet + #Allow from my.ip.range/cidr + #Deny from All + AuthType Basic + AuthName "Git" + AuthBasicProvider ldap + AuthUserFile /dev/null + AuthzLDAPAuthoritative on + AuthLDAPURL ldaps://AD.DC1.local:3269 AD.DC2.local:3269 AD.DC3.local:3269/?sAMAccountName?sub + AuthLDAPBindDN git@domain.local + AuthLDAPBindPassword super.secret.password + AuthLDAPGroupAttributeIsDN on + + # You must use one of the two following approaches to handle authentication via active directory + + # Require membership in the gitolite users group in AD + # The ldap-filter option is used to handle nested groups on the AD server rather than multiple calls to traverse from apache + # Require ldap-filter memberof:1.2.840.113556.1.4.1941:=cn=Gitolite Users,ou=Security Groups,dc=domain,dc=local + + # Alternatively, require a valid user account only since you're going to control authorization in gitolite anyway + Require valid-user + -- cgit v1.2.3