Sécurité, Performance
et Haute Disponibilité
Configuring subversion access over HTTP/DAV

Subversion repositories can be served by the Apache web server over the HTTP protocol (extended by WebDAV/DeltaV). The benefits of this system include high performance, fine-grained permission control, SSL support, alternative authentication modes and more. It is the solution of choice if your are behind a company firewall since it uses only standard HTTP or HTTPS connections. Repository content can also be accessed seamlessly from the web.

This method requires the use of a dedicated Apache server instance (described here), which is available to our Hôte-Avancé and Hôte-Corporatif customers.

Creating the repository

If you have not created any Subversion repositories yet, you can create one with svnadmin:

  $ svnadmin create ~/my-repository
Adding mod_dav_svn to your httpd

Simply copy /usr/local/lib/apache2/mod_dav_svn.so to your Apache modules directory:

  $ cp /usr/local/lib/apache2/mod_dav_svn.so ~/apache/modules

And add to httpd.conf:

  LoadModule dav_svn_module modules/mod_dav_svn.so

If you plan to use fine-grained permissions, load mod_authz_svn.so as well:

  LoadModule authz_svn_module modules/mod_authz_svn.so
Configuring access to repositories

HTTP access to your repositories is defined using a <Location> section in your httpd.conf.

  <Location /myproject>
    DAV svn
    SVNPath /home/myself/myrepos/myproject
    AuthType Basic
    AuthName "My project"
    AuthUserFile /home/myself/private/myproject.pw
    Order deny,allow
    <LimitExcept GET PROPFIND OPTIONS REPORT>
      Require valid-user
    </LimitExcept>
  </Location>

This entry would grant read-only access to everyone and write access to every user AuthUserFile. You can use the htpasswd utility to create or update this file, as described here.

The next entry grants read/write access to users in the AuthUserFile, and no access to anyone else.

<Location /myproject>
  DAV svn
  SVNPath /home/myself/myrepos/myproject
  AuthType Basic
  AuthName "My project"
  AuthUserFile /home/myself/private/myproject.pw
  Order deny,allow
  Require valid-user
</Location>

The previous examples all define access on a per-repository basis. It is also possible to grant access from specific users to specific areas of the repository, using fine-grained permissions.

Testing the repository

Using either a remote Subversion client or the standard svn command from your shell, you can generate your working copy of the repository with the checkout command. If you are accessing public data over a read-only account, you can use a standard http URL:

  $ svn co http://your-domain/myproject/

If you are accessing private data or using a read/write account, make sure to use an https URL:

  $ svn co https://your-domain/myproject/

The contents of public repositories are also accessible from a web browser. Keep in mind that search engines will try to index any public data, so you may want to use a robots.txt file.

Using fine-grained permissions (optional)

You can allow or deny specific users read/write privileges on specific items within a repository using AuthzSVNAccessFile. If you use this directive, make sure the mod_authz_svn module is loaded.

  <Location /repos>
    DAV svn
    SVNPath /home/myself/myrepos
    
    # Access Control via the authz module.
    AuthzSVNAccessFile /home/myself/private/myrepos.acl
    # Anonymous access is allowed. Prompt as needed.
    Satisfy Any
    Require valid-user
    AuthType Basic
    AuthName "My subversion repositories"
    AuthUserFile /home/myself/private/myrepos.pw
  </Location>

The file specified in AuthzSVNAccessFile is a plain text file which defines fine-grained access lists. Note that all path names specified are relative to the SVNPath.

  #
  # Allow anonymous read access to everything by default.
  #
  [/]
  * = r
  
  #
  # Grant alice and bob write access to all of /myproject1/.
  #
  [/myproject]
  * = r
  alice = rw
  bob = rw
  
  #
  # Grant carol and charlie write access to only /myproject/foo
  #
  [/myproject/foo]
  carol = rw
  charlie = rw

Links


  Contre les brevets logiciels!