Plan for hosting git repos

[zarvox]

Phabricator supports exporting repositories over both SSH and HTTP.

Sandstorm does not currently provide a good way for apps to listen for SSH connections. There's some powerbox stuff and the server-admin-only IpInterface capability, but this isn't available on Oasis, and we haven't ironed out the interface or made this ergonomic to use.

This leaves us with hosting repositories over HTTP. https://secure.phabricator.com/book/phabricator/article/diffusion_hosting/#configuring-http indicates that this is only supported with HTTP Basic Auth with a separate "VCS Password".

Sandstorm will strip any Authorization headers before giving the request to the app, but on the other hand, it will have already authenticated the request. So we should:

• patch authenticateHTTPRepositoryUser() in phabricator/src/applications/diffusion/controller/DiffusionServeController.php to look for the Sandstorm headers to authenticate the user, rather than using the VCS Password
• have users generate a webkey to use as the password when cloning the repo, ideally using offer templates with forSharing: false to give useful copy-paste-able instructions

[liamzdenek]

I've got the basics worked out in c3bf89cb460f510d909f779df99e4581ba37fe0b. This commit ties DiffusionServeController.authenticateHTTPRepositoryUser() into PhabricatorSandstormAuthProvider. The authorization is all set up properly.

At this point, the repository on-disk has to be set up manually by entering the grain, cd /var/assets/repos and git init --bare 1 (or whichever folder is specified under Storage in the web UI). I believe this may be a bug affecting phd (PHabricator Daemons), but I haven't looked into it much -- maybe permissions.

After the repository is set up, a web token should be generated. No special permissions are required.

The token is presented in the following format: http://$domain#$token

The correct command to run is: git clone http://$username:$token@$domain/diffusion/$CALLSIGN/$shortsign.git where: $username is arbitrary -- i would recommend using your SS handle $CALLSIGN is the all-uppercase callsign from the web UI $shortsign is the all-lowercase shortsign from the web UI

Pending tasks before this issue is resolved:

• init the repository on disk correctly/automatically
• use offer templates to present the correct token or otherwise have not misleading commands presented to the user within Phabricator

[liamzdenek]

I spun up a dedicated Phabricator instance in order to test how things "should" be. I had a suspicion my recent commit (0505a5fb16eb685633752f6487238eb2d1b679c1) was going down the wrong path. I shouldn't have to manually initialize the git repo on disk. In the dedicated Phabricator instance, I observed that the web-facing PHP did not create the repository, but, after a short delay, (10-15s or so) the repository would appear with the hooks installed. I believe this is the doing of the Phabricator Daemons. Since this is not happening within sandstorm, it must be a misconfiguration -- either in the environment variables or in the permissions. Back to Sq. 1

[liamzdenek]

Resolved in 9506c530e9516e38f12b535e1148646aed5c3e3b