the whys
I’ve planned to play with one or another source code management platform since quite a time, but only recently have found enough time to actually try it.
My criteria were very far from professional: I was looking for a project that:
- is functional enough that using it instead of github won’t be too much of a pain,
- is easy enough to install (from zero to functional installation in five hours time tops, and that including reading the documentation for the first time),
- runs well on apache (because I already have a reasonably well-configured apache instance running),
- works with mysql (like with the apache, I already have well-tuned mysql instance),
- last but not least, relies on packaged software only (because I am lazy)
That unfortunately ruled out redmine and all ruby-on-rails-based github clones out there, including the otherwise appealing gitorious. The most interesting contender from the python side of the world – rhodecode – switched from free software to closed source, and the only other name I remembered was phabricator.
I’ve heard about the project for the first time during one of Facebook Dublin’s Infrastructure Open House meetings and it definitely piqued my interest then – it is, basically, an integrated software engineering platform that’s used by Facebook internally to manage all their code. It is also an open source project available under Apache licence. Written in well-managed PHP, it runs – or is advertised to run – on almost everything.
the hows
Upstream guides for both installation and setup are quite good, notes below handle the differences.
difference #1: apache + mod_fcgid + worker mpm
I have mod_fcgid configured to use a wrapper script from a directory that’s mapped to the /fcgi-bin alias:
<IfModule mod_fcgid.c>
⋮
AddType application/x-php php phtml php3
AddType application/x-php-source phps
AddHandler php-fcgid .php
Action php-fcgid /fcgi-bin/php-fcgi-wrapper
Alias /fcgi-bin/ /var/www/fcgi-bin.d/php5-default/
<FilesMatch ".+\.ph(p[345]?|t|tml)$">
SetHandler php-fcgid
</FilesMatch>
<Location /fcgi-bin/>
SetHandler fcgid-script
Options +ExecCGI
</Location>
⋮
</IfModule>
For Phabricator to work with this configuration you have to add the first rewrite rule, to make sure that the fcgi invocations will not be touched – if the path to the fcgi handler is not whitelisted, the last rule with its greedy regex will break the php fcgi execution.
<VirtualHost>
⋮
RewriteRule ^/fcgi-bin - [L]
RewriteRule ^/rsrc/(.*) - [L,QSA]
RewriteRule ^/favicon.ico - [L,QSA]
RewriteRule ^(.*)$ /index.php?__path__=$1 [B,L,QSA]
⋮
</VirtualHost>
difference#2: managing phd through init daemon
I’m using the following service file to keep the phd services up:
[Unit]
Description=the phabricator daemon service
After=syslog.target network.target remote-fs.target nss-lookup.target
[Service]
Type=forking
WorkingDirectory=/srv/blueprint/phabricator/bin
ExecStart=/srv/blueprint/phabricator/bin/phd start
ExecStop=/srv/blueprint/phabricator/bin/phd stop
Restart=always
User=phd
Group=phd
[Install]
WantedBy=multi-user.target
difference#3: make diffusion’s ssh service listen on a custom port
I’m using ‘vcs’ as the user name and decided to run customised ssh service listening on ports 22 and 2401 on a dedicated IP to manage the ssh-based VCS operations. (The openssh-server package from wheezy backports is needed for the AuthorizedKeysCommand support.)
/etc/systemd/system/phabricator-ssh.service:
[Unit]
Description=phabricator ssh service
After=network.target auditd.service phd.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
[Service]
EnvironmentFile=-/etc/default/phabricator
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
[Install]
WantedBy=multi-user.target
Alias=phabricator-sshd.service
/etc/default/phabricator-ssh:
# (line breaks for clarity)
SSHD_OPTS="-f /etc/ssh/sshd_config_phabricator \
-h /etc/ssh/ssh_host_dsa_key \
-h /etc/ssh/ssh_host_rsa_key \
-h /etc/ssh/ssh_host_ecdsa_key"
/etc/ssh/sshd_config_phabricator:
# NOTE: You must have OpenSSHD 6.2 or newer; support for AuthorizedKeysCommand
# was added in this version.
AuthorizedKeysCommandUser vcs
AuthorizedKeysCommand /usr/local/lib/phabricator/bin/ssh-hook
AllowUsers vcs
# You may need to tweak these options, but mostly they just turn off everything
# dangerous.
ListenAddress 144.76.160.154:22
ListenAddress 144.76.160.154:2401
ListenAddress [2a01:4f8:200:20e2:1::c]:22
ListenAddress [2a01:4f8:200:20e2:1::c]:2401
Protocol 2
PermitRootLogin no
AllowAgentForwarding no
AllowTcpForwarding no
PrintMotd no
PrintLastLog no
PasswordAuthentication no
AuthorizedKeysFile none
PidFile /var/run/phabricator-sshd.pid
the results
Fully featured phabricator installation, with git, mercurial and svn available through https and ssh protocols, project/task management, wiki, pastebin clone etc., with LDAP and github account integration.
Not too bad for a Sunday afternoon project, if I may say so myself.
