Comments on: Running Mercurial with FastCGI in nginx

By: wumzi

wumzi — Wed, 21 Jul 2010 15:10:13 +0000

Great how-to !

Thanks !

By: Peter

Peter — Sat, 17 Oct 2009 08:24:24 +0000

You are right. Thanks for pointing out the error!

I updated the posting.

By: seth

seth — Sat, 17 Oct 2009 02:12:02 +0000

To answer my own problem.

The executable bit needs to be set on hgwebdir.fcgi
(chmod +x hgwebdir.fcgi)

Otherwise we get:
spawn-fcgi: child exited with: 2

Also (I could be incorrect), but instead of:
chmod -R www-data.www-data /tmp/hgtest

I think it was meant to be:
chown -R www-data.www-data /tmp/hgtest

Thanks for the great post!

By: seth

seth — Fri, 16 Oct 2009 23:06:16 +0000

After running

spawn-fcgi -a 127.0.0.1 -p 9001 -u www-data -g www-data -f /tmp/hgwebdir.fcgi -P /var/run/fastcgi-mercurial.pid -C 1

I get the following

spawn-fcgi: child exited with: 2

Any thoughts?

By: Michael Papenbrock

Michael Papenbrock — Tue, 15 Sep 2009 09:01:49 +0000

It’s running!!! Thank you very much!

By: Peter

Peter — Mon, 14 Sep 2009 14:58:18 +0000

Thanks, I forgot to mention this modification in my howto. The posting is now updated.

By: Markus Papenbrock

Markus Papenbrock — Mon, 14 Sep 2009 14:53:53 +0000

I ran into problems where an empty repository list was shown.
To solve this, you have to edit the file /tmp/hgwebdir.fcgi
Replace this line at the bottom:
WSGIServer(hgwebdir('hgweb.config')).run()
with a direct reference to the hgweb.config file:
WSGIServer(hgwebdir('/tmp/hgweb.config')).run()

By: Peter

Peter — Wed, 09 Sep 2009 13:12:11 +0000

Yes, I am indeed using fail2ban to secure my repository. I have defined a new filter file /etc/fail2ban/filter.d/nginx-auth.conf to identify failed login attempts in the nginx access log (note: nginx does not log failed attempts to the error.log like Apache):

[Definition]
failregex = .*" 401

This filter is then called from a custom jail definition:

[mercurial]
 
enabled = true
port = https
filter = nginx-auth
logpath = /var/log/nginx/access.log
maxretry = 3

So far this is working out nice.

By: Michael Papenbrock

Michael Papenbrock — Wed, 09 Sep 2009 12:00:12 +0000

This looks quite interesting and I am eager to give it a try. However, in terms of security I guess you are also using fail2ban for this
Is it sufficient just do create a jail for nginx or is there more one should consider?

Cheers,
Michael