CentOS搭建Nginx+Subversion环境（包括多个版本库的配置）
Apache Subversion（简称SVN，svn）
因为某种原因我们需要用Nginx作为Subversion的http前端，但目前没有现成的Nginx+Subversion搭配方式。 而Subversion提供Apache的http处理模块。现在我们通过nginx反向代理给Apache的方式来实现Nginx+Subversion的组合方式。
构建Apache+Subversion的环境:
[root@nginx-apache-svn ~]# yum install httd subversion mod_dav_svn -y #mod_dav_svn是Apache的svn模块
建立SVN库：
[root@nginx-apache-svn ~]# mkdir -p /home/svn [root@nginx-apache-svn ~]# cd /home/svn/ [root@nginx-apache-svn svn]# svnadmin create work [root@nginx-apache-svn svn]# chown -R apache.apache work [root@nginx-apache-svn svn]# tree work/ work/ ├── conf │ ├── authz │ ├── passwd │ └── svnserve.conf ├── db │ ├── current │ ├── format │ ├── fsfs.conf │ ├── fs-type │ ├── min-unpacked-rev │ ├── rep-cache.db │ ├── revprops │ │ └── 0 │ │ └── 0 │ ├── revs │ │ └── 0 │ │ └── 0 │ ├── transactions │ ├── txn-current │ ├── txn-current-lock │ ├── txn-protorevs │ ├── uuid │ └── write-lock ├── format ├── hooks │ ├── post-commit.tmpl │ ├── post-lock.tmpl │ ├── post-revprop-change.tmpl │ ├── post-unlock.tmpl │ ├── pre-commit.tmpl │ ├── pre-lock.tmpl │ ├── pre-revprop-change.tmpl │ ├── pre-unlock.tmpl │ └── start-commit.tmpl ├── locks │ ├── db.lock │ └── db-logs.lock └── README.txt 10 directories, 28 files
添加Subversion账号：(注意只是浏览项目的账户，并不能用它登录SVN)
[root@nginx-apache-svn svn]# htpasswd -c /home/svn/work/conf/passwdfile visitor New password: visitor#用户名和密码都设为visitor Re-type new password:visitor Adding password for user visitor
修改/etc/httpd/conf.d/subversion.conf，内容如下:
<Location /svn/work>
DAV svn
SVNPath /home/svn/work
AuthType Basic
AuthName "Authorization Realm"
AuthUserFile /home/svn/work/conf/passwdfile#注意这里的用户，只是通过识证的，通过认证，只能是通过http://ip/svn/项目，去浏览项目，不能跟svn/work/conf/passwd里的svn用户混淆了！
AuthzSVNAccessFile /home/svn/work/conf/authz
Require valid-user
</Location>
AuthzSVNAccessFile /home/svn/work/conf/authz特别注意这里也要添加认证用户和权限（不然会认证失败，本文章中是visitor）
修改Apache的端口：
[root@nginx-apache-svn svn]# grep "^Listen" /etc/httpd/conf/httpd.conf Listen 81
[root@nginx-apache-svn svn]# service iptables stop && setenforce 0 iptables: Setting chains to policy ACCEPT: filter [ OK ] iptables: Flushing firewall rules: [ OK ] iptables: Unloading modules: [ OK ] [root@nginx-apache-svn svn]# getenforce Permissive
[root@nginx-apache-svn svn]# /etc/init.d/httpd start Starting httpd: [ OK ] [root@nginx-apache-svn svn]# netstat -lnutp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1310/sshd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1389/master tcp 0 0 :::81 :::* LISTEN 1632/httpd tcp 0 0 :::22 :::* LISTEN 1310/sshd tcp 0 0 ::1:25 :::* LISTEN 1389/master udp 0 0 0.0.0.0:68 0.0.0.0:* 1143/dhclient
使用Nginx反向代理：
[root@nginx-apache-svn src]# wget http://nginx.org/download/nginx-0.8.55.tar.gz [root@nginx-apache-svn src]# pwd /usr/local/src [root@nginx-apache-svn src]# ls nginx-0.8.55.tar.gz
[root@nginx-apache-svn nginx-0.8.55]# tar -xzvf nginx-0.8.55.tar.gz && cd nginx-0.8.55
添加nginx账号：
[root@nginx-apache-svn nginx-0.8.55]# useradd -s /bin/false nginx /bin/false是最严格的禁止login选项，一切服务都不能用。 /sbin/nologin只是不允许login系统
安装依赖包：
[root@nginx-apache-svn nginx-0.8.55]# yum install gcc pcre-devel openssl-devel -y
[root@nginx-apache-svn nginx-0.8.55]# ./configure --prefix=/app/server/nginx-0.8.55 \ --with-http_stub_status_module \ --with-http_gzip_static_module
[root@nginx-apache-svn nginx-0.8.55]# make && make install
[root@nginx-apache-svn nginx-0.8.55]# cd /app/server/
[root@nginx-apache-svn server]# ls nginx-0.8.55 [root@nginx-apache-svn server]# ln -sf nginx-0.8.55/ nginx && cd -
[root@nginx-apache-svn nginx-0.8.55]# ll /app/server/ total 4 lrwxrwxrwx. 1 root root 13 Jul 25 09:36 nginx -> nginx-0.8.55/ drwxr-xr-x. 6 root root 4096 Jul 25 09:35 nginx-0.8.55
配置Nginx反向代理,修改/app/server/nginx/conf/nginx.conf:
server {
listen 80;
server_name localhost ;
location /svn/work {
proxy_pass http://127.0.0.1:81/svn/work;
}
location / {
return 404;
}
}
配置SNV：
[root@nginx-apache-svn conf]# pwd /home/svn/work/conf
[root@nginx-apache-svn conf]# egrep -v "^$|^#" svnserve.conf [general] anon-access = read auth-access = write password-db = /home/svn/work/conf/passwd authz-db = /home/svn/work/conf/authz
[root@nginx-apache-svn conf]# which svnserve /usr/bin/svnserve [root@nginx-apache-svn conf]# /usr/bin/svnserve -d -r /home/svn
[root@nginx-apache-svn conf]# netstat -lnutp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:3690 0.0.0.0:* LISTEN 4806/svnserve tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1744/sshd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1389/master tcp 0 0 :::81 :::* LISTEN 1632/httpd tcp 0 0 :::22 :::* LISTEN 1744/sshd tcp 0 0 ::1:25 :::* LISTEN 1389/master udp 0 0 0.0.0.0:68 0.0.0.0:* 1143/dhclient
[root@nginx-apache-svn conf]# /app/server/nginx/sbin/nginx [root@nginx-apache-svn conf]# netstat -lnutp Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:3690 0.0.0.0:* LISTEN 4806/svnserve tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 4809/nginx tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1744/sshd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1389/master tcp 0 0 :::81 :::* LISTEN 1632/httpd tcp 0 0 :::22 :::* LISTEN 1744/sshd tcp 0 0 ::1:25 :::* LISTEN 1389/master udp 0 0 0.0.0.0:68 0.0.0.0:* 1143/dhclient
[root@nginx-apache-svn work]# cat /home/svn/work/conf/authz
### This file is an example authorization file for svnserve.
### Its format is identical to that of mod_authz_svn authorization
### files.
### As shown below each section defines authorizations for the path and
### (optional) repository specified by the section name.
### The authorizations follow. An authorization line can refer to:
### - a single user,
### - a group of users defined in a special [groups] section,
### - an alias defined in a special [aliases] section,
### - all authenticated users, using the '$authenticated' token,
### - only anonymous users, using the '$anonymous' token,
### - anyone, using the '*' wildcard.
###
### A match can be inverted by prefixing the rule with '~'. Rules can
### grant read ('r') access, read-write ('rw') access, or no access
### ('').
[aliases]
# joe = /C=XZ/ST=Dessert/L=Snake City/O=Snake Oil, Ltd./OU=Research Institute/CN=Joe Average
[groups]
# harry_and_sally = harry,sally
# harry_sally_and_joe = harry,sally,&joe
# [/foo/bar]
# harry = rw
# &joe = r
# * =
[/]
visitor=r
# [repository:/baz/fuz]
# @harry_and_sally = rw
# * = r
svnserve -d -r /home/svn#注意启动的时候，一定不要:svnserve -d -r /home/svn/work
svn co svn://192.168.1.98/work work01#注意略径
真对/home/svn/work/conf/passwd是明文的不安全因素，可以考虑用vim passwd +X去加密passwd文件。(经测试这种方法行不通，无法认别，所以无法用VIM加密passwd文件！！！)
特别要注意关掉selinux:(否则重启会出现认证失败！！！)
[root@NGINX-APACHE-SVN ~]# getenforce Disabled
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝
可以配置多个版本库：
主要是两个文件：/var/http/conf.d/subversion.conf 和 /app/server/nginx/conf/nginx.conf
[root@NGINX-APACHE-SVN ~]# egrep -v "(^$|^#)" /etc/httpd/conf.d/subversion.conf
LoadModule dav_svn_module modules/mod_dav_svn.so
LoadModule authz_svn_module modules/mod_authz_svn.so
<Location /svn/pro>＃(注意通过http:xxx.xxx.xxx.xxx/xxx访问多个代码库的时候，关键是配置下面的参数)
DAV svn
SVNPath /var/www/html/svn/pro
AuthType Basic
AuthName "Authorization Realm"
AuthUserFile /var/www/html/svn/pro/conf/passwdfile ＃可以对不同的项目以不同的配置文件，设不同的密码,达到不同的代码组，不能看对方的代码
AuthzSVNAccessFile /var/www/html/svn/pro/conf/authz
Require valid-user
</Location>
<Location /svn/app01>
DAV svn
SVNPath /var/www/html/svn/app01
AuthType Basic
AuthName "Authorization Realm"
AuthUserFile /var/www/html/svn/pro/conf/passwdfile
AuthzSVNAccessFile /var/www/html/svn/pro/conf/authz
Require valid-user
</Location>
多一个版本库就添加一个[Location].......[/Location]
vi /app/server/nginx/conf/nginx.conf
server {
listen 80;
server_name localhost;
#charset koi8-r;
#access_log logs/host.access.log main;
location / {
root html;
index index.html index.htm;
}
location /svn/pro {
proxy_pass http://127.0.0.1:81/svn/pro;
}
location /svn/app01 {
proxy_pass http://127.0.0.1:81/svn/app01;
}
#error_page 404 /404.html;
# redirect server error pages to the static page /50x.html
#
error_page 500 502 503 504 /50x.html;
location = /50x.html {
root html;
}
#多一个版本库 就多添加一个location /svn/xxxx {.......}
所有的版本库的svnserver.conf都用相同的这样更于管理:
[root@NGINX-APACHE-SVN ~]# egrep -v "(^$|^#)" /var/www/html/svn/pro/conf/svnserve.conf [general] anon-access = read auth-access = write password-db = /var/www/html/svn/pro/conf/passwd authz-db = /var/www/html/svn/pro/conf/authz [sasl] ============================================================================= [root@NGINX-APACHE-SVN ~]# egrep -v "(^$|^#)" /var/www/html/svn/app01/conf/svnserve.conf [general] anon-access = read auth-access = write password-db = /var/www/html/svn/pro/conf/passwd authz-db = /var/www/html/svn/pro/conf/authz [sasl] [root@NGINX-APACHE-SVN ~]#
这样就OK了可以对于不能的版库，有可以设不同的密码在各自的passwd中。
联系方式QQ：326528263 EMAIL：clnking@163.com 网名：bass 分享技术 突破难点 创新思维
