<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Python Blog - All about python &#187; ssl</title>
	<atom:link href="http://www.python-blog.com/tag/ssl/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.python-blog.com</link>
	<description>and technologies around</description>
	<lastBuildDate>Tue, 27 Jul 2010 19:58:17 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Mercurial on nginx with authentication and SSL</title>
		<link>http://www.python-blog.com/2009/11/15/mercurial-on-nginx-with-authentication-and-ssl/</link>
		<comments>http://www.python-blog.com/2009/11/15/mercurial-on-nginx-with-authentication-and-ssl/#comments</comments>
		<pubDate>Sun, 15 Nov 2009 19:59:08 +0000</pubDate>
		<dc:creator>Marcin Kuźmiński</dc:creator>
				<category><![CDATA[Mercurial]]></category>
		<category><![CDATA[Nginx]]></category>
		<category><![CDATA[certificate generation]]></category>
		<category><![CDATA[crypt]]></category>
		<category><![CDATA[eclipse]]></category>
		<category><![CDATA[generator]]></category>
		<category><![CDATA[IDE]]></category>
		<category><![CDATA[mercurial ssl]]></category>
		<category><![CDATA[orm]]></category>
		<category><![CDATA[passwd]]></category>
		<category><![CDATA[push pull]]></category>
		<category><![CDATA[Python]]></category>
		<category><![CDATA[python blog]]></category>
		<category><![CDATA[ssl]]></category>
		<category><![CDATA[tutorial]]></category>

		<guid isPermaLink="false">http://www.python-blog.com/?p=205</guid>
		<description><![CDATA[Today is a great day ;) i switched my repos from svn to mercurial.
I was still thinking about GIT but there where three key points that made me choose mercurial

 hg serve ( out of the box http server)
 it&#8217;s written in python
 has a very good eclipse plug-in (http://www.vectrace.com/mercurialeclipse/)

Cons: it&#8217;s slower than GIT ( [...]]]></description>
			<content:encoded><![CDATA[<p>Today is a great day ;) i switched my repos from svn to mercurial.<br />
I was still thinking about GIT but there where three key points that made me choose mercurial</p>
<ul>
<li> hg serve ( out of the box http server)</li>
<li> it&#8217;s written in python</li>
<li> has a very good eclipse plug-in (<a href="http://www.vectrace.com/mercurialeclipse/">http://www.vectrace.com/mercurialeclipse/</a>)</li>
</ul>
<p>Cons: it&#8217;s slower than GIT ( but who cares :D )</p>
<p>So after installing mercurial and moving my svn repos with history with <a title="HGSVN home page" href="http://pypi.python.org/pypi/hgsvn" target="_blank">hgsvn</a> ( which can also do push to svn )<br />
I started to setup easy access to the repository using nginx. I&#8217;ll show you how to setup an SSL http based repository to do PUSH/PULL/CLONE what ever.</p>
<p>Firstly we have to make self signed ssl certificates.<br />
I found on of the easiest tutorials available you can find it here: <a href="http://www.akadia.com/services/ssh_test_certificate.html" target="_blank">http://www.akadia.com/services/ssh_test_certificate.html</a></p>
<p>OK when we have the ssl certificates for our server. Put it somewhere on the server so nginx can access it.<br />
We have to setup a new virtual host for nginx that will only do ssl connections<br />
and have basic auth additionally.</p>
<p>Here&#8217;s the example config:</p>
<pre class="brush:plain">server {
    listen          443;
    server_name     hg.yourserver.com;
    ssl    on;
    ssl_certificate    /home/ssl_certs/hg_cert.crt;
    ssl_certificate_key     /home/ssl_certs/hg_cert.key;
    access_log      /var/log/nginx/hg.log;
    auth_basic      "mercurial server";
    auth_basic_user_file    /etc/nginx/.htpasswd;

    location / {
        proxy_pass      http://127.0.0.1:8001;
        #here's where the hg server runs
        include         /etc/nginx/proxy.conf;
    }
}</pre>
<p>Few thing to notice.<br />
.htpasswd file has to be in a format &lt;username&gt;:&lt;cryptPassword&gt; if you don&#8217;t have apache<br />
installed you can use <a href="http://www.python-blog.com/2009/06/23/python-random-password-generator/" target="_blank">my password generator</a> for generating crypt password. This username<br />
and password will be used to do pull/push from console and eclipse.<br />
Another important thing is that when you run hg serve you must specify the -a 127.0.0.1 option which is<br />
for the address the mercurial server runs. Hg serve default is to start at all interfaces<br />
so you have this port open outside and your ssl/passwd protection is for nothing&#8230;</p>
<p>I run my using hg serve &#8211;webdir-conf=/etc/hg/hgweb.conf -d -p 8001 -a 127.0.0.1</p>
<p>The hgweb.conf should be with</p>
<pre class="brush:plain">push_ssl = false
#since nginx is doing the SSL
allow_push = * #NGINX  is doing the auth
style = gitweb</pre>
<p>O and one more thing remember that your repo should be accessible to hg serv.<br />
I made a mistake and run hg serve as www-data and my repo was to my home user,<br />
and i had internal server error when trying to do push to server.</p>
<p>So now you can have your repo via http with SSL and nginx authentication.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.python-blog.com/2009/11/15/mercurial-on-nginx-with-authentication-and-ssl/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
