Services hosted on GNU Savannah servers

The following is the list of various network services related to Savannah, organized by the VM they run on.

When restarting/reload/reboot a service or a VM, please check the following services are working as expected.

See also:

Conventions

  • Host names
    • X.gnu.org and X.nongnu.org point to the same IP address.
    • X.savannah.gnu.org and X.sv.gnu.org likewise point to the same address.
    • dl => dl.sv.gnu.org => download.savannah.gnu.org
    • vcs => vcs.sv.gnu.org => vcs.savannah.gnu.org
    • fe => fe.sv.gnu.org => frontend.savannah.gnu.org
    • int => int.sv.gnu.org => internal.savannah.gnu.org
  • File names
    • Filenames with server name are written as dl:/etc/apache2/foo.conf - meaning the file /etc/apache2/foo.conf on the dl server (which is dl.sv.gnu.org).
    • Filenames without server name - the server is assumed to be deduced from the context.

frontend

The frontend.sv.gnu.org VM runs the Savannah website (PHP code).

vcs

The vcs.sv.gnu.org VM holds the source code (bzr,cvs,hg,git,svn) and webpages (cvs only) repositories, providing various access methods.

(The old GNU arch version control program and repositories are still present on the server, but perhaps no one is still using it. In any case, we very strongly not recommend using it for any new development, and we won't mention it further on this page. We hope to remove it completely in due course.)

vcs - project member access (commits)

  • ssh: used for read/write access to the repositories by members of a project. Before using ssh, the Savannah user must upload a public ssh key through the Savannah web interface. Upon attempted login, this user key is checked against the Savannah MySQL database, using the AuthorizedKeysExec command defined in vcs:/etc/ssh/sshd_config. The user must also be a member of the given project.

    The repositories' access methods are:

    • bzr: bzr branch bzr+ssh://<USER>@bzr.savannah.nongnu.org/<PROJECT>/branch
    • cvs: cvs -d:ext:<USER>@cvs.savannah.nongnu.org:/sources/<PROJECT> co <modulename>
    • git: git clone <USER>@git.sv.gnu.org:/srv/git/<PROJECT>.git
    • hg: hg clone ssh://<USER>@hg.sv.gnu.org/<PROJECT>
    • svn: svn co svn+ssh://<USER>@svn.savannah.gnu.org/<PROJECT>/<modulename>
    • webcvs: cvs -d:ext:<USER>@cvs.savannah.nongnu.org:/web/<PROJECT> co <PROJECT>

vcs - public anonymous access (read-only)

  • rsync - read-only anonymous access to the raw repository files. configuration in vcs:/etc/rsync.conf, started with xinetd in vcs:/etc/xinetd.d/rsync.

    • bzr: rsync://bzr.savannah.gnu.org/bzr/<PROJECT>
    • cvs: rsync://cvs.savannah.gnu.org/sources/<PROJECT>
    • git: rsync://svn.savannah.gnu.org/git/<PROJECT>
    • hg: not defined.
    • svn: rsync://svn.savannah.gnu.org/svn/<PROJECT>
    • webcvs: rsync://web.cvs.savannah.gnu.org/web/<PROJECT>
  • bzr-daemon - read-only anonymous access to bzr repositories. configured with xinetd in vcs:/etc/xinetd.d/bzr-hpss.

    • bzr: bzr branch bzr://bzr.savannah.nongnu.org/gnewsense/branch
  • cvs-pserver - read-only anonymous access to cvs repositories. configured with xinetd in vcs:/etc/xinetd.d/cvs.

    • cvs: cvs -d:pserver:anonymous@cvs.savannah.nongnu.org:/sources/<PROJECT> co <modulename>
    • webcvs: cvs -d:pserver:anonymous@cvs.savannah.nongnu.org:/web/<PROJECT> co <modulename>
  • git-daemon - read-only anonymous access to git repositories. configured with xinetd in vcs:/etc/xinetd.d/git.

    • git: git clone git://git.savannah.gnu.org/<PROJECT>.git
  • hg - not defined.

  • svn-daemon - read-only anonymous access to svn repositories. configured with xinetd in vcs:/etc/xinetd.d/svn.

    • svn: svn co svn://svn.savannah.gnu.org/texinfo/trunk

vcs - web browsing

Source code repositories:

Webpages repositories:

download

The dl.sv.gnu.org hosts the following:

  • The 'downloads' (aka 'releases') for projects hosted on GNU Sanannah.
  • The content of http://audio-video.gnu.org
  • The (old, obsolete) GNU Arch repositories

See Mirmon for more information about the auto-redirection mentioned below.

Configuration details:

  • Mirror multiplexor for ftp.gnu.org: (The official ftp.gnu.org server is managed by the FSF, and Savannah hackers have no access to it.)

    • web access: http://ftpmirror.gnu.org (this url auto-redirects).
    • Apache conf: dl:/etc/apache2/sites-available/download
    • uses Apache2::Geo::Mirror to redirect based on GeoIP.
  • Savannah-hosted downloads/releases: These are mostly intended for nongnu projects, as GNU projects are expected to put releases on ftp.gnu.org, as detailed in the GNU Maintainer Information https://www.gnu.org/prep/maintain/html_node/Automated-FTP-Uploads.html.

  • Mirrored downloads/releases:

  • Savannah top-level download urls:

  • GNU audio-video host:

  • GNU Arch repositories:

  • rsync access

    • rsync start-up configuration file: dl:/etc/default/rsync. The configuration uses xinetd, and so all other options in this file are ignored. Instead, the parameters in dl:/etc/xinetd.d/rsync are used.
    • rsync configuration file: dl:/etc/rsyncd.conf. Available modules:
      • releases mapped to dl:/srv/download.
      • audio-video mapped to dl:/srv/audio-video.
    • Anonymous access using rsync protcol: rsync -avhP rsync://dl.sv.gnu.org/releases/<PROJECT>/<FILE> LOCALFILE
    • Listing content of a directory: rsync rsync://dl.sv.gnu.org/releases/<PROJECT>/
    • All Savannah members can access rsync services, using the ssh public key configured on Savannah website (see ssh section of VCS server, above).
    • Download a file using ssh public key + Savannah User: rsync -avhP <USER>@dl.sv.gnu.org:/releases/<PROJECT>/<FILE> LOCALFILE
    • Uploading a file (only to projects in which USER is a member): rsync -avhP LOCALFILE <USER>@dl.sv.gnu.org/srv/download/<PROJECT>/<FILE>
  • sftp access

    • sftp <USER>@dl.sv.gnu.org

internal

The internal.sv.gnu.org VM runs the Savannah database (mysql), and dns (bind) for Savannah VMs.

  • DNS server - bind

    • startup configuration file: int:/etc/default/bind9
    • bind configuration directory: int:/etc/bind/
    • The relevant configuration files are:
      • int:/etc/bind/named.conf which includes
      • int:/etc/bind/named.conf.local which includes
      • int:/etc/bind/master/savannah.{gnu,nongnu}.org which include:
      • int:/etc/bind/master/savannah.header - name servers and serial update timestamp
      • int:/etc/bind/master/savannah.footer - A and CNAME dns records for all Savannah VMs (e.g. dl / vcs / fe)
    • The server does not answer DNS queries directly. Instead, it propagates its DNS configuration to ns1.gnu.org, and only answers queries from ns1.gnu.org (enforced with iptables rules).
    • More about DNS: DNS.
  • Savannah database - mysql

    • Used in two contexts:
      1. The database for the Savannah PHP code (based on old SourceForge code base). These are the registered users on Savannah, registered projects, trackers (tasks, bugs, etc.), etc. Users upload their public ssh keys to Savannah web interface, and those are also stored in the database.
      2. All VMs which allow ssh access based on public ssh keys connect to the mysql database, and query the user's ssh key. Users' keys are not stored outside this database (with a few exceptions for Savannah hackers and fencepost.gnu.org users).
    • MySQL tcp connections are accepted only from sv.gnu.org, sv.nongnu.org, vcs.sv.gnu.org, dl.sv.gnu.org (enforced with iptables rules).
    • MySQL configuration file: int:/etc/mysql/my.cnf

lists

lists.gnu.org handles the mailing lists for gnu.org, nongnu.org, libreplanet.org, and other FSF-related domains. (The FSF also uses other servers in some cases, for its mass mailings, etc.)

Configuration details:

  • DNS records: the server responds to lists.gnu.org, lists.nongnu.org, lists.libreplanet.org and few other FSF-related sites.

  • One mailman installation handles all of the above domains (see here).

  • web access:

    • multiple configuration files in lists:/etc/apache2/sites-enabled configured to reply to different server names and ssl certificates.
    • all include the following file: lists:/etc/apache2/sites-available/lists.gnu.org-common
    • static html archives:
      • available from http://lists.gnu.org/archive/html
      • stored in lists:/arc/mharc-html.
      • search cgi with namazu2 package, using:
        • http://lists.gnu.org/archive/cgi-bin/namazu.cgi pointing to
        • lists:/home/mharc/cgi-bin/namazu.cgi symlink to
        • lists:/usr/lib/cgi-bin/namazu.cgi.
    • GNU Mailman manages mailing list activities (subscriptions, moderation, etc.)
  • rsync access to mailing lists archives:

    • rsync daemon startup enabled in lists:/etc/default/rsync
    • rsync configuration in lists:/etc/rsyncd.conf:
      • Publishes module mbox, served from lists:/arc/mharc-mbox
    • To list available archives: rsync rsync://lists.gnu.org/mbox/
    • To download full archive of one mailing list:
      rsync -avhP rsync://lists.gnu.org/mbox/bug-texinfo .

Spam handling is a whole subject in itself: ListHelperAntiSpam.

lists.gnu.org is administered by FSF admins, not by savannah hackers, though savannah hackers have non-root access to the machine. See ListServer for more about mailing-list management.

mgt - management

--moretowrite-- The mgt.sv.gnu.org VM runs munin, and what else? Provides access point to get to all other sv hosts (in old days, hosts had unroutable 10.x addresses).