1: As far as installing gitosis goes, you fetch its "source" to whatever directory you please. The setup.py script has default locations it will use for installing everything to. Debian's gitosis package will install the files listed here. As for your code, gitosis manages the repository in the "git" user's home directory. From there you will need to pull a working copy for the actual website. There's a page here on using git to manage websites here that has some ideas for automating this, though you'll need more elbow grease to handle the staging vs. production issues. Also, see #3.
2: SSH uses a public/private keypair. The user keeps the private key secret at all times, then gives out the public key to whatever servers that user wants to log in on (thus, if someone "steals" the public key, the best they can do is let the user log in to their server). The gitosis-init command given at the tutorial you linked takes the public half of the key and adds it to the list of SSH's authorized_keys for that "git" user you created, with special settings that force anyone logging in using the private key half to only be able to use gitosis.
3: You'll have to decide on this based on your access controls. If your team has shell access on the production server, the simple thing to do would be to
git pull all the updates from gitolite to the production server. If you don't have shell access then you'll need to set up some kind of service for pushing the site to the production server, which would probably be easiest using rsync or scp or something similar.
How SSH makes Gitosis Work
There are several key pieces to ssh that make gitosis work:
The first piece is the public/private key system which allows users to log in using the keys rather than using the account's password. This is what lets multiple people all use the same ssh username ("git") to log in.
The next part is the
authorized_keys file. All of the public keys that are permitted to log in to this "git" account are stored in this file. When you connect, you and the server exchange information based on the keys (without actually transmitting the key itself) to prove that your private key matches one of those authorized public keys. In order for your client to do this, if you've set a passphrase on your key (which actually encrypts the key itself) you'll need to give your client the passphrase.
The "magic" of gitosis is that the
authorized_keys file can be configured to force a particular key to run a particular command. What
gitosis-init does (in addition to setting up gitosis's own "special" configuration repository) is take the public key it is given and adds it to the authorized_keys file with the command forced to a program that identifies the actual owner of the key and connects the remote git program to the local git repository (this command being
gitosis-serve username). Note that
gitosis-init should only be used once, after that all changes are made through the configuration repository: you will add your other developers' public keys (which they should generate themselves, keeping the private key private and giving you only the public key) into that repository and push the configuration back to the server. gitosis will automatically add the
authorized_keys lines with their user information when this is done.