Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Basically, how do I do it in Mercurial Repository?

Currently I've configured the Location in Apache to require SSL, use basic auth, and require valid-user. That's a bit much, as I want to allow anonymous pull, just require basic auth for the pushers — right now user/password are required to simply view the repository in a web browser. I'd like to require SSL at all times, and don't really want to host the same repository twice (to have a different Location for the pull-only, and another for the verified push).

share|improve this question
up vote 4 down vote accepted

Ches Martin has a nice blog with details of how he setup Mercurial complete with what you are asking.

<LimitExcept GET>
  require valid-user

This snippet from an Apache config is part of what is needed to allow anonymous pull (or browsing if published via hgweb) but still require a pass for push.

share|improve this answer

What you looking for is may be the LimitExcept directive of Apache. Something like:

<LimitExcept GET>
  Require valid-user

So that a user/pass will be needed for anything else than a GET request. But I don't know Mercurial and don't know how hg push is done. If it is a POST request, it will be Ok, but may be that POST is also required to pull.

share|improve this answer
Mercurial only uses POST for hg push, so you're correct in your suggestions. – Martin Geisler Dec 18 '11 at 10:42

You're making your problem a lot harder by requiring SSL for the anonymous pull, and I have no idea what you're aiming for by doing so. If anyone can pull without authentication, anyone can see all of the data just by asking, making sniffing the wire completely redundant, so there's no point in encrypting it.

I strongly recommend taking the simpler route of putting your anonymous distribution on http, and save https for pushes.

share|improve this answer
The whole subdomain is https only- there are other repositories and information that requires authorized users + ssl. We decided to deny plain http so that there wouldn't be any confusion or security holes. – user9748 Jul 5 '09 at 17:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.