How to configure mercurial access controls using apache and hgweb?

Question

I have set up a mercurial repo to be served using apache+wsgi+hgweb on OS X.

It is now completely open to anyone who stumbles upon my server on the correct port number..

How can I set it up so that only people with a username+password pair that I approve can pull and/or push from the repo?

I know how to very easily achieve this using ssh, but in this specific case the requirement is that the solution doesn't require defining full fledged user accounts on the machine for each person whom I'd like to give access to the repo.

Answer 1

Assuming you already have the VirtualHost and under it the Directory for where you placed your hgweb.wsgi, you need to add under that Directory the following:

AuthType Basic
AuthName "Mercurial Repositories Restricted Access"
AuthUserFile /path/to/hg_passwords_file
Require valid-user

Next you should use the htpasswd tool to create the hg_passwords_file like so:

htpasswd -c hg_passwords_file username

for the first user (and enter the password as requested).

For additional users omit the -c to add them to the file instead of recreating the file.

Answer 2

Apache configuration examples for authentication are given in the “Adding authentication” section of the “Publishing Mercurial Repositories” document. There are examples for two usual cases (restricting all access, or just push operations), and even examples for usage of the htpasswd and htdigest tools (which are needed to maintain the password file).

Using WSGI instead of plain CGI (or any other method) does not affect this part of setup — just specify the user-visible URL path in the <Location url-path> statement.