Serving a git repository with nginx fails with 403 Forbidden

Question

I made a user git and placed an empty bare repository in his home directory /home/git:

$ git init --bare test.git
$ ls -l
drwxr-xr-x 7 git git 4.0K Jul 18 12:51 test.git

I want this repository to be accessible as example.com/repos/test.git.

To accomplish this, I have the following nginx configuration:

location ~ /repos(/.*) {
    fastcgi_pass unix:/var/run/fcgiwrap.socket;
    include fastcgi_params;
    fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
    fastcgi_param GIT_HTTP_EXPORT_ALL "";
    fastcgi_param GIT_PROJECT_ROOT /home/git;
    fastcgi_param PATH_INFO $1;
}

Attempting to clone the repository fails, however:

$ git clone https://example.com/repos/test.git
Cloning into 'test'...
remote: 403 Forbidden
fatal: unable to access 'https://example.com/repos/test.git/':
  The requested URL returned error: 403

Meanwhile, nginx had this to say in its access.log:

"GET /repos/test/info/refs?service=git-upload-pack HTTP/1.1"
403 25 "-" "git/2.4.5"

What am I doing wrong?

Thanks for any help.

Answer 1

...

After many hours of pulling my hair out, the trick was to reorder the nginx configuration.

In addition, to enable pushing, I had to add some basic-auth directives.

    location ~ /repos(/.*) {
            auth_basic "access denied";
            auth_basic_user_file /path/to/your/htpasswd;
            client_max_body_size 0;
            fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
            include fastcgi_params;
            fastcgi_param GIT_HTTP_EXPORT_ALL "";
            fastcgi_param GIT_PROJECT_ROOT /home/git;
            fastcgi_param PATH_INFO $1;
            fastcgi_param REMOTE_USER $remote_user;
            fastcgi_pass unix:/var/run/fcgiwrap.socket;
    }

For any poor soul perusing this to find an answer to their problem, if after all this you get an "insufficient permission to blah blah" error, fix your repository permissions like so.