Gitosis worktree permissions with Rails app

Question

I currently have gitosis installed and configured on a server. It does exactly what it says on the tin, and does it well.

One of the repositories is a Rails application, an application which is ran in production mode inside a subdomain (lets call this staging.foo.com) before going live. The contents of this Rails application is located at /var/www/staging.foo.com. This directory is git-clone'd from the gitosis user on the same server. Follow me?

So workflow goes something like this..

• Make changes on local copy
• Push to origin
• SSH into server, cd /var/www/staging.foo.com
• git pull to update the app

The whole SSH'ing into the server to update the application was in place before I took on this role, which confused me because Git had the workflow configuration option so I wouldn't have to do this.

I proceeded to add the /var/www/staging.foo.com worktree into /home/git/repositories/staging.foo.com.git and added a post-commit hook to force a checkout to update the application at /var/www/staging.foo.com. Still following me? Great

Both the git user and for example the me user are part of the dev group. The dev group has read and write access to /var/www/staging.foo.com, meaning both myself and the git user can control the repo (with the git user doing to most part).

My problem is when I push changes to the remote, my app returns a 500 error code with a blank page. Neither the Apache (I'm using Passenger) logs or the Rails logs provide any information whatsoever.

If I remove this directory and git clone [email protected]:staging.foo.com.git staging.foo.com the app functions fine, as expected. It seems like the only difference here is the user, even though the dev group has both read and write permissions to this app.

Sorry if I'm not making much sense, it's a little hard to explain (or I just suck at it). My question is.. Does anyone have any idea what could be happening? Why it would work if I clone the repo and control it directly, yet wont if I allow git to use it as the worktree. Or can you provide a better/easier/more logical solution to this issue?

Thanks!

Answer 1

First, I think this question should be posted to ServerFault.

I am not a Rails expert, but could give some hints on common permission issues. One possibility is, that while you and the gitosis user have read/write access to the directory, the new files created by the git-hook do not allow Apache to serve/access them. There might be a different umask set for the gitosis user than for you, allowing the files to be accessed when you clone the repo, but not when the hook updates the working copy.

Note that under common configurations Apache traverses the full directory above a file to look for a .htaccess file. If Apache cannot access a directory this also triggers an error.