Instructions for setting up git server on Synology Diskstation

Synology-Diskstation-Git.md

Configure Synology NAS as Git Server

Instructions for setting up a git server on a Synology NAS with Diskstation. Specifically, I am using a DS414 with DSM 5.0.

Set Up User and Folder

• Create user gituser via Diskstation interface (with File Station and WebDAV privilages)
• Add new shared folder called git (located at /volume1/git) with read/write access for gituser and admin. This folder will hold all the repos.
• Install Git Server package via Diskstation
• Open Git Server and allow gituser permissions
• Enable SSH access on Diskstation (Control Panel > Terminal & SNMP > Enable SSH Service)

Configure SSH Access

• create ~/.ssh folder for gituser on server

ssh admin@diskstation.local
mkdir /volume1/homes/gituser/.ssh

• copy public rsa key from local computer to gituser account on server

scp ~/.ssh/id_rsa.pub admin@diskstation.local:/volume1/homes/gituser/.ssh

• connect via SSH as root and rename id_rsa.pub to authorized_keys on NAS (or append if already exists, cat id_rsa.pub >> authorized_keys)

ssh root@diskstation.local
mv /volume1/homes/gituser/.ssh/id_rsa.pub /volume1/homes/gituser/.ssh/authorized_keys

• change permissions while logged in as root

cd /volume1/homes/gituser/
chown -R gituser:users .ssh
chmod 700 .ssh
chmod 644 .ssh/authorized_keys

Set Up New Repo on NAS

• create bare repo as root

ssh root@diskstation.local
cd /volume1/git/
git --bare init <repo-name>.git
chown -R gituser:users <repo-name>.git
cd <repo-name>.git
git update-server-info

NOTE: I'm not entirely sure if git update-server-info must be run for each repo or just initially. It seems to work without running this command, but I'm suspcicious that it might cause problems later.

Add NAS as Remote for Local Repo

• Clone repo from NAS

git clone ssh://gituser@diskstation.local/volume1/git/<repo-name>.git

References

http://blog.osdev.org/git/2014/02/13/using-git-on-a-synology-nas.html http://stackoverflow.com/questions/20074692/set-up-git-on-a-nas-with-synologys-official-package http://www.heidilux.com/2014/02/setup-git-server-synology-nas/

@mahoromax the most likely cause of issues with your gituser is the permissions. Check the following permission.

1. gituser home directory (~gituser/. in bash) should be owned by gituser and have 711 permission rwx--x--x
2. gituser .ssh directory in their home directory (~gituser/.ssh/. owned by gituser and 711 permissions rwx--x--x)
3. the ssh authorized keys file in the .ssh directory (~gituser/.ssh/authorized_keys owned by gituser with 600 permissions rw-------).

For the git access check that the permissions on the git repository, the git directory and that git has been initialized.

1. Check the permissions on the git directory and the git repository you are trying to access
   ls -la /volume1/git/.

The dot directory . should have the following permissions

drwx------+ 1 gituser root 186 Apr 4 02:08 .

The repository directory should have the following permissions

drwx------+ 1 gituser users 98 Apr 4 02:08 SynologyGitUsability.git

2. Ensure git is pointing to the correct directory for git services

My example git repository is called SynologyGitUsability.git

cd SynologyGitUsability.git
git update-server-info

**If you don't yet have a git repository **

The following command sequence is the easiest to create one for testing. You will need to complete step two to update-server-info after creating the first git repository.

You need root or admin access.

1. Sudo to gituser
   sudo -u gituser bash
2. Change directory to git directory
   cd /volume1/git
3. Create an empty git repository In this example I am calling it TestRepository. This would be the name it accessed as remotely

git --bare init TestRepository.git

Finally remember when adding the repository into windows, linux or OS X git tools you must use the full name TestRepository.git.

Tell if this helps or provide more details on what is going wrong. Good luck!

Thank you for the detailed answer.
I double checked all the mentioned permissions (they were usually a bit higher, but I adjusted them to 700/600 to be sure)

Still cant access SSH via gituser
(Hi gituser! You have successfully authenticated, but there is NO interactive shell access. )
I try this via an SSH client (mobaxterm)
Nor clone the bare repo. (GIT for windows)
When I connect it also doesn't accept the SSH key, I get asked for password every time.
"Permission denied, please try again. fatal: Could not read from remote repository.
Please make sure you have the correct access rights and the repository exists."
$ git clone ssh://gituser@192.168.2.100/volume2/git/nasgit.git
tried different paths without volume2/git and so on... always the same...

I found a note saying that SSH is only enabled for administrators users, where I enable SSH in the synology options.
Could that be related?

The "NO interactive users" comes from the file ~gituser/git-shell-commands/no-interactive-login

This file is sourced by git-shell which is the assigned shell for gituser once it is associated with GIT.

You can remove this file

rm ~gituser/git-shell-commands/no-interactive-login

OR rename it

mv ~gituser/git-shell-commands/no-interactive-login ~gituser/git-shell-commands/no-interactive-login.HOLD

Remember to move it back or recreate once you are done.

I would login and check if you can initialise a repository using the commands

You need root or admin access.

Sudo to gituser
sudo -u gituser bash

Change directory to git directory
cd /volume1/git

Create an empty git repository In this example I am calling it TestRepository. This would be the name it accessed as remotely
git --bare init TestRepository.git

Finally remember when adding the repository into windows, linux or OS X git tools you must use the full name TestRepository.git.

Trouble shooting the requirement for password

First check what it is doing using the ssh client in verbose mode.

ssh -vvv gituser@192.168.2.100

You are looking for information on matching keys etc.

Be aware that it could be rejected because .ssh/authorized_keys does not exist or permissions are incorrect on the file or the .ssh directory on the Synology. You also need to be aware of name or IP address mismatches between files. If your id_rsa.pub file has an old hostname or IP address in it then this will not match.

The ssh client will require a password if you have created a password on your private key file on your local machine. It is difficult to remove this and not break other things, so i would recommend you creating another one.

ssh-keygen -t rsa -f gituser_rsa

Generating an ssh key on a mac os x

You will then need to append the gituser_rsa.pub file onto the .ssh/authorized_keys file.

Hope these things help.

Hi,

Thanks for the post!

• To make "password-less ssh" work, aside from @gazgeek's suggestion, I also find out that I need to change the permission of the user folder (that contains .ssh) to 755. Previously it was 711:

chmod 755 /home/gituser

Reference:
http://superuser.com/questions/736055/ssh-with-no-password-passwordless-on-synology-dsm-5-as-other-non-root-user

With your tip I could make it work for my buddy who is a non-root user and needs access to my git repository.
Thanks for sharing!

Hi, thanks for your above comments,
this is what I have done on my Synology.

On Diskstation interface.

1. Create gituser.
2. Create git shared folder.
3. Grand access for gituser to the shared folder.
4. Enable SSH access (Control Panel > Terminal & SNMP > Enable SSH Service)
5. Install Git Server package.
6. Open Git Server and allow gituser permissions.

On local computer. (Generate SSH key pair and copy public key to Diskstation)

ssh-keygen -t rsa -b 4096
scp ~/.ssh/id_rsa.pub admin@diskstation.local:/tmp

On Diskstation SSH. (Create Git repository, configure permissions and SSH Server )

ssh admin@diskstation.local
cd /volume1/git
git init --bare --shared myrepo.git
cd ./myrepo.git
git update-server-info
sudo ln -s /volume1/git/myrepo.git /myrepo.git

sudo su -
mkdir /volume1/homes/gituser/.ssh
cat /tmp/id_rsa.pub >> /volume1/homes/gituser/.ssh/authorized_keys
chown -R gituser:users /volume1/homes/gituser/.ssh
chmod 755 /volume1/homes/gituser
chmod 711 /volume1/homes/gituser/.ssh/
chmod 600 /volume1/homes/gituser/.ssh/authorized_keys

vim /etc/ssh/sshd_config
    RSAAuthentification yes
    PubkeyAuthentification yes
synoservicectl --reload sshd

On local computer.
git clone ssh://gituser@diskstation.local/myrepo.git

@walkerjeffd @denrzh Hi all could someone please advise. I followed all the steps but when I open the application Git Server my list of users is empty! Why are no users showing up at all on the GitServer app? I'm logged in as a user who has admin access.

@walkerjeffd @denrzh Hi all could someone please advise. I followed all the steps but when I open the application Git Server my list of users is empty! Why are no users showing up at all on the GitServer app? I'm logged in as a user who has admin access.

Hi mate! It's blank for me too, as I don't need to restrict the use of the git shell to specific users.
Since all my users can use git repositories, i manage their permission through the configured gituser - as discussed above.

Please make sure to check the hint in the documentation when you click the "?" in that GIT server dialog:

(Sorry, my NAS is setup in German, but I guess the English documentation will provide the same information.)

The issue can be resolved by editing "appPriv" in SYNO.Git.lib file.
cat /var/packages/Git/target/webapi/SYNO.Git.lib

Before appPriv edit.
{"SYNO.Git.lib": {"allowUser": ["admin.local", "admin.domain", "admin.ldap"], "appPriv": "SYNO.SDS.GIT.Instance", "authLevel": 1, "lib": "/var/packages/Git/target/webapi/SYNO.Git.so", "maxVersion": 1, "methods": {"1": [{"enum_user": {"grantable": true}}, {"apply": {"grantable": true}}]}, "minVersion": 1, "priority": 0}}

After appPriv edit.
{"SYNO.Git.lib": {"allowUser": ["admin.local", "admin.domain", "admin.ldap"], "appPriv": "", "authLevel": 1, "lib": "/var/packages/Git/target/webapi/SYNO.Git.so", "maxVersion": 1, "methods": {"1": [{"enum_user": {"grantable": true}}, {"apply": {"grantable": true}}]}, "minVersion": 1, "priority": 0}}

@walkerjeffd @denrzh Hi all could someone please advise. I followed all the steps but when I open the application Git Server my list of users is empty! Why are no users showing up at all on the GitServer app? I'm logged in as a user who has admin access.

Hi mate! It's blank for me too, as I don't need to restrict the use of the git shell to specific users.
Since all my users can use git repositories, i manage their permission through the configured gituser - as discussed above.

Please make sure to check the hint in the documentation when you click the "?" in that GIT server dialog:

(Sorry, my NAS is setup in German, but I guess the English documentation will provide the same information.)

@denrzh It works!!! , thanks, but i do not know why

Hi, thanks for your above comments,
this is what I have done on my Synology.

On Diskstation interface.

1. Create gituser.
2. Create git shared folder.
3. Grand access for gituser to the shared folder.
4. Enable SSH access (Control Panel > Terminal & SNMP > Enable SSH Service)
5. Install Git Server package.
6. Open Git Server and allow gituser permissions.

On local computer. (Generate SSH key pair and copy public key to Diskstation)

ssh-keygen -t rsa -b 4096
scp ~/.ssh/id_rsa.pub admin@diskstation.local:/tmp

On Diskstation SSH. (Create Git repository, configure permissions and SSH Server )

ssh admin@diskstation.local
cd /volume1/git
git init --bare --shared myrepo.git
cd ./myrepo.git
git update-server-info
sudo ls -s /volume1/git/myrepo.git /myrepo.git

sudo su -
mkdir /volume1/homes/gituser/.ssh
cat /tmp/id_rsa.pub >> /volume1/homes/gituser/.ssh/authorized_keys
chown -R gituser:users /volume1/homes/gituser/.ssh
chmod 755 /volume1/homes/gituser
chmod 711 /volume1/homes/gituser/.ssh/
chmod 600 /volume1/homes/gituser/.ssh/authorized_keys

vim /etc/ssh/sshd_config
    RSAAuthentification yes
    PubkeyAuthentification yes
synoservicectl --reload sshd

On local computer.
git clone ssh://gituser@diskstation.local/myrepo.git

Thank you very much for your great instructions!

I think there's a typo "sudo ls -s". It should be "ln" instead of "ls".

It seems Synology removed interactive command support in their packaged version of git:

https://community.synology.com/enu/forum/8/post/147518

If you get the 'fatal: git package does not support interactive shell' messages, then that's why.

A workaround (discussed in the linked forum) to remove the Syno package, install community, get the git-shell executable, remove community and reinstall Syno git package, and overwrite their version of git-shell. You have to do it as root so be careful what you type.

Multiple units, DSM7.0, Synology GIT server package: 2.26.2-1015

@dmurphyoz I have been trying to follow your scripts but the problem I ran into is that the remote execution could not find these scripts.
running a remote env command gives PATH=/usr/bin:/bin:/usr/sbin:/sbin. The login shell of gituser is /bin/sh, I tried to add a ~/.profile, ~/.shinit file, did not load, I also tried to change the login shell to /bin/bash but then access was denied. Could you provide more insight? I'm using DSM7 btw.

Create repositories remotely using supported mechanism

Thank you for this guide! It is extremely useful. Thank you @walkerjeffd