Skip to content

Instantly share code, notes, and snippets.

Last active May 19, 2024 21:30
Show Gist options
  • Save walkerjeffd/374750c366605cd5123d to your computer and use it in GitHub Desktop.
Save walkerjeffd/374750c366605cd5123d to your computer and use it in GitHub Desktop.
Instructions for setting up git server on Synology Diskstation

Configure Synology NAS as Git Server

Instructions for setting up a git server on a Synology NAS with Diskstation. Specifically, I am using a DS414 with DSM 5.0.

Set Up User and Folder

  • Create user gituser via Diskstation interface (with File Station and WebDAV privilages)
  • Add new shared folder called git (located at /volume1/git) with read/write access for gituser and admin. This folder will hold all the repos.
  • Install Git Server package via Diskstation
  • Open Git Server and allow gituser permissions
  • Enable SSH access on Diskstation (Control Panel > Terminal & SNMP > Enable SSH Service)

Configure SSH Access

  • create ~/.ssh folder for gituser on server
ssh admin@diskstation.local
mkdir /volume1/homes/gituser/.ssh
  • copy public rsa key from local computer to gituser account on server
scp ~/.ssh/ admin@diskstation.local:/volume1/homes/gituser/.ssh
  • connect via SSH as root and rename to authorized_keys on NAS (or append if already exists, cat >> authorized_keys)
ssh root@diskstation.local
mv /volume1/homes/gituser/.ssh/ /volume1/homes/gituser/.ssh/authorized_keys
  • change permissions while logged in as root
cd /volume1/homes/gituser/
chown -R gituser:users .ssh
chmod 700 .ssh
chmod 644 .ssh/authorized_keys

Set Up New Repo on NAS

  • create bare repo as root
ssh root@diskstation.local
cd /volume1/git/
git --bare init <repo-name>.git
chown -R gituser:users <repo-name>.git
cd <repo-name>.git
git update-server-info

NOTE: I'm not entirely sure if git update-server-info must be run for each repo or just initially. It seems to work without running this command, but I'm suspcicious that it might cause problems later.

Add NAS as Remote for Local Repo

  • Clone repo from NAS
git clone ssh://gituser@diskstation.local/volume1/git/<repo-name>.git


Copy link

denrzh commented Jun 25, 2020

The issue can be resolved by editing "appPriv" in SYNO.Git.lib file.
cat /var/packages/Git/target/webapi/SYNO.Git.lib

Before appPriv edit.
{"SYNO.Git.lib": {"allowUser": ["admin.local", "admin.domain", "admin.ldap"], "appPriv": "SYNO.SDS.GIT.Instance", "authLevel": 1, "lib": "/var/packages/Git/target/webapi/", "maxVersion": 1, "methods": {"1": [{"enum_user": {"grantable": true}}, {"apply": {"grantable": true}}]}, "minVersion": 1, "priority": 0}}

After appPriv edit.
{"SYNO.Git.lib": {"allowUser": ["admin.local", "admin.domain", "admin.ldap"], "appPriv": "", "authLevel": 1, "lib": "/var/packages/Git/target/webapi/", "maxVersion": 1, "methods": {"1": [{"enum_user": {"grantable": true}}, {"apply": {"grantable": true}}]}, "minVersion": 1, "priority": 0}}

Copy link

StoneYss commented Jul 6, 2020

@walkerjeffd @denrzh Hi all could someone please advise. I followed all the steps but when I open the application Git Server my list of users is empty! Why are no users showing up at all on the GitServer app? I'm logged in as a user who has admin access.

Hi mate! It's blank for me too, as I don't need to restrict the use of the git shell to specific users.
Since all my users can use git repositories, i manage their permission through the configured gituser - as discussed above.

Please make sure to check the hint in the documentation when you click the "?" in that GIT server dialog:

(Sorry, my NAS is setup in German, but I guess the English documentation will provide the same information.)

@denrzh It works!!! , thanks, but i do not know why

Copy link

steathy commented Dec 20, 2020

Hi, thanks for your above comments,
this is what I have done on my Synology.

On Diskstation interface.

  1. Create gituser.
  2. Create git shared folder.
  3. Grand access for gituser to the shared folder.
  4. Enable SSH access (Control Panel > Terminal & SNMP > Enable SSH Service)
  5. Install Git Server package.
  6. Open Git Server and allow gituser permissions.

On local computer. (Generate SSH key pair and copy public key to Diskstation)

ssh-keygen -t rsa -b 4096
scp ~/.ssh/ admin@diskstation.local:/tmp

On Diskstation SSH. (Create Git repository, configure permissions and SSH Server )

ssh admin@diskstation.local
cd /volume1/git
git init --bare --shared myrepo.git
cd ./myrepo.git
git update-server-info
sudo ls -s /volume1/git/myrepo.git /myrepo.git
sudo su -
mkdir /volume1/homes/gituser/.ssh
cat /tmp/ >> /volume1/homes/gituser/.ssh/authorized_keys
chown -R gituser:users /volume1/homes/gituser/.ssh
chmod 755 /volume1/homes/gituser
chmod 711 /volume1/homes/gituser/.ssh/
chmod 600 /volume1/homes/gituser/.ssh/authorized_keys
vim /etc/ssh/sshd_config
    RSAAuthentification yes
    PubkeyAuthentification yes
synoservicectl --reload sshd

On local computer.
git clone ssh://gituser@diskstation.local/myrepo.git

Thank you very much for your great instructions!

I think there's a typo "sudo ls -s". It should be "ln" instead of "ls".

Copy link

It seems Synology removed interactive command support in their packaged version of git:

If you get the 'fatal: git package does not support interactive shell' messages, then that's why.

A workaround (discussed in the linked forum) to remove the Syno package, install community, get the git-shell executable, remove community and reinstall Syno git package, and overwrite their version of git-shell. You have to do it as root so be careful what you type.

Multiple units, DSM7.0, Synology GIT server package: 2.26.2-1015

Copy link

whytong commented Oct 24, 2021

@dmurphyoz I have been trying to follow your scripts but the problem I ran into is that the remote execution could not find these scripts.
running a remote env command gives PATH=/usr/bin:/bin:/usr/sbin:/sbin. The login shell of gituser is /bin/sh, I tried to add a ~/.profile, ~/.shinit file, did not load, I also tried to change the login shell to /bin/bash but then access was denied. Could you provide more insight? I'm using DSM7 btw.

Create repositories remotely using supported mechanism

Thank you for this guide! It is extremely useful. Thank you @walkerjeffd

Copy link

Six years on and this still seems the best documentation available for this process - thank you. Unfortunately I did not find it until near the end of the process.
In my case I was using DSM 7.1.? and then then found I could manually upgrade to 7.2.1.
Each version upgrade seems to tie the system down even tighter in terms of "security", but the measures taken seem to me somewhat arbitrary. There are at least three layers of actively blocking me trying to get a login shell for the git user (just so I can get things set up).

Here are some other observations people might find useful

Openssh requirements for public key use.

From the manual for opensshd, on Linux systems it requires only that group and other permissions are set to be not writable. Whether you apply mode 0600, 700, 711 or 755 should not make any difference. As mentioned, this requirement applies to:

  1. the git user's login dir,
  2. ~/.ssh and
  3. authorized_keys under that.

What I don't know the answer to is how much DSM's default to inherited ACL permissions breaks this.
The presence of a "+" in the permission list of ls -l indicates ACLs are in operation and the unix-mode flags are fabrications. In some cases, different users will see different flags shown for the same directory.
Using chmod on a file or directory will disable the ACLs and assign the unix-mode values you have specified, but if your home directory is not set suitably then you may think it is safe, but to root it reports as world- or group-writable.
In the end, I used the undocumented synoacltool to remove inheritance and delete write-access to 'admin'. So, the lesson is, if you see a "+" on the permission flags with ls then apply a chmod, even if the values already look ok.

Did Synology modify opensshd to take ACLs into account? I doubt it.

sftp chroot

Another thing that threw me for a bit was that ssh in a default config will log you in with access to the full file system. However, sftp and scp do something like a chroot and they only expose shared folders you have permission to access.
So, what looks like /volume1/gitfiles/ when you log in, becomes /gitfiles under sftp and scp. And the default starting folder with scp is not your home dir - I've not found a way that does not need a full path specified.

Copy link

thriem commented Apr 27, 2024

2024 - this all still seems to be a problem.
I rarely fiddle with SSH keys, so I wonder - my client only prompts me to give it a private key… this instruction does also… I'd assume, since this is the host, that it also (should) issue certificates. How'd I go about that?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment