MySQL database

• Create database and user for Gerrit

CREATE USER 'gerrit'@'localhost' IDENTIFIED BY 'gerrit';  
CREATE DATABASE gerritdb;  
ALTER DATABASE gerritdb charset=latin1;  
GRANT ALL ON gerritdb.* TO 'gerrit'@'localhost';  
FLUSH PRIVILEGES;  
exit;

Apache Configuration

• Enable required modules

sudo a2enmod proxy
sudo a2enmod proxy_http  
sudo service apache2 restart

• Create virtualhost for gerrit:

vim /etc/apache2/sites-available/001_gerrit.conf
 
NameVirtualHost *:81
 
<VirtualHost *:81>
 
  ProxyRequests Off
  ProxyVia Off
  ProxyPreserveHost On
 
  <Proxy *>
    Order deny,allow
    Allow from all
  </Proxy>
 
  # Reverse proxy mode
 
  ProxyPass /gerrit/ http://localhost:8080/gerrit/
  ProxyPassReverse /gerrit/ http://localhost:8080/gerrit/
 
  <Location /gerrit/login/>
    AuthType Basic
    AuthName "Gerrit Code Review"
    AuthBasicProvider file
    AuthUserFile /etc/apache2/passwd
    Require valid-user
  </Location>
</VirtualHost>

Deploy Gerrit in Tomcat

• Stop Tomcat7

service tomcat7 stop

• In order to access the database from the Tomcat we need a database connector for the mysql database:

<Context>
    <!-- DB connector for gerrit -->
    <Resource name="jdbc/ReviewDb" auth="Container"
          type="javax.sql.DataSource" 
          maxActive="100" maxIdle="30" maxWait="10000"
          username="gerrit" password="gerrit"
          driverClassName="com.mysql.jdbc.Driver"
          factory="org.apache.commons.dbcp.BasicDataSourceFactory"
          url="jdbc:mysql://localhost:3306/gerritdb"/>
</Context>

• Deploy the ‘gerrit.war’ in Tomcat7

cd /opt/gerrit/
cp bin/gerrit.war /var/lib/tomcat7/webapps/
cp lib/mysql-connector-java-5.1.21.jar /usr/share/tomcat7/lib/
chown tomcat7:tomcat7 -R /opt/gerrit/
chown tomcat7:tomcat7 -R /var/lib/git/

• Modify canonicalWebUrl in Gerrit config to point to Gerrit Virtualhost in Apache as gerrit wants to provide some links to itself:

change

[gerrit]
        basePath = /var/lib/git/repo
        canonicalWebUrl = http://localhost:8081/

to

[gerrit]
        basePath = /var/lib/git/repo
        canonicalWebUrl = http://localhost:81/

Setup Gerrit

root@gerrit:~# java -jar gerrit-2.11.2.war  init -d /opt/gerrit
Using secure store: com.google.gerrit.server.securestore.DefaultSecureStore

*** Gerrit Code Review 2.11.2
*** 

Create '/opt/gerrit'           [Y/n]? Y

*** Git Repositories
*** 

Location of Git repositories   [git]: /var/lib/git/repo

*** SQL Database
*** 

Database server type           [h2]: mysql

Gerrit Code Review is not shipped with MySQL Connector/J 5.1.21
**  This library is required for your configuration. **
Download and install it now [Y/n]? Y
Downloading http://repo2.maven.org/maven2/mysql/mysql-connector-java/5.1.21/mysql-connector-java-5.1.21.jar ... OK
Checksum mysql-connector-java-5.1.21.jar OK
Server hostname                [localhost]: 
Server port                    [(mysql default)]: 
Database name                  [reviewdb]: gerritdb
Database username              [root]: gerrit
gerrit's password              : 
              confirm password : 

*** Index
*** 

Type                           [LUCENE/?]: 

*** User Authentication
*** 

Authentication method          [OPENID/?]: http
Get username from custom HTTP header [y/N]? 
SSO logout URL                 : 

*** Review Labels
*** 

Install Verified label         [y/N]? 

*** Email Delivery
*** 

SMTP server hostname           [localhost]: 
SMTP server port               [(default)]: 
SMTP encryption                [NONE/?]: 
SMTP username                  : 

*** Container Process
*** 

Run as                         [root]: 
Java runtime                   [/usr/lib/jvm/java-7-openjdk-amd64/jre]: 
Copy gerrit-2.11.2.war to /opt/gerrit/bin/gerrit.war [Y/n]? 
Copying gerrit-2.11.2.war to /opt/gerrit/bin/gerrit.war

*** SSH Daemon
*** 

Listen on address              [*]: 
Listen on port                 [29418]: 

Gerrit Code Review is not shipped with Bouncy Castle Crypto SSL v151
  If available, Gerrit can take advantage of features
  in the library, but will also function without it.
Download and install it now [Y/n]? n
Generating SSH host key ... rsa(simple)... done

*** HTTP Daemon
*** 

Behind reverse proxy           [y/N]? 
Use SSL (https://)             [y/N]? 
Listen on address              [*]: 
Listen on port                 [8080]: 8081
Canonical URL                  [http://localhost:8081/]: 

*** Plugins
*** 

Installing plugins.
Install plugin reviewnotes version v2.11.2 [y/N]? 
Install plugin replication version v2.11.2 [y/N]? 
Install plugin download-commands version v2.11.2 [y/N]? 
Install plugin singleusergroup version v2.11.2 [y/N]? 
Install plugin commit-message-length-validator version v2.11.2 [y/N]? 
Initializing plugins.
No plugins found with init steps.

Initialized /opt/gerrit
Executing /opt/gerrit/bin/gerrit.sh start
Starting Gerrit Code Review: 
OK
Waiting for server on localhost:8081 ... OK
Opening http://localhost:8081/#/admin/projects/ ...FAILED
Open Gerrit with a JavaScript capable browser:
  http://localhost:8081/#/admin/projects/

Logging configuration

log4j settings in Gerrit configuration log4j settings in Gerrit configuration

log4j settings in gerrit.config. For heavy users, it’s recommended switching from verbose tracing to normal logging in the log4j.properties file. The original file section looks like this:

# Normal logging
#log4j.appender.TRC.Threshold=OFF
#log4j.logger.com.google.gerrit.rpc=INFO
#log4j.logger.com.google=INFO
#log4j.logger.com.gerics=INFO
#log4j.logger.com.google.gerrit=INFO
#log4j.logger.com.google.gerrit.pgm.util.RuntimeShutdown$ShutdownCallback=INFO
 
# Verbose tracing (for troubleshooting purposes)
log4j.appender.TRC.Threshold=DEBUG
log4j.logger.com.google.gerrit.rpc=INFO
log4j.logger.com.google=DEBUG
log4j.logger.com.gerics=DEBUG
log4j.logger.com.google.gerrit=DEBUG
log4j.logger.com.google.gerrit.pgm.util.RuntimeShutdown$ShutdownCallback=INFO

Replace it with the following (uncomment normal logging and comment out the verbose tracing):

# Normal logging
log4j.appender.TRC.Threshold=OFF
log4j.logger.com.google.gerrit.rpc=INFO
log4j.logger.com.google=INFO
log4j.logger.com.gerics=INFO
log4j.logger.com.google.gerrit=INFO
log4j.logger.com.google.gerrit.pgm.util.RuntimeShutdown$ShutdownCallback=INFO
 
# Verbose tracing (for troubleshooting purposes)
#log4j.appender.TRC.Threshold=DEBUG
#log4j.logger.com.google.gerrit.rpc=INFO
#log4j.logger.com.google=DEBUG
#log4j.logger.com.gerics=DEBUG
#log4j.logger.com.google.gerrit=DEBUG
#log4j.logger.com.google.gerrit.pgm.util.RuntimeShutdown$ShutdownCallback=INFO

LDAP integration

In this example we will use a test DIT, which you can find here.

• Make changes to Gerrit configuration file:

vim /opt/gerrit/etc/gerrit.config

• Change auth type to ldap:

[auth]
    type = ldap

• Configure LDAP connection settings:

[ldap]  
    server = ldap://10.10.10.1
    username = cn=admin,dc=example,dc=com #oldRootDN
    password = password                   #olcRootPW
    accountBase = ou=People,dc=example,dc=com
    referral = follow  
    accountPattern = (&(objectClass=person)(uid=${username}))
    accountFullName = cn  
    accountEmailAddress = mail
    groupBase = ou=Groups,dc=example,dc=com
    groupMemberPattern = (&(objectClass=groupOfUniqueNames)(uniquemember=${dn}))

Used Documentation

understanding Gerrit:

https://nofluffjuststuff.com/magazine/2016/04/understanding_and_applying_gerrit_part_3_gerrit_submit_types_and_git_review

gerrit under tomcat:

http://serverfault.com/questions/383573/how-do-i-install-gerrit-under-tomcat-with-ldap/385076#385076
http://pjankows.blogspot.com/2013/04/howto-deploy-gerrit-and-jenkins-on-tomat.html
http://codeandme.blogspot.com/2012/11/setup-dedicated-gerrit-server.html
https://kupschke.net/2012/06/27/gerrit-code-review-mit-tomactmysql-und-ldap/
https://git.help.collab.net/entries/24136668-log4j-settings-in-Gerrit-configuration

mod_jk:

https://tomcat.apache.org/connectors-doc/reference/workers.html
https://wiki.eclipse.org/Jetty/Howto/Configure_AJP13

gerrit LDAP integration

http://kir1.blogspot.com/2011/07/install-gerrit.html

Reference

• https://blog.dachary.org/2013/01/03/configuring-gerrit-for-jenkins-and-git-2/
• https://blog.dachary.org/2013/01/03/configuring-gerrit-for-jenkins-and-git-2/
• https://wiki.jenkins.io/pages/viewpage.action?pageId=82673841
• https://gerrit-review.googlesource.com/Documentation/config-reverseproxy.html
• https://stackoverflow.com/questions/18179728/set-up-gerrit-with-http-authentication
• https://gerrit-documentation.storage.googleapis.com/Documentation/2.15.3/config-reverseproxy.html
• https://gerrit-review.googlesource.com/Documentation/config-reverseproxy.html
• https://stackoverflow.com/questions/18179728/set-up-gerrit-with-http-authentication
• https://gerrit-review.googlesource.com/Documentation/config-sso.html#_http_basic_digest_authentication
• https://wiki.nix-pro.com/view/Gerrit

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.