Installing Gerrit Code Review

This guide walks through installing Gerrit Code Review, securing it with NGINX as a reverse proxy, and configuring HTTPS using SSL certificates.
Tested with Ubuntu 22.04/24.04 and Gerrit 3.9.x.

1. Install and configure nginx

sudo apt install -y apache2-utils nginx

2. Create ‘admin’ with htpasswd

NGINX uses an .htpasswd file to store usernames and hashed passwords.

sudo htpasswd -c /etc/nginx/.htpasswd admin

3. Install SSL Certificates

Place your certificate files in:

/etc/ssl/certs/yourdomain.crt
/etc/ssl/private/yourdomain.key
/etc/ssl/certs/ca_bundle.crt

3.1 Set Secure Permissions

chmod 640 /etc/ssl/private/yourdomain.key
chown root:www-data /etc/ssl/private/yourdomain.key

chmod 644 /etc/ssl/certs/yourdomain.crt
chown root:root /etc/ssl/certs/yourdomain.crt

chmod 644 /etc/ssl/certs/ca_bundle.crt
chown root:root /etc/ssl/certs/ca_bundle.crt

4. Configure NGINX Reverse Proxy for Gerrit

Create the file: /etc/nginx/sites-available/default with the following contents

server {
    listen 80;
    listen [::]:80;
    server_name _;

    # Redirect all HTTP traffic to HTTPS
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;

    server_name _;

    # SSL Configuration
    ssl_certificate /etc/ssl/certs/yourdomain.crt;
    ssl_certificate_key /etc/ssl/private/yourdomain.key;

    # Include the CA Chain Bundle
    ssl_trusted_certificate /etc/ssl/certs/ca_bundle.crt;

    # Best practice SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    root /var/www/html;
    index index.html index.htm;

    location / {
        auth_basic "Gerrit Code Review";
        auth_basic_user_file /etc/nginx/.gerrit_passwd;

        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;

        # Add this line to pass the logged-in user to Gerrit
        proxy_set_header AUTH_USER $remote_user;
    }
}

server {
    listen 80;
    server_name gerrit.yourdomain.net git.yourdomain.net;
    return 301 https://$host$request_uri;
}

Restart nginx

systemctl restart nginx

5. Install Java (Gerrit Pre-requisite)

sudo apt install openjdk-17-jre-headless -y

6. Download, install, and configure Gerrit

sudo adduser --system --group --home /home/gerrit gerrit
sudo su -s /bin/bash gerrit
cd ~
wget https://gerrit-releases.storage.googleapis.com/gerrit-3.9.2.war -O gerrit.war

Initialize gerrit

java -jar gerrit.war init –batch -d ~/gerrit_site

Stop gerrit so that we can edit the configuration

~/gerrit_site/bin/gerrit.sh stop

Edit configuration

nano ~/gerrit_site/etc/gerrit.config

[gerrit]
basePath = git
canonicalWebUrl = https://gerrit.yourdomain.net/
serverId = 8d3360d8-0ad5-4cf4-b006-31a33e812272
[container]
javaOptions = “-Dflogger.backend_factory=com.google.common.flogger.backend.log4j.Log4jBackendFactory#getInstance”
javaOptions = “-Dflogger.logging_context=com.google.gerrit.server.logging.LoggingContext#getInstance”
user = gerrit
javaHome = /usr/lib/jvm/java-17-openjdk-amd64
[index]
type = lucene
[auth]
type = HTTP
userNameCaseInsensitive = true
httpHeader = AUTH_USER
[sendemail]
smtpServer = localhost
[sshd]
listenAddress = *:29418
[httpd]
listenUrl = proxy-http://127.0.0.1:8080/
[cache]
directory = cache

Create a systemd file to start/stop the Gerrit service

sudo nano /etc/systemd/system/gerrit.service

[Unit]
Description=Gerrit Code Review
After=network.target

[Service]
Type=forking
User=gerrit
ExecStart=/home/gerrit/gerrit_site/bin/gerrit.sh start
ExecStop=/home/gerrit/gerrit_site/bin/gerrit.sh stop
ExecReload=/home/gerrit/gerrit_site/bin/gerrit.sh restart
Restart=always

[Install]
WantedBy=multi-user.target


sudo systemctl daemon-reload
sudo systemctl enable gerrit
sudo systemctl start gerrit