Deployment Plan Table

Operating System IP NGINX Version Hostname Role
Rocky9.5(x86_64) 192.168.225.30 1.26.3 loadbalance.haoyang.cn gerrit service 1
Rocky9.5(x86_64) 192.168.225.31 1.26.3 gerrit1.haoyang.cn gerrit service 2
Rocky9.5(x86_64) 192.168.225.32 1.26.3 gerrit2.haoyang.cn Loadbalance service

Prerequisites

To run the Gerrit service, the following requirement must be met on the host:

JRE, versions 17 or 21.

Oracle’s java is paid not free any more.

Openjdk is available here.

Download the gerrit.war tarball

You could download the gerrit.war file from Gerrit official site here as you want.

Download any current *.war package. The war will be referred to as gerrit.war from this point forward, so you may find it easier to rename the downloaded file.

Initialize the Site

Gerrit stores configuration files, the server’s SSH keys, and the managed Git repositories under a local directory, typically referred to as ‘$site_path’.

Initialize a new site directory by running the init command, passing the path of the site directory to be created as an argument to the ‘-d’ option.

Its recommended that Gerrit Code Review be given its own user account on the host system:

1
2
3
4
5
6
7
# Create a new user called gerrit
sudo adduser gerrit
# Swith the privilages to root for gerrit user account and start it up:(inherit the environment variables from root)
sudo su gerrit

# Initialize a new site directory for Gerrit: (replace /path/to/your/gerrit_application_directory with your actual path)
java -jar gerrit.war init -d /path/to/your/gerrit_application_directory

Initial Configuration

I would like to show the whole process I’ve experienced here. Don’t worry, just follow my guidance.

1
2
3
4
5
6
7
8
# Create a new user called gerrit
sudo adduser gerrit
# Swith the privilages to root for gerrit user account and start it up:(inherit the environment variables from root)
sudo su gerrit

# Make a new directory
cd /home/gerrit
mkdir gerrit_war

The structure should be same as me as followed.

1
2
3
4
5
6
7
[gerrit@gerrit2 ~]$ pwd
/home/gerrit
[gerrit@gerrit2 ~]$ tree -L 2
.
└── gerrit_war

2 directories, 0 files

Then, download the gerrit.war from the Gerrit official site here as you want. Then, move the gerrit application to your gerrit directory.

1
2
3
4
5
6
7
8
9
10
[gerrit@gerrit2 gerrit_war]$ scp root@192.168.225.30:/home/gerrit/gerrit_war/gerrit-3.11.1.war .
The authenticity of host '192.168.225.30 (192.168.225.30)' can't be established.
ED25519 key fingerprint is SHA256:QZY7LFi5pVYhQHY56cn96boDi59JBU55x9o8/uyTlic.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.225.30' (ED25519) to the list of known hosts.
root@192.168.225.30's password:
gerrit-3.11.1.war                                                                                                              100%   82MB 111.7MB/s   00:00
[gerrit@gerrit2 gerrit_war]$ ls
gerrit-3.11.1.war
1
2
3
# Init the gerrir.war tarball
cd /home/gerrit/gerrit_war
java -jar gerrit-3.11.1.war init -d /home/gerrit/gerrit_application

The detailed information you could based on my settings and change it as you want.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
[gerrit@gerrit2 gerrit_war]$ java -jar gerrit-3.11.1.war init -d /home/gerrit/gerrit_application
Using secure store: com.google.gerrit.server.securestore.DefaultSecureStore
[2025-03-11 15:07:00,893] [main] INFO  com.google.gerrit.server.config.GerritServerConfigProvider : No /home/gerrit/gerrit_application/etc/gerrit.config; assuming defaults

*** Gerrit Code Review 3.11.1
***

Create '/home/gerrit/gerrit_application' [Y/n]? Y

*** Git Repositories
***

Location of Git repositories   [git]:

*** JGit Configuration
***

Auto-configured "receive.autogc = false" to disable auto-gc after git-receive-pack.

*** Index
***

Type                           [lucene]:

*** User Authentication
***

Authentication method          [openid/?]: HTTP
Get username from custom HTTP header [y/N]? N
SSO logout URL                 :
Enable signed push support     [y/N]? N
Use case insensitive usernames [Y/n]? Y

*** Review Labels
***

Install Verified label         [y/N]? y

*** Email Delivery
***

SMTP server hostname           [localhost]: ***
SMTP server port               [(default)]: **
SMTP encryption                [none/?]: none
SMTP username                  [gerrit]: ***@***.com
***@***.com's password :
              confirm password :

*** Container Process
***

Run as                         [gerrit]: gerrit
Java runtime                   [/usr/lib/jvm/java-21-openjdk-21.0.6.0.7-1.el9.x86_64]:
Copy gerrit-3.11.1.war to /home/gerrit/gerrit_application/bin/gerrit.war [Y/n]? Y
Copying gerrit-3.11.1.war to /home/gerrit/gerrit_application/bin/gerrit.war

*** SSH Daemon
***

Listen on address              [*]:
Listen on port                 [29418]:
Generating SSH host key ... rsa... ed25519... ecdsa 256... ecdsa 384... ecdsa 521... done

*** HTTP Daemon
***

Behind reverse proxy           [y/N]? y
Proxy uses SSL (https://)      [y/N]? N
Subdirectory on proxy server   [/]:
Listen on address              [*]:
Listen on port                 [8081]: 8080
Canonical URL                  [http://***/]: http://***

*** Cache
***


*** Plugins
***

Installing plugins.
Install plugin codemirror-editor version v3.11.1 [y/N]? y
Installed codemirror-editor v3.11.1
Install plugin commit-message-length-validator version v3.11.1 [y/N]? y
Installed commit-message-length-validator v3.11.1
Install plugin delete-project version v3.11.1 [y/N]? y
Installed delete-project v3.11.1
Install plugin download-commands version v3.11.1 [y/N]? y
Installed download-commands v3.11.1
Install plugin gitiles version v3.11.1 [y/N]? y
Installed gitiles v3.11.1
Install plugin hooks version v3.11.1 [y/N]? y
Installed hooks v3.11.1
Install plugin plugin-manager version v3.11.1 [y/N]? y
Installed plugin-manager v3.11.1
Install plugin replication version v3.11.1 [y/N]? y
Installed replication v3.11.1
Install plugin replication-api version v3.11.1 [y/N]? y
Installed replication-api v3.11.1
Install plugin reviewnotes version v3.11.1 [y/N]? y
Installed reviewnotes v3.11.1
Install plugin singleusergroup version v3.11.1 [y/N]? y
Installed singleusergroup v3.11.1
Install plugin webhooks version v3.11.1 [y/N]? y
Installed webhooks v3.11.1
Initializing plugins.

Mar 11, 2025 3:09:49 PM org.apache.lucene.store.MemorySegmentIndexInputProvider <init>
INFO: Using MemorySegmentIndexInput with Java 21; to disable start with -Dorg.apache.lucene.store.MMapDirectory.enableMemorySegments=false
============================================================================
Welcome to the Gerrit community

Find more information on the homepage: https://www.gerritcodereview.com
Discuss Gerrit on the mailing list: https://groups.google.com/g/repo-discuss
============================================================================
Initialized /home/gerrit/gerrit_application
Init complete, reindexing accounts,changes,groups,projects with: reindex --site-path /home/gerrit/gerrit_application --threads 1 --index accounts --index changes --index groups --index projectsReindexed 0 documents in accounts index in 0.0s (0.0/s)
Index accounts in version 14 is ready
Reindexing groups:      100% (3/3)
Reindexed 3 documents in groups index in 0.3s (11.3/s)
Index groups in version 11 is ready
Reindexing changes: Slicing projects: 100% (2/2), done
Reindexed 0 documents in changes index in 0.0s (0.0/s)
Index changes in version 86 is ready
Reindexing projects:    100% (2/2)
Reindexed 2 documents in projects index in 0.1s (27.0/s)
Index projects in version 9 is ready
Executing /home/gerrit/gerrit_application/bin/gerrit.sh start
Starting Gerrit Code Review: WARNING: Could not adjust Gerrit's process for the kernel's out-of-memory killer.
         This may be caused by /home/gerrit/gerrit_application/bin/gerrit.sh not being run as root.
         Consider changing the OOM score adjustment manually for Gerrit's PID=1859 with e.g.:
         echo '-1000' | sudo tee /proc/1859/oom_score_adj
OK
Waiting for server on 192.168.225.31:8080 ... OK
Please open the following URL in the browser: http://192.168.225.31:8080/#/admin/projects/

Tips:

If you would like to use reverse-proxy, the Authentication method must be set as http.
Other configurations could set as default, type enter to skip.

What’s more, please rememer to allow the 8080 port by using:

1
2
3
4
[root@gerrit2 ~]# firewall-cmd --permanent --add-port=8080/tcp
success
[root@gerrit2 ~]# firewall-cmd --reload
success

If you see this page, please do not worry!

It represents you’ve deployed the gerrit application successfully.

For the next step, you should handle with the NGINX configuration.

Revers-proxy error

Configuring NGINX as a Reverse Proxy for Gerrit

Please refer to NGIXN Series Chapter 1: Deploying NGINX to deploy NGINX in your local.

1
2
3
4
[root@loadbalance conf.d]# pwd
/etc/nginx/conf.d
[root@loadbalance conf.d]# ls
default.conf.bak  gerrit.conf

Tips:

You’d better to rename the default.conf in /etc/nginx/conf.d.

Create a new configuration file, here called gerrit.conf.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
upstream gerrit_backend {
    ip_hash;
    server 192.168.225.30:8080 weight=1 max_fails=3 fail_timeout=10s;
    server 192.168.225.31:8080 weight=1 max_fails=3 fail_timeout=10s;
}

server {
    listen 80;
    server_name loadbalance.haoyang.cn;

    auth_basic "Gerrit Code Review";
    auth_basic_user_file /etc/nginx/conf.d/htpasswd;

    location / {
        proxy_pass http://gerrit_backend;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_set_header Host $host;
        proxy_set_header Authorization $http_authorization;

        proxy_redirect off;
    }
}

Finally, install the httpd-tools to generate http-authentification account and password.

1
yum install httpd-tools -y

Create the gerrit administrator user.

1
2
[root@loadbalance ~]# htpasswd -b -c /etc/nginx/conf.d/htpasswd gerritadmin ***
Adding password for user gerritadmin
1
2
3
4
5
6
7
8
[root@loadbalance conf.d]# curl http://192.168.225.32:80
<html>
<head><title>401 Authorization Required</title></head>
<body>
<center><h1>401 Authorization Required</h1></center>
<hr><center>nginx/1.26.3</center>
</body>
</html>

We could find that it needs to be authorized.

If you open the website in the browser(e.g. chrome), A pop-up window will appear asking you to enter your password.

pop-up window

Congratulations to you! Up to now, you have completed the whole process of deploying gerrit.

gerrit
Please enjoy yourself in using such a code review application :D

Tips:

It is normal phenomenon if you could not sign out in the website.

Here is the reason: You are using HTTP Basic authentication. There is no way to tell a browser to quit sending basic authentication credentials, to logout with basic authentication is to close the Web browser.

What’s more, clear all cookies and data cache does work as well.