Note that often it is unnecessary to publish traditional source packages. Debian-format source packages can be complex, idiosyncratic and difficult to work with. You should avoid them if you can. If you do not need to publish source packages, you can work as a Debian downstream purely using git branches, (using dgit to get the source from Debian in git form). You can build binaries directly from git, and push package source code as a git branch to an ordinary git server. See dgit-user(7).
Not every option is covered here. dgit(1) has a mostly-complete list of config options, although not always with useful descriptions.
You need a name for yourself (ie for your distro). The name will appear in the git tags made by your tools, and in configuration settings. It must be globally unique across all people and institutions who use dgit.
You could choose your organisation's domain name, or a part of it if you think that is going to be very unique.
The distro name may contain ascii alphanumerics and . + -, although - may be confusing and is probably best avoided. Try to avoid uppercase letters (and underscore): you will be typing this name a lot.
For example, if you were the Free Software Foundation Europe (fsfe.org) you might call your distro fsfe or fsfe.org. In the rest of this document we will write distro for your distro name.
If your releases align with Debian's releases, then your suites should contain the Debian suite names. Do not use just the Debian names. That will cause confusion. Instead, prepend your organisation's name and a hyphen. For example, FSFE might end up with suites like fsfe-stretch.
Suite names end up in git ref and branch names, and on dgit command lines. Suite names can contain alphanumerics and "-". Other characters may work but are not recommended.
Everyone who will use dgit push needs to be able to update refs/dgit/suite (note, not refs/heads/dgit/suite) on that server, and to make tags distro/version and archive/distro/version. Normally this would be done over ssh.
The server may host other branches and tags too. So this might be your ordinary git server, or an instance of a git hosting system.
Everyone who obtains one of your source packages, or who will run dgit clone and dgit fetch, needs to have at least read access to the git server. Ideally everything would be published via the git smart https protocol.
The git server name, and public git url structure, should be chosen so they will not need to change in the future. Best is to give the git server a DNS name of its own.
Debian's dgit git server has special access control rules, implemented in dgit-repos-server and dgit-repos-policy-debian in the package dgit-infrastructure. but in most installations this is not needed. If there is no or little distinction between (i) developers who are entitled to upload (push) and (ii) repository administrators, then it is sufficient to provide a git server with a unix account for each user who will be pushing, perhaps using ssh restricted commands.
dgit uses the term archive for this.
There are a variety of tools for creating and managing a Debian-format archive. In this document we will assume you are using reprepro.
Setting up reprepro is not covered in this tutorial. Instead, we assume you already have reprepro working.
You should also write appropriate dput configuration, since dgit uses dput to upload packages to the archive. This will involve choosing a dput host name. That's probably your distro name, distro.
dgit is configured via git's configuration system, so this is done with git configuration. See git-config(1).
Below, each heading is one or more git config keys. bold is literal text and italics is things that vary. In the descriptions of the effects of config settings, we refer to the config values "like this".
The url should be stable, and publicly accessible, because its name is published in .dsc files. (Note that if you make modified versions of packages from Debian, the copyleft licences used for Free Software often require you to permit your users, employees, and downstreams to further distribute your modified source code.)
If you have a normal git over ssh arrangement, where people ssh as themselves, leave "git-user-force" unset. If a user wishes to override the username (for example, if their local username is not the same as on the server) they can set "username".
If you always have a git repository for every package in your archive, perhaps because you never use dput/dupload, and always dgit push, set "git-check" to true.
Otherwise, set "git-check" to a url prefix - ideally, https. dgit clone will try to fetch "git-check"/package"git-check-suffix" and expect to get either some successful fetch (it doesn't matter what) or a file not found error (http 404 status code). Other outcomes are fatal errors.
If your git server runs cgit, then you can set "git-check" to the same as "git-url", and "git-check-suffix" to /info/refs.
You can set both of these to ssh-cmd, which will use an ssh shell command to test repository existence. Or leave them unset, and dgit push will use the readonly details. If repositories are created automatically on push, somehow, you can set "git-create" to true.
This is a nickname, not the real host name. You need to provide everyone who will push with an appropriate dput configuration. See dput.cf(5).
A good nickname for your upload host is your distro name distro.
If your distro is large (eg, if it contains a substantial fraction of Debian) then this will not be very efficient: with this setting, dgit often needs to download and update Sources files.
For large distros, it is better to implement the Debian archive ftpmaster API. See <https://api.ftp-master.debian.org/>, and set "archive-query" to ftpmasterapi: (with a colon) and "archive-query-url" to your API base URL. dgit uses these queries: suites, dsc_in_suite/isuite/package and file_in_archive/pat (so you need not implement anything else).
Alternatively, if your system supports the rmadison protocol, you can set "archive-query" to madison:[madison-distro]. dgit will invoke rmadison -umadison-distro.
If "git-create" is set to ssh-cmd, dgit will use the user's shell access to the server to cp -a _template.git package.git. So you should create _template.git with suitable contents.
Note that the ssh rune invoked by dgit does not do any locking. So if two people dgit push the same package at the same time, there will be lossage. Either don't do that, or set up dgit-repos-server.
To make use of ssh restricted command easier, and for the benefit of dgit-repos-server, dgit's ssh commands each start with a parseable commentish rune.
The ssh commands used by dgit are these:
(There are also other ssh commands which are historical or obscure.)