




Usage examples


 $ tracd -p 8080 /path/to/project







 $ tracd -p 8080 -e /path/to


Installing as a Windows Service

Option 1


 net start tracd



 sc config tracd start= auto

The spacing here is important.


Three (string) parameters are provided:

AppDirectory C:\Python26\
Application python.exe
AppParameters scripts\ -p 8080 ...




net start tracd

Option 2


Option 3

also cygwin's cygrunsrv.exe can be used:

$ cygrunsrv --install tracd --path /cygdrive/c/Python27/Scripts/tracd.exe --args '--port 8000 --env-parent-dir E:\IssueTrackers\Trac\Projects'
$ net start tracd

Using Authentication

Tracd allows you to run Trac without the need for Apache, but you can take advantage of Apache's password tools (htpasswd and htdigest) to easily create a password file in the proper format for tracd to use in authentication. (It is also possible to create the password file without htpasswd or htdigest; see below for alternatives)

Tracd provides support for both Basic and Digest authentication. Digest is considered more secure. The examples below use Digest; to use Basic authentication, replace --auth with --basic-auth in the command line.

The general format for using authentication is:



    • when serving multiple projects: relative to the project_path


  • password_file_path: path to the password file
  • realm: the realm name (can be anything)
  • project_path: path of the project
  • --auth in the above means use Digest authentication, replace --auth with --basic-auth if you want to use Basic auth. Although Basic authentication does not require a "realm", the command parser does, so the second comma is required, followed directly by the closing quote for an empty realm name.


 $ tracd -p 8080 \


 $ tracd -p 8080 \
   /path/to/project1 /path/to/project2


 $ tracd -p 8080 \
   /path/to/project1 /path/to/project2

Basic Authorization: Using a htpasswd password file


Note: It is necessary (at least with Python 2.6) to install the fcrypt package in order to decode some htpasswd formats. Trac source code attempt an import crypt first, but there is no such package for Python 2.6. Only SHA-1 passwords (since Trac 1.0) work without this module.



then for additional users:


Then to start tracd run something like this:


For example:



Digest authentication: Using a htdigest password file



Generating Passwords Without Apache

Basic Authorization can be accomplished via this online HTTP Password generator which also supports SHA-1. Copy the generated password-hash line to the .htpasswd file on your system. Note that Windows Python lacks the "crypt" module that is the default hash type for htpasswd ; Windows Python can grok MD5 password hashes just fine and you should use MD5.

You can use this simple Python script to generate a digest password file:

from optparse import OptionParser
# The md5 module is deprecated in Python 2.5
    from hashlib import md5
except ImportError:
    from md5 import md5
realm = 'trac'

# build the options
usage = "usage: %prog [options]"
parser = OptionParser(usage=usage)
                  help="the password to use")
(options, args) = parser.parse_args()

# check options
if (options.realm is not None):
   realm = options.realm
# Generate the string to enter into the htdigest file

Note: If you use the above script you must set the realm in the --auth argument to trac. Example usage (assuming you saved the script as


Using md5sum

It is possible to use md5sum utility to generate digest-password file:

echo ${user}:${realm}:$(printf "${user}:${realm}:${password}" | md5sum - | sed -e 's/\s\+-//') > ${path_to_file}



Usage: tracd [options] [projenv] ...

  --version             show program's version number and exit
  -h, --help            show this help message and exit
  -b HOSTNAME, --hostname=HOSTNAME
                        the host name or IP address to bind to
  --protocol=PROTOCOL   http|scgi|ajp|fcgi
  --http10              use HTTP/1.0 protocol version instead of HTTP/1.1
  --http11              use HTTP/1.1 protocol version (default)
                        parent directory of the project environments
                        the initial portion of the request URL's "path"
  -d, --daemonize       run in the background as a daemon
  --pidfile=PIDFILE     when daemonizing, file to which to write pid
  --umask=MASK          when daemonizing, file mode creation mask to use, in
                        octal notation (default 022)
  --group=GROUP         the group to run as
  --user=USER           the user to run as

Use the -d option so that tracd doesn't hang if you close the terminal window where tracd was started.


Serving static content




Support for htdocs: TracLinks syntax was added in version 0.10

Using tracd behind a proxy




See also TracOnWindowsIisAjp, TracNginxRecipe.

Authentication for tracd behind a proxy

It is convenient to provide central external authentication to your tracd instances, instead of using --basic-auth. There is some discussion about this in #9206.

Below is example configuration based on Apache 2.2, mod_proxy, mod_authnz_ldap.

First we bring tracd into Apache's location namespace.

<Location /project/proxified>
        Require ldap-group cn=somegroup, ou=Groups,
        Require ldap-user somespecificusertoo
        ProxyPass http://localhost:8101/project/proxified/
        # Turns out we don't really need complicated RewriteRules here at all
        RequestHeader set REMOTE_USER %{REMOTE_USER}s

Then we need a single file plugin to recognize HTTP_REMOTE_USER header as valid authentication source. HTTP headers like HTTP_FOO_BAR will get converted to Foo-Bar during processing. Name it something like and drop it into proxified/plugins directory:

from trac.core import *
from trac.config import BoolOption
from trac.web.api import IAuthenticator

class MyRemoteUserAuthenticator(Component):


    obey_remote_user_header = BoolOption('trac', 'obey_remote_user_header', 'false', 
               """Whether the 'Remote-User:' HTTP header is to be trusted for user logins 
                (''since ??.??').""") 

    def authenticate(self, req):
        if self.obey_remote_user_header and req.get_header('Remote-User'): 
            return req.get_header('Remote-User') 
        return None

Add this new parameter to your TracIni:

obey_remote_user_header = true

Run tracd:

tracd -p 8101 -r -s proxified --base-path=/project/proxified

Note that if you want to install this plugin for all projects, you have to put it in your global plugins_dir and enable it in your global trac.ini.

Global config (e.g. /srv/trac/conf/trac.ini):

remote-user-auth.* = enabled
plugins_dir = /srv/trac/plugins
obey_remote_user_header = true

Environment config (e.g. /srv/trac/envs/myenv):

file = /srv/trac/conf/trac.ini

Serving a different base path than /


 $ tracd --base-path=/some/path


Last modified 7 years ago Last modified on Jan 11, 2014, 4:54:15 PM