updates to cgit config

2 files changed, 55 insertions, 15 deletions

diff --git a/modules/services/nixos/cgit.nix b/modules/services/nixos/cgit.nix
index 235335f..ed8bce2 100644
--- a/modules/services/nixos/cgit.nix
+++ b/modules/services/nixos/cgit.nix
@@ -2,27 +2,64 @@
   pkgs,
   config,
   lib,
-  hosts,
   ...
 }: let
   cfg = config.collinux.services.cgit;
-
-  authorizedKeys =
-    hosts
-    |> builtins.mapAttrs (_: data: ''command="git-shell -c \"$SSH_ORIGINAL_COMMAND\"" ${data.user_pubkey or null}'')
-    |> builtins.attrValues
-    |> builtins.filter (x: x != null);
 in {
   config = lib.mkIf cfg.enable {
+    environment.shells = ["${pkgs.git}/bin/git-shell"];
     users.groups."git" = {};
     users.users."git" = {
       isSystemUser = true;
       group = "git";
+      shell = "${pkgs.git}/bin/git-shell";
+
       home = "/var/lib/cgit";
-      homeMode = 755;
-      shell = "${pkgs.git}/libexec/git-core/git-shell";
+      createHome = true;
+      homeMode = "755";
+
+      openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC3SjzIs3YI8PWJaNrAuaEeRcTcvIVHOKyCh2VwHTHEF"];
+    };
+    hjem.users."git".files = {
+      "git-shell-commands/set-description" = {
+        executable = true;
+        text = ''
+          #!/usr/bin/env bash
+          set -euo pipefail
+          repo="$1"
+          desc="$2"
+          base="/var/lib/cgit"
+          repo_path="$base/$repo"
+
+          test -d "$repo_path" || { echo "Repository does not exist"; exit 1; }
+
+          # Prevent path traversal
+          real=$(realpath "$repo_path")
+          if [[ "$real" != "$base/"* ]]; then
+              echo "Invalid path"
+              exit 1
+          fi
+
+          echo "$desc" | head -n 1 > "$repo_path/description"
 
-      openssh.authorizedKeys.keys = authorizedKeys;
+          echo "Description updated for '$repo'"
+        '';
+      };
+      "git-shell-commands/create-repo" = {
+        executable = true;
+        text = ''
+          #!/usr/bin/env bash
+          set -euo pipefail
+          repo="$1"
+          base="/var/lib/cgit"
+          repo_path="$base/$repo"
+
+          test -d "$repo_path" && { echo "Repository already exists."; exit 1; }
+
+          git init --bare "$repo_path"
+          echo "Repository '$repo' created"
+        '';
+      };
     };
 
     services.openssh.extraConfig = lib.mkAfter ''
@@ -30,12 +67,11 @@ in {
         AllowTcpForwarding no
         X11Forwarding no
         PermitTunnel no
-        ForceCommand git-shell
         PubkeyAuthentication yes
         AuthenticationMethods publickey
     '';
 
-    environment.etc."cgitrc" = ''
+    environment.etc."cgitrc".text = ''
       scan-path=/var/lib/cgit
       virtual-root=/
       repo.sort=age
@@ -43,9 +79,7 @@ in {
       readme=:README.md
     '';
 
-    services.fcgiwrap.instance."cgit" = {
-      enable = true;
-
+    services.fcgiwrap.instances."cgit" = {
       process = {
         user = "git";
         group = "git";
@@ -59,6 +93,10 @@ in {
       };
     };
 
+    networking.extraHosts = ''
+      127.0.0.1 git.ganymede
+    '';
+
     services.caddy.virtualHosts."git.ganymede".extraConfig = ''
       tls internal
 
diff --git a/modules/services/options.nix b/modules/services/options.nix
index ccc2038..aacdee9 100644
--- a/modules/services/options.nix
+++ b/modules/services/options.nix
@@ -72,6 +72,8 @@ in {
 
       goaccess.enable = mkEnableOption "GoAccess Real-Time Analytics";
 
+      cgit.enable = mkEnableOption "cgit web git frontend";
+
       mopidy = {
         enable = mkEnableOption "Mopidy MPD server";
         port = mkOption {