1 files changed, 78 insertions, 0 deletions
diff --git a/modules/services/nixos/cgit.nix b/modules/services/nixos/cgit.nix
new file mode 100644
index 0000000..235335f
--- /dev/null
+++ b/modules/services/nixos/cgit.nix
@@ -0,0 +1,78 @@
+{
+  pkgs,
+  config,
+  lib,
+  hosts,
+  ...
+}: let
+  cfg = config.collinux.services.cgit;
+
+  authorizedKeys =
+    hosts
+    |> builtins.mapAttrs (_: data: ''command="git-shell -c \"$SSH_ORIGINAL_COMMAND\"" ${data.user_pubkey or null}'')
+    |> builtins.attrValues
+    |> builtins.filter (x: x != null);
+in {
+  config = lib.mkIf cfg.enable {
+    users.groups."git" = {};
+    users.users."git" = {
+      isSystemUser = true;
+      group = "git";
+      home = "/var/lib/cgit";
+      homeMode = 755;
+      shell = "${pkgs.git}/libexec/git-core/git-shell";
+
+      openssh.authorizedKeys.keys = authorizedKeys;
+    };
+
+    services.openssh.extraConfig = lib.mkAfter ''
+      Match User git
+        AllowTcpForwarding no
+        X11Forwarding no
+        PermitTunnel no
+        ForceCommand git-shell
+        PubkeyAuthentication yes
+        AuthenticationMethods publickey
+    '';
+
+    environment.etc."cgitrc" = ''
+      scan-path=/var/lib/cgit
+      virtual-root=/
+      repo.sort=age
+
+      readme=:README.md
+    '';
+
+    services.fcgiwrap.instance."cgit" = {
+      enable = true;
+
+      process = {
+        user = "git";
+        group = "git";
+      };
+
+      socket = {
+        user = "caddy";
+        group = "caddy";
+        type = "unix";
+        address = "/run/fcgiwrap-cgit.sock";
+      };
+    };
+
+    services.caddy.virtualHosts."git.ganymede".extraConfig = ''
+      tls internal
+
+      @assets path /cgit.css /cgit.js /cgit.png /favicon.ico /robots.txt
+      handle @assets {
+      	root * ${pkgs.cgit}/cgit
+      	file_server
+      }
+
+      reverse_proxy unix//run/fcgiwrap-cgit.sock {
+      	transport fastcgi {
+      		env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi
+      	}
+      }
+    '';
+  };
+}