From da80bdbe5f325e06b9d4f01274f8b30efe4facf1 Mon Sep 17 00:00:00 2001
From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com>
Date: Sat, 21 Feb 2026 17:18:40 -0600
Subject: add cgit

---
 modules/services/nixos/cgit.nix    | 78 ++++++++++++++++++++++++++++++++++++++
 modules/services/nixos/default.nix |  1 +
 2 files changed, 79 insertions(+)
 create mode 100644 modules/services/nixos/cgit.nix

(limited to 'modules/services')

diff --git a/modules/services/nixos/cgit.nix b/modules/services/nixos/cgit.nix
new file mode 100644
index 0000000..235335f
--- /dev/null
+++ b/modules/services/nixos/cgit.nix
@@ -0,0 +1,78 @@
+{
+  pkgs,
+  config,
+  lib,
+  hosts,
+  ...
+}: let
+  cfg = config.collinux.services.cgit;
+
+  authorizedKeys =
+    hosts
+    |> builtins.mapAttrs (_: data: ''command="git-shell -c \"$SSH_ORIGINAL_COMMAND\"" ${data.user_pubkey or null}'')
+    |> builtins.attrValues
+    |> builtins.filter (x: x != null);
+in {
+  config = lib.mkIf cfg.enable {
+    users.groups."git" = {};
+    users.users."git" = {
+      isSystemUser = true;
+      group = "git";
+      home = "/var/lib/cgit";
+      homeMode = 755;
+      shell = "${pkgs.git}/libexec/git-core/git-shell";
+
+      openssh.authorizedKeys.keys = authorizedKeys;
+    };
+
+    services.openssh.extraConfig = lib.mkAfter ''
+      Match User git
+        AllowTcpForwarding no
+        X11Forwarding no
+        PermitTunnel no
+        ForceCommand git-shell
+        PubkeyAuthentication yes
+        AuthenticationMethods publickey
+    '';
+
+    environment.etc."cgitrc" = ''
+      scan-path=/var/lib/cgit
+      virtual-root=/
+      repo.sort=age
+
+      readme=:README.md
+    '';
+
+    services.fcgiwrap.instance."cgit" = {
+      enable = true;
+
+      process = {
+        user = "git";
+        group = "git";
+      };
+
+      socket = {
+        user = "caddy";
+        group = "caddy";
+        type = "unix";
+        address = "/run/fcgiwrap-cgit.sock";
+      };
+    };
+
+    services.caddy.virtualHosts."git.ganymede".extraConfig = ''
+      tls internal
+
+      @assets path /cgit.css /cgit.js /cgit.png /favicon.ico /robots.txt
+      handle @assets {
+      	root * ${pkgs.cgit}/cgit
+      	file_server
+      }
+
+      reverse_proxy unix//run/fcgiwrap-cgit.sock {
+      	transport fastcgi {
+      		env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi
+      	}
+      }
+    '';
+  };
+}
diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix
index 48c14b6..738213f 100644
--- a/modules/services/nixos/default.nix
+++ b/modules/services/nixos/default.nix
@@ -2,6 +2,7 @@
   imports = [
     ./mopidy.nix
     ./forgejo.nix
+    ./cgit.nix
     ./openssh.nix
     # ./jellyfin.nix
     ./caddy.nix
-- 
cgit v1.3.1