blob: ed8bce27aec4e6595c550d92999105673fd4586e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
{
pkgs,
config,
lib,
...
}: let
cfg = config.collinux.services.cgit;
in {
config = lib.mkIf cfg.enable {
environment.shells = ["${pkgs.git}/bin/git-shell"];
users.groups."git" = {};
users.users."git" = {
isSystemUser = true;
group = "git";
shell = "${pkgs.git}/bin/git-shell";
home = "/var/lib/cgit";
createHome = true;
homeMode = "755";
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC3SjzIs3YI8PWJaNrAuaEeRcTcvIVHOKyCh2VwHTHEF"];
};
hjem.users."git".files = {
"git-shell-commands/set-description" = {
executable = true;
text = ''
#!/usr/bin/env bash
set -euo pipefail
repo="$1"
desc="$2"
base="/var/lib/cgit"
repo_path="$base/$repo"
test -d "$repo_path" || { echo "Repository does not exist"; exit 1; }
# Prevent path traversal
real=$(realpath "$repo_path")
if [[ "$real" != "$base/"* ]]; then
echo "Invalid path"
exit 1
fi
echo "$desc" | head -n 1 > "$repo_path/description"
echo "Description updated for '$repo'"
'';
};
"git-shell-commands/create-repo" = {
executable = true;
text = ''
#!/usr/bin/env bash
set -euo pipefail
repo="$1"
base="/var/lib/cgit"
repo_path="$base/$repo"
test -d "$repo_path" && { echo "Repository already exists."; exit 1; }
git init --bare "$repo_path"
echo "Repository '$repo' created"
'';
};
};
services.openssh.extraConfig = lib.mkAfter ''
Match User git
AllowTcpForwarding no
X11Forwarding no
PermitTunnel no
PubkeyAuthentication yes
AuthenticationMethods publickey
'';
environment.etc."cgitrc".text = ''
scan-path=/var/lib/cgit
virtual-root=/
repo.sort=age
readme=:README.md
'';
services.fcgiwrap.instances."cgit" = {
process = {
user = "git";
group = "git";
};
socket = {
user = "caddy";
group = "caddy";
type = "unix";
address = "/run/fcgiwrap-cgit.sock";
};
};
networking.extraHosts = ''
127.0.0.1 git.ganymede
'';
services.caddy.virtualHosts."git.ganymede".extraConfig = ''
tls internal
@assets path /cgit.css /cgit.js /cgit.png /favicon.ico /robots.txt
handle @assets {
root * ${pkgs.cgit}/cgit
file_server
}
reverse_proxy unix//run/fcgiwrap-cgit.sock {
transport fastcgi {
env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi
}
}
'';
};
}
|
