blob: e1726bc6a0e0dc10fc527419a82d179cef0d6e1e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
|
{
pkgs,
config,
lib,
...
}: let
cfg = config.collinux.services.cgit;
in {
config = lib.mkIf cfg.enable {
environment.shells = ["${pkgs.git}/bin/git-shell"];
users.groups."git" = {};
users.users."git" = {
isSystemUser = true;
group = "git";
shell = "${pkgs.git}/bin/git-shell";
home = "/var/lib/cgit";
createHome = true;
homeMode = "755";
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC3SjzIs3YI8PWJaNrAuaEeRcTcvIVHOKyCh2VwHTHEF"];
};
hjem.users."git".files = {
"git-shell-commands/set-description" = {
executable = true;
text = ''
#!/usr/bin/env bash
set -euo pipefail
repo="$1"
desc="$2"
base="/var/lib/cgit"
repo_path="$base/$repo"
test -d "$repo_path" || { echo "Repository does not exist"; exit 1; }
# Prevent path traversal
real=$(realpath "$repo_path")
if [[ "$real" != "$base/"* ]]; then
echo "Invalid path"
exit 1
fi
echo "$desc" | head -n 1 > "$repo_path/description"
echo "Description updated for '$repo'"
'';
};
"git-shell-commands/create-repo" = {
executable = true;
text = ''
#!/usr/bin/env bash
set -euo pipefail
repo="$1"
base="/var/lib/cgit"
repo_path="$base/$repo"
test -d "$repo_path" && { echo "Repository already exists."; exit 1; }
git init --bare "$repo_path"
echo "Repository '$repo' created"
'';
};
};
services.openssh.extraConfig = lib.mkAfter ''
Match User git
AllowTcpForwarding no
X11Forwarding no
PermitTunnel no
PubkeyAuthentication yes
AuthenticationMethods publickey
'';
environment.etc."cgitrc".text = ''
logo=/favicon.svg
favicon=/favicon.svg
repo.sort=age
enable-http-clone=1
diff-style=ssdiff
root-title=Ganymede Public Git Server
root-desc=
readme=:README.md
about-filter=${pkgs.cgit}/lib/cgit/filters/html-converters/md2html
virtual-root=/
scan-path=/var/lib/cgit
'';
services.fcgiwrap.instances."cgit" = {
process = {
user = "git";
group = "git";
};
socket = {
user = "caddy";
group = "caddy";
type = "unix";
address = "/run/fcgiwrap-cgit.sock";
};
};
networking.extraHosts = "127.0.0.1 git.ganymede";
services.caddy.virtualHosts."git.ganymede".extraConfig = let
custom_cgit = pkgs.stdenv.mkDerivation {
name = "custom-cgit-assets";
src = pkgs.cgit;
installPhase = ''
mkdir -p $out
cp -pPR ./cgit/* $out/
rm -f $out/cgit.png $out/favicon.ico
cp -f ${../favicon.svg} $out/favicon.svg
'';
};
in ''
tls internal
@assets path /cgit.css /cgit.js /favicon.svg /robots.txt
handle @assets {
root * ${custom_cgit}
file_server
}
reverse_proxy unix//run/fcgiwrap-cgit.sock {
transport fastcgi {
env SCRIPT_FILENAME ${custom_cgit}/cgit.cgi
}
}
'';
};
}
|
