blob: 0f81958078d60200e09a36c25812e052adc4c367 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
{
pkgs,
config,
lib,
...
}: let
cfg = config.collinux.services.cgit;
in {
config = lib.mkIf cfg.enable {
environment.shells = ["${pkgs.git}/bin/git-shell"];
users.groups."git" = {};
users.users."git" = {
isSystemUser = true;
group = "git";
shell = "${pkgs.git}/bin/git-shell";
home = "/var/lib/cgit";
createHome = true;
homeMode = "755";
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC3SjzIs3YI8PWJaNrAuaEeRcTcvIVHOKyCh2VwHTHEF"];
};
hjem.users."git".files = {
"git-shell-commands/set-description" = {
executable = true;
text = ''
#!/usr/bin/env bash
set -euo pipefail
repo="$1"
desc="$2"
base="/var/lib/cgit"
repo_path="$base/$repo"
test -d "$repo_path" || { echo "Repository does not exist"; exit 1; }
# Prevent path traversal
real=$(realpath "$repo_path")
if [[ "$real" != "$base/"* ]]; then
echo "Invalid path"
exit 1
fi
echo "$desc" | head -n 1 > "$repo_path/description"
echo "Description updated for '$repo'"
'';
};
"git-shell-commands/create-repo" = {
executable = true;
text = ''
#!/usr/bin/env bash
set -euo pipefail
repo="$1"
base="/var/lib/cgit"
repo_path="$base/$repo"
test -d "$repo_path" && { echo "Repository already exists."; exit 1; }
git init --bare "$repo_path"
echo "Repository '$repo' created"
'';
};
};
services.openssh.extraConfig = lib.mkAfter ''
Match User git
AllowTcpForwarding no
X11Forwarding no
PermitTunnel no
PubkeyAuthentication yes
AuthenticationMethods publickey
'';
environment.etc."cgitrc".text = ''
logo=/favicon.svg
favicon=/favicon.svg
repo.sort=age
enable-http-clone=1
enable-commit-graph=1
side-by-side-diffs=1
root-title=git@ganymede
root-desc=Git repos associated with Ganymede
readme=:README.md
about-filter=${pkgs.cgit}/lib/cgit/filters/html-converters/md2html
source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
footer=
virtual-root=/
scan-path=/var/lib/cgit
'';
services.fcgiwrap.instances."cgit" = {
process = {
user = "git";
group = "git";
};
socket = {
user = "caddy";
group = "caddy";
type = "unix";
address = "/run/fcgiwrap-cgit.sock";
};
};
networking.extraHosts = "127.0.0.1 git.ganymede";
services.caddy.virtualHosts."git.ganymede".extraConfig = let
custom_cgit = pkgs.stdenv.mkDerivation {
name = "custom-cgit-assets";
src = pkgs.cgit;
installPhase = ''
mkdir -p $out
cp -pPR ./cgit/* $out/
rm -f $out/cgit.png $out/favicon.ico $out/cgit.css
cp -f ${./favicon.svg} $out/favicon.svg
cp -f ${./cgit.css} $out/cgit.css
'';
};
in ''
tls internal
@assets path /cgit.css /cgit.js /favicon.svg /robots.txt
handle @assets {
root * ${custom_cgit}
file_server
}
reverse_proxy unix//run/fcgiwrap-cgit.sock {
transport fastcgi {
env SCRIPT_FILENAME ${custom_cgit}/cgit.cgi
}
}
'';
};
}
|
