blob: 477e6786265379cca55e112238e92bdd25c5fe31 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
{
pkgs,
config,
lib,
...
}: let
cfg = config.collinux.services.cgit;
custom_cgit = pkgs.stdenv.mkDerivation {
name = "custom-cgit-assets";
src = pkgs.cgit;
installPhase = ''
mkdir -p $out
cp -pPR ./cgit/* $out/
rm -f $out/cgit.png $out/favicon.ico $out/cgit.css
cp -f ${./cgit.css} $out/cgit.css
'';
};
md2html = pkgs.writeShellScriptBin "md2html.sh" ''
#!/bin/sh
echo '<div class="markdown-body">'
${lib.getExe pkgs.cmark-gfm} \
--extension table \
--extension tasklist \
--extension strikethrough \
--extension autolink
echo '</div>'
'';
in {
imports = [./gitShellCommands.nix];
config = lib.mkIf cfg.enable {
users.groups."git" = {};
users.users."git" = {
isSystemUser = true;
group = "git";
shell = lib.getExe pkgs.git;
home = "/var/lib/cgit";
createHome = true;
homeMode = "755";
openssh.authorizedKeys.keys = ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC3SjzIs3YI8PWJaNrAuaEeRcTcvIVHOKyCh2VwHTHEF"];
};
services.openssh.extraConfig = lib.mkAfter ''
Match User git
AllowTcpForwarding no
X11Forwarding no
PermitTunnel no
PubkeyAuthentication yes
AuthenticationMethods publickey
'';
environment.etc."cgitrc".text = ''
repo.sort=age
enable-http-clone=1
enable-commit-graph=1
root-title=git@ganymede
root-desc=Git repos associated with Ganymede
readme=:README.md
about-filter=${md2html}/bin/md2html.sh
source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
head-include=${./cgit-head.html}
footer=
virtual-root=/
scan-path=/var/lib/cgit
'';
services.fcgiwrap.instances."cgit" = {
process = {
user = "git";
group = "git";
};
socket = {
user = "caddy";
group = "caddy";
type = "unix";
address = "/run/fcgiwrap-cgit.sock";
};
};
services.caddy.virtualHosts."git.ganymede".extraConfig = ''
tls internal
@assets path /cgit.css /cgit.js /favicon.svg /robots.txt
handle @assets {
root * ${custom_cgit}
file_server
}
reverse_proxy unix//run/fcgiwrap-cgit.sock {
transport fastcgi {
env SCRIPT_FILENAME ${custom_cgit}/cgit.cgi
}
}
'';
collinux.services.glance.homelabServices."git" = {
url = "https://git.ganymede";
icon = "si:git";
};
};
}
|
