feat(hosts/tahoe): install gitolite and cgit

Replace gitea with gitolite + cgit. I don't need a whole git forge for
myself, especially since I don't use most of the features.

The main thing I'm losing with this change is CI (via drone), but this
is not really a big loss for now.

4 files changed, 145 insertions, 9 deletions

diff --git a/hosts/tahoe/services.nix b/hosts/tahoe/services.nix
index 3c47417..f4c8e95 100644
--- a/hosts/tahoe/services.nix
+++ b/hosts/tahoe/services.nix
@@ -21,20 +21,17 @@ in
       enable = true;
       vhostName = "unifi.fcuny.xyz";
     };
-    gitea = {
+    prometheus = { enable = true; };
+    grafana = {
       enable = true;
-      stateDir = "/var/lib/gitea";
+      vhostName = "dash.fcuny.xyz";
     };
-    drone = {
+    cgit = {
       enable = true;
-      vhostName = "ci.fcuny.net";
-      runners = [ "docker" "exec" ];
-      sharedSecretFile = secrets."drone/secrets".path;
     };
-    prometheus = { enable = true; };
-    grafana = {
+    gitolite = {
       enable = true;
-      vhostName = "dash.fcuny.xyz";
+      stateDir = "/var/lib/gitolite";
     };
     rclone = { enable = true; };
     nginx = { enable = true; };
diff --git a/modules/services/cgit/default.nix b/modules/services/cgit/default.nix
new file mode 100644
index 0000000..0010635
--- /dev/null
+++ b/modules/services/cgit/default.nix
@@ -0,0 +1,100 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.my.services.cgit;
+
+  # there's no need for web crawlers on that site
+  robots-deny = pkgs.writeText "robots.txt" ''
+    User-agent: *
+    Disallow: /
+  '';
+
+  cgitrc = ''
+    # Global configuration
+    virtual-root=/
+
+    enable-http-clone=1
+    clone-url=https://git.fcuny.net/$CGIT_REPO_URL
+
+    # I've fewer than 150 repos, all should be able to be listed on
+    # the main page
+    max-repo-count=150
+
+    # limit to year for the stats
+    max-stats=year
+
+    snapshots=tar.gz
+
+    source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
+    about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh
+
+    enable-git-config=1
+    enable-index-owner=0
+
+    remove-suffix=1
+
+    # sort repositories by section and branches by date
+    repository-sort=age
+    branch-sort=age
+
+    readme=:README.md
+    readme=:README.org
+    readme=:readme.org
+
+    # print the number of modified files
+    enable-log-filecount=1
+    # print the number of modified lines
+    enable-log-linecount=1
+    enable-follow-links=1
+    enable-blame=1
+
+    root-title="¯\_(ツ)_/¯"
+    root-desc="source code of my various projects"
+
+    # don't index or follow
+    robots="noindex, nofollow"
+
+    project-list=/var/lib/gitolite/projects.list
+    scan-path=/var/lib/gitolite/repositories
+  '';
+in
+{
+  options.my.services.cgit = with lib; {
+    enable = mkEnableOption "git web viewer";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.fcgiwrap = {
+      enable = true;
+      user = "git";
+      group = "git";
+    };
+
+    services.nginx.virtualHosts."git.fcuny.net" = {
+      # make cgit the default site: if a request goes through nginx
+      # without a host header, this will be the default site we serve
+      # for that request.
+      default = true;
+      forceSSL = true;
+      enableACME = true;
+      locations = {
+        "~* ^.+.(css|png|ico)$" = { root = "${pkgs.cgit}/cgit"; };
+        # as per https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md
+        # if you want to map a single file make sure the location starts with a =, e.g =/i.gif instead of /i.gif.
+        "=/robots.txt".alias = robots-deny;
+        "/".extraConfig = ''
+          include ${pkgs.nginx}/conf/fastcgi_params;
+          fastcgi_param CGIT_CONFIG ${pkgs.writeText "cgitrc" cgitrc};
+          fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
+          fastcgi_split_path_info ^(/?)(.+)$;
+          fastcgi_param PATH_INFO $fastcgi_path_info;
+          fastcgi_param HTTP_HOST $server_name;
+          fastcgi_param QUERY_STRING $args;
+          fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
+          if ($http_user_agent ~* "(Blackbox Exporter)" ) {
+            access_log off;
+          }
+        '';
+      };
+    };
+  };
+}
diff --git a/modules/services/default.nix b/modules/services/default.nix
index 758a7cf..d215173 100644
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -4,9 +4,11 @@
   imports = [
     ./avahi
     ./backup
+    ./cgit
     ./drone
     ./fwupd
     ./gitea
+    ./gitolite
     ./gnome
     ./grafana
     ./metrics-exporter
diff --git a/modules/services/gitolite/default.nix b/modules/services/gitolite/default.nix
new file mode 100644
index 0000000..1cfab29
--- /dev/null
+++ b/modules/services/gitolite/default.nix
@@ -0,0 +1,37 @@
+{ config, pkgs, lib, ... }:
+let cfg = config.my.services.gitolite;
+in
+{
+  options.my.services.gitolite = with lib; {
+    enable = mkEnableOption "gitolite";
+    stateDir = mkOption {
+      type = types.str;
+      example = "/var/lib/gitolite";
+      description = "gitolite base directory";
+    };
+  };
+
+  # FIXME: I also ran the following as the git user:
+  # git config --global init.defaultBranch main
+  # to ensure that new repositories are created with the default
+  # branch set to `main'.
+  config = lib.mkIf cfg.enable {
+    services.gitolite = {
+      enable = true;
+      dataDir = cfg.stateDir;
+      adminPubkey = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo=";
+      user = "git";
+      group = "git";
+      extraGitoliteRc = ''
+        # Make dirs/files group readable, needed for webserver/cgit. (Default
+        # setting is 0077.)
+        $RC{UMASK} = 0027;
+        $RC{GIT_CONFIG_KEYS} = 'cgit.desc cgit.hide cgit.ignore cgit.owner cgit.section';
+        $RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local";
+        push( @{$RC{ENABLE}}, 'symbolic-ref' );
+      '';
+    };
+
+    my.services.backup = { paths = [ cfg.stateDir ]; };
+  };
+}