diff options
author | Franck Cuny <franck@fcuny.net> | 2023-05-10 18:18:15 -0700 |
---|---|---|
committer | Franck Cuny <franck@fcuny.net> | 2023-05-10 18:18:15 -0700 |
commit | bc95ae6e46b19e1f53deded39fbb44e40a41d348 (patch) | |
tree | 3bfca9c8c7b1ba6edb6433ebb89826bc3d51c121 | |
parent | profiles/music-server: fix backup configuration (diff) | |
download | world-bc95ae6e46b19e1f53deded39fbb44e40a41d348.tar.gz |
profiles/git-server: move gitolite and cgit
Diffstat (limited to '')
-rw-r--r-- | hosts/tahoe/default.nix | 1 | ||||
-rw-r--r-- | hosts/tahoe/services.nix | 8 | ||||
-rw-r--r-- | modules/services/cgit/default.nix | 112 | ||||
-rw-r--r-- | modules/services/default.nix | 2 | ||||
-rw-r--r-- | modules/services/gitolite/default.nix | 37 | ||||
-rw-r--r-- | profiles/git-server.nix | 129 |
6 files changed, 130 insertions, 159 deletions
diff --git a/hosts/tahoe/default.nix b/hosts/tahoe/default.nix index 17d0ae4..f3174e5 100644 --- a/hosts/tahoe/default.nix +++ b/hosts/tahoe/default.nix @@ -13,6 +13,7 @@ in "${self}/profiles/acme.nix" "${self}/profiles/nginx.nix" "${self}/profiles/unifi.nix" + "${self}/profiles/git-server.nix" "${self}/profiles/music-server.nix" "${self}/profiles/hardware/amd.nix" ]; diff --git a/hosts/tahoe/services.nix b/hosts/tahoe/services.nix index 94ee6bb..b8a1b34 100644 --- a/hosts/tahoe/services.nix +++ b/hosts/tahoe/services.nix @@ -27,14 +27,6 @@ in promtail.enable = true; node-exporter.enable = true; }; - - cgit = { - enable = true; - }; - gitolite = { - enable = true; - stateDir = "/var/lib/gitolite"; - }; syncthing.enable = true; backup = { enable = true; diff --git a/modules/services/cgit/default.nix b/modules/services/cgit/default.nix deleted file mode 100644 index e00790c..0000000 --- a/modules/services/cgit/default.nix +++ /dev/null @@ -1,112 +0,0 @@ -{ config, pkgs, lib, ... }: -let - cfg = config.my.services.cgit; - - # there's no need for web crawlers on that site - robots-deny = pkgs.writeText "robots.txt" '' - User-agent: * - Disallow: / - ''; - - cgitrc = '' - # Global configuration - virtual-root=/ - - enable-http-clone=1 - clone-url=https://git.fcuny.net/$CGIT_REPO_URL - - # I've fewer than 150 repos, all should be able to be listed on - # the main page - max-repo-count=150 - - # limit to year for the stats - max-stats=year - - snapshots=tar.gz - - source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py - about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh - - enable-git-config=1 - enable-index-owner=0 - - remove-suffix=1 - - # sort repositories by section and branches by date - repository-sort=age - branch-sort=age - - readme=:README.md - readme=:README.org - readme=:readme.org - - # print the number of modified files - enable-log-filecount=1 - # print the number of modified lines - enable-log-linecount=1 - enable-follow-links=1 - enable-blame=1 - - root-title=¯\_(°ペ)_/¯ - root-desc=source code of my various projects - - # don't index or follow - robots="noindex, nofollow" - - project-list=/var/lib/gitolite/projects.list - scan-path=/var/lib/gitolite/repositories - ''; -in -{ - options.my.services.cgit = with lib; { - enable = mkEnableOption "git web viewer"; - }; - - config = lib.mkIf cfg.enable { - services.fcgiwrap = { - enable = true; - user = "git"; - group = "git"; - }; - - services.nginx.virtualHosts."git.fcuny.net" = { - # make cgit the default site: if a request goes through nginx - # without a host header, this will be the default site we serve - # for that request. - default = true; - forceSSL = true; - enableACME = true; - listen = [ - { - addr = "192.168.6.40"; - port = 443; - ssl = true; - } - { - addr = "192.168.6.40"; - port = 80; - ssl = false; - } - ]; - locations = { - "~* ^.+.(css|png|ico)$" = { root = "${pkgs.cgit}/cgit"; }; - # as per https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md - # if you want to map a single file make sure the location starts with a =, e.g =/i.gif instead of /i.gif. - "=/robots.txt".alias = robots-deny; - "/".extraConfig = '' - include ${pkgs.nginx}/conf/fastcgi_params; - fastcgi_param CGIT_CONFIG ${pkgs.writeText "cgitrc" cgitrc}; - fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi; - fastcgi_split_path_info ^(/?)(.+)$; - fastcgi_param PATH_INFO $fastcgi_path_info; - fastcgi_param HTTP_HOST $server_name; - fastcgi_param QUERY_STRING $args; - fastcgi_pass unix:${config.services.fcgiwrap.socketAddress}; - if ($http_user_agent ~* "(Blackbox Exporter)" ) { - access_log off; - } - ''; - }; - }; - }; -} diff --git a/modules/services/default.nix b/modules/services/default.nix index 3d24cbb..4b2dcba 100644 --- a/modules/services/default.nix +++ b/modules/services/default.nix @@ -4,8 +4,6 @@ imports = [ ./avahi ./backup - ./cgit - ./gitolite ./monitoring ./samba ./sendsms diff --git a/modules/services/gitolite/default.nix b/modules/services/gitolite/default.nix deleted file mode 100644 index 1cfab29..0000000 --- a/modules/services/gitolite/default.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ config, pkgs, lib, ... }: -let cfg = config.my.services.gitolite; -in -{ - options.my.services.gitolite = with lib; { - enable = mkEnableOption "gitolite"; - stateDir = mkOption { - type = types.str; - example = "/var/lib/gitolite"; - description = "gitolite base directory"; - }; - }; - - # FIXME: I also ran the following as the git user: - # git config --global init.defaultBranch main - # to ensure that new repositories are created with the default - # branch set to `main'. - config = lib.mkIf cfg.enable { - services.gitolite = { - enable = true; - dataDir = cfg.stateDir; - adminPubkey = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo="; - user = "git"; - group = "git"; - extraGitoliteRc = '' - # Make dirs/files group readable, needed for webserver/cgit. (Default - # setting is 0077.) - $RC{UMASK} = 0027; - $RC{GIT_CONFIG_KEYS} = 'cgit.desc cgit.hide cgit.ignore cgit.owner cgit.section'; - $RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local"; - push( @{$RC{ENABLE}}, 'symbolic-ref' ); - ''; - }; - - my.services.backup = { paths = [ cfg.stateDir ]; }; - }; -} diff --git a/profiles/git-server.nix b/profiles/git-server.nix new file mode 100644 index 0000000..c49f0e1 --- /dev/null +++ b/profiles/git-server.nix @@ -0,0 +1,129 @@ +{ config, pkgs, lib, ... }: +let + vhostName = "git.fcuny.net"; + stateDir = "/var/lib/gitolite"; + + # there's no need for web crawlers on that site + robots-deny = pkgs.writeText "robots.txt" '' + User-agent: * + Disallow: / + ''; + + cgitrc = '' + # Global configuration + virtual-root=/ + + enable-http-clone=1 + clone-url=https://${vhostName}/$CGIT_REPO_URL + + # I've fewer than 150 repos, all should be able to be listed on + # the main page + max-repo-count=150 + + # limit to year for the stats + max-stats=year + + snapshots=tar.gz + + source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py + about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh + + enable-git-config=1 + enable-index-owner=0 + + remove-suffix=1 + + # sort repositories by section and branches by date + repository-sort=age + branch-sort=age + + readme=:README.md + readme=:README.org + readme=:readme.org + + # print the number of modified files + enable-log-filecount=1 + + # print the number of modified lines + enable-log-linecount=1 + enable-follow-links=1 + enable-blame=1 + + root-title=¯\_(°ペ)_/¯ + root-desc=source code of my various projects + + # don't index or follow + robots="noindex, nofollow" + + project-list=${stateDir}/projects.list + scan-path=${stateDir}/repositories + ''; +in +{ + + # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/fcgiwrap.nix + services.fcgiwrap = { + enable = true; + user = "git"; + group = "git"; + }; + + services.nginx.virtualHosts."${vhostName}" = { + # make cgit the default site: if a request goes through nginx + # without a host header, this will be the default site we serve + # for that request. + default = true; + forceSSL = true; + enableACME = true; + listen = [ + { + addr = "192.168.6.40"; + port = 443; + ssl = true; + } + { + addr = "192.168.6.40"; + port = 80; + ssl = false; + } + ]; + locations = { + "~* ^.+.(css|png|ico)$" = { root = "${pkgs.cgit}/cgit"; }; + # as per https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md + # if you want to map a single file make sure the location starts with a =, e.g =/i.gif instead of /i.gif. + "=/robots.txt".alias = robots-deny; + "/".extraConfig = '' + include ${pkgs.nginx}/conf/fastcgi_params; + fastcgi_param CGIT_CONFIG ${pkgs.writeText "cgitrc" cgitrc}; + fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi; + fastcgi_split_path_info ^(/?)(.+)$; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param HTTP_HOST $server_name; + fastcgi_param QUERY_STRING $args; + fastcgi_pass unix:${config.services.fcgiwrap.socketAddress}; + if ($http_user_agent ~* "(Blackbox Exporter)" ) { + access_log off; + } + ''; + }; + }; + + # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/gitolite.nix + services.gitolite = { + enable = true; + dataDir = stateDir; + adminPubkey = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo="; + user = "git"; + group = "git"; + extraGitoliteRc = '' + # Make dirs/files group readable, needed for webserver/cgit. (Default + # setting is 0077.) + $RC{UMASK} = 0027; + $RC{GIT_CONFIG_KEYS} = 'cgit.desc cgit.hide cgit.ignore cgit.owner cgit.section'; + $RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local"; + push( @{$RC{ENABLE}}, 'symbolic-ref' ); + ''; + }; + + my.services.backup.paths = [ cfg.stateDir ]; +} |