From ad1b478db47c44c538d82095c8c7f61d34de694d Mon Sep 17 00:00:00 2001
From: Franck Cuny <franck@fcuny.net>
Date: Mon, 5 Aug 2024 17:42:33 -0700
Subject: attempt at configuring cgit and gitolite

---
 nix/hosts/wildcat/configuration.nix | 55 +++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

(limited to 'nix')

diff --git a/nix/hosts/wildcat/configuration.nix b/nix/hosts/wildcat/configuration.nix
index e3d5a9b..670db0d 100644
--- a/nix/hosts/wildcat/configuration.nix
+++ b/nix/hosts/wildcat/configuration.nix
@@ -12,6 +12,32 @@
     acceptTerms = true;
   };
 
+  # FIXME: I also ran the following as the git user:
+  # git config --global init.defaultBranch main
+  # to ensure that new repositories are created with the default
+  # branch set to `main'.
+  services.gitolite = {
+    enable = true;
+    dataDir = "/var/lib/gitolite";
+    adminPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi";
+    user = "git";
+    group = "git";
+    extraGitoliteRc = ''
+      # Make dirs/files group readable, needed for webserver/cgit. (Default
+      # setting is 0077.)
+      $RC{UMASK} = 0027;
+      $RC{GIT_CONFIG_KEYS} = 'cgit.desc cgit.hide cgit.ignore cgit.owner cgit.section';
+      $RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local";
+      push( @{$RC{ENABLE}}, 'symbolic-ref' );
+    '';
+  };
+
+  services.fcgiwrap = {
+    enable = true;
+    user = "git";
+    group = "git";
+  };
+
   services.nginx = {
     enable = true;
 
@@ -33,6 +59,35 @@
           };
         };
       };
+      "git.fcuny.net" = {
+        # make cgit the default site: if a request goes through nginx
+        # without a host header, this will be the default site we serve
+        # for that request.
+        default = true;
+        forceSSL = true;
+        enableACME = true;
+        locations = {
+          "/.well-known/acme-challenge" = {
+            root = "/var/lib/acme/acme-challenges";
+          };
+          "~* ^.+.(css|png|ico)$" = {
+            root = "${pkgs.cgit}/cgit";
+          };
+          # as per https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md
+          # if you want to map a single file make sure the location starts with a =, e.g =/i.gif instead of /i.gif.
+          "=/robots.txt".alias = robots-deny;
+          "/".extraConfig = ''
+            include ${pkgs.nginx}/conf/fastcgi_params;
+            fastcgi_param CGIT_CONFIG ${pkgs.writeText "cgitrc" cgitrc};
+            fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
+            fastcgi_split_path_info ^(/?)(.+)$;
+            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param HTTP_HOST $server_name;
+            fastcgi_param QUERY_STRING $args;
+            fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
+          '';
+        };
+      };
     };
   };
 }
-- 
cgit 1.4.1