cgit config on poweredge pro

5 files changed, 108 insertions, 148 deletions

diff --git a/hosts/poweredge-pro/cgit.nix b/hosts/poweredge-pro/cgit.nix
new file mode 100644
index 0000000..9927301
--- /dev/null
+++ b/hosts/poweredge-pro/cgit.nix
@@ -0,0 +1,106 @@
+let
+	publicUrl = "git.tjkeller.xyz";
+	rootTitle = "git.TJKeller.xyz";
+	rootDesc = "TJK's git repositories, served by cgit";
+	scanPath = "/srv/git";
+	sectionFromStartpath = 0;
+	maxRepoCount = 100;
+in {
+
+	containers.cgit = {
+		autoStart = true;
+		privateNetwork = true;
+		ephemeral = true;
+		hostBridge = "br-lan1";
+		localMacAddress = "02:00:00:00:77:08";
+
+		bindMounts = {
+			${scanPath} = {
+				hostPath = "/nix/persist/cgit/srv/git";
+				isReadOnly = false;
+			};
+		};
+
+		config = { pkgs, lib, config, ... }: {
+			# Networking
+			networking.interfaces.eth0.useDHCP = true;
+			networking.firewall.allowedTCPPorts = [ 80 22 9418 ];  # nginx, ssh, git-daemon
+
+			# Enable ssh service
+			services.openssh.enable = true;
+
+			# Create git user for ssh access
+			# git user and group are uid/gid 41 as defined by gitDaemon & nixpkgs/nixos/modules/misc/ids.nix
+			users.users.git = {
+				isSystemUser = true;
+				group = "git";
+				home = scanPath;  # Serve from git user's home to allow cloning git@cgit:repo
+				createHome = true;
+				homeMode = "750";  # Allow read permissions for group members
+				shell = pkgs.bash;
+				#openssh = { inherit authorizedKeys; };
+			};
+			users.groups.git.members = [ "nginx" ];  # Create the git group and add nginx user as a member so scanPath can be served by cgit
+
+			# Enable cgit service
+			services.cgit.main = {
+				enable = true;
+				inherit scanPath;
+				nginx.virtualHost = "cgit";
+				user = "git";
+				group = "git";
+				gitHttpBackend.checkExportOkFiles = true;  # only serve repos containing git-daemon-export-ok
+				settings = {
+					# Based on joseluisq/alpine-cgit
+					root-title = rootTitle;
+					root-desc = rootDesc;
+
+					source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
+					about-filter  = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
+
+					readme = [ ":README" ":README.html" ":README.md" ":README.txt" ];
+
+					# Cache
+					#cache-root=/var/cache/cgit
+					#cache-size=2000
+
+					enable-index-links = 1;
+					enable-index-owner = 0;
+					enable-remote-branches = 1;
+					enable-log-filecount = 1;
+					enable-log-linecount = 1;
+					enable-git-config = 1;
+					snapshots = "tar.xz zip";
+
+					robots = "noindex, nofollow";
+
+					scan-path = scanPath;
+					virtual-root = "/";
+					section-from-path = sectionFromStartpath;
+					max-repo-count = maxRepoCount;
+
+					clone-prefix = "https://${publicUrl} git://${publicUrl}";
+					max-stats = "month";
+
+					enable-http-clone = false;  # optional: let git-http-backend handle all clones
+					strict-export = "git-daemon-export-ok";
+				};
+			};
+			services.nginx.virtualHosts."cgit".default = true;
+
+			# Enable git program
+			programs.git.enable = true;
+
+			# Enable git daemon
+			services.gitDaemon = {
+				enable = true;
+				basePath = scanPath;
+				exportAll = false;  # only export repos containing git-daemon-export-ok
+				listenAddress = "0.0.0.0";
+				port = 9418;
+			};
+
+			system.stateVersion = "26.05";
+		};
+	};
+}
diff --git a/hosts/poweredge-pro/configuration.nix b/hosts/poweredge-pro/configuration.nix
index 483b14e..f3ea1fb 100644
--- a/hosts/poweredge-pro/configuration.nix
+++ b/hosts/poweredge-pro/configuration.nix
@@ -1,5 +1,6 @@
 { config, lib, pkgs, ... }: {
 	imports = [
+		./cgit.nix
 		./dns.nix
 		./embedtube.nix
 		./filebrowser.nix
diff --git a/hosts/poweredge-pro/dhcp-hosts.nix b/hosts/poweredge-pro/dhcp-hosts.nix
index 6ca6ca7..08e3ebd 100644
--- a/hosts/poweredge-pro/dhcp-hosts.nix
+++ b/hosts/poweredge-pro/dhcp-hosts.nix
@@ -11,6 +11,7 @@ let
 		devel             = { macAddress = "00:a0:98:79:81:5a"; staticIp = "192.168.77.3";   };
 		mailcow           = { macAddress = "00:a0:98:79:20:a2"; staticIp = "192.168.77.7";   };
 		tjkeller          = { macAddress = "00:a0:98:62:cf:86"; staticIp = "192.168.77.8";   };
+		cgit              = { macAddress = "02:00:00:00:77:08"; staticIp = "192.168.77.88";  };
 		filebrowser       = { macAddress = "02:00:00:00:77:12"; staticIp = "192.168.77.12";  };
 		searxng           = { macAddress = "02:00:00:00:77:13"; staticIp = "192.168.77.13";  };
 		embedtube         = { macAddress = "02:00:00:00:77:14"; staticIp = "192.168.77.14";  };
diff --git a/nixos/services/cgit.nix b/nixos/services/cgit.nix
deleted file mode 100644
index 66de1d8..0000000
--- a/nixos/services/cgit.nix
+++ /dev/null
@@ -1,142 +0,0 @@
-{ lib, pkgs, config, ... }:
-let
-	cfg = config.services._cgit;
-in {
-	options.services._cgit = {
-		enable = lib.mkEnableOption "enables cgit service";
-		hostAddress = lib.mkOption {
-			type = lib.types.str;
-			description = "hostAddress for the container";
-			default = "10.0.1.1";
-		};
-		localAddress = lib.mkOption {
-			type = lib.types.str;
-			description = "localAddress for the container";
-			default = "10.0.1.2";
-		};
-		rootTitle = lib.mkOption {
-			type = lib.types.str;
-			description = "cgit site title";
-			default = "";
-		};
-		rootDesc = lib.mkOption {
-			type = lib.types.str;
-			description = "cgit site description";
-			default = "";
-		};
-		extraConfig = lib.mkOption {
-			type = lib.types.str;
-			description = "cgitrc lines inserted verbatim at the end";
-			default = "";
-		};
-		ssh.authorizedKeys = {
-			keys = lib.mkOption {
-				type = lib.types.listOf lib.types.singleLineStr;
-				default = [ ];
-				description = ''
-					see `options.openssh.authorizedKeys.keys`.
-					ssh authorized keys for git user in container.
-				'';
-			};
-			keyFiles = lib.mkOption {
-				type = lib.types.listOf lib.types.path;
-				default = [ ];
-				description = ''
-					see `options.openssh.authorizedKeys.keyFiles`.
-					ssh authorized keys for git user in container.
-				'';
-			};
-		};
-	};
-
-	config = lib.mkIf cfg.enable {
-		# Configure cgit container
-		containers.cgit = {
-			autoStart = true;
-			privateNetwork = true;
-			hostAddress  = cfg.hostAddress;
-			localAddress = cfg.localAddress;
-
-			specialArgs = {
-				authorizedKeys = cfg.ssh.authorizedKeys;
-				cgitrc = with cfg; {
-					inherit rootTitle;
-					inherit rootDesc;
-					inherit extraConfig;
-				};
-			};
-
-			config = { lib, config, authorizedKeys, cgitrc, ... }: {
-				# Create git user for ssh access
-				users.users.git = {
-					isNormalUser = true;
-					home = "/srv/git";  # Serve from git user's home to allow cloning git@cgit:repo
-					group = "git";
-					createHome = true;
-					homeMode = "750";  # Allow read permissions for group members
-					shell = pkgs.bash;
-					openssh = { inherit authorizedKeys; };
-				};
-				users.groups.git.members = [ "lighttpd" ];  # Create the git group and add lighttpd user as a member so /srv/git can be served by cgit
-
-				# Enable git
-				programs.git.enable = true;
-
-				# Enable ssh service
-				services.openssh.enable = true;
-
-				# Enable cgit service
-				services.lighttpd.enable = true;
-				services.lighttpd.cgit = {
-					enable = true;
-					#subdir = "";  # FIXME this does not work for some reason
-					configText = ''
-						# Based on joseluisq/alpine-cgit
-						root-title=${cgitrc.rootTitle}
-						root-desc=${cgitrc.rootDesc}
-
-						source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
-						about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh
-
-						readme=:README.md
-						readme=:README.html
-						readme=:README.txt
-						readme=:README
-						readme=:INSTALL.md
-						readme=:INSTALL.html
-						readme=:INSTALL.txt
-						readme=:INSTALL
-
-						# Cache
-						#cache-root=/var/cache/cgit
-						#cache-size=2000
-
-						enable-index-links=1
-						enable-index-owner=0
-						enable-remote-branches=1
-						enable-log-filecount=1
-						enable-log-linecount=1
-						enable-git-config=1
-						snapshots=tar.xz zip
-
-						robots=noindex, nofollow
-
-						virtual-root=/cgit
-						section-from-path=0
-						max-repo-count=100
-						scan-path=/srv/git
-
-						# extra config
-						${cgitrc.extraConfig}
-					'';
-				};
-
-				# Networking, etc.
-				networking.firewall.allowedTCPPorts = [ 80 22 ];
-				networking.hostName = "cgit";
-
-				system.stateVersion = "25.05";
-			};
-		};
-	};
-}
diff --git a/users/timmy/default.nix b/users/timmy/default.nix
index b75ebb5..4f9e206 100644
--- a/users/timmy/default.nix
+++ b/users/timmy/default.nix
@@ -78,12 +78,6 @@ in {
 		# Configure sops age key paths since age keys are generated via ssh private key
 		sops.age = { inherit sshKeyPaths; };
 
-		# Add authorizedKeys to cgit service
-		services._cgit.ssh.authorizedKeys = {
-			keys = sshPublicKeys;
-			#keyFiles = sshPublicKeyPaths;
-		};
-
 		# Configure user home
 		home-manager.users.${username} = {
 			imports = [ ./home.nix ];