1 files changed, 106 insertions, 0 deletions
diff --git a/hosts/poweredge-pro/cgit.nix b/hosts/poweredge-pro/cgit.nix
new file mode 100644
index 0000000..9927301
--- /dev/null
+++ b/hosts/poweredge-pro/cgit.nix
@@ -0,0 +1,106 @@
+let
+	publicUrl = "git.tjkeller.xyz";
+	rootTitle = "git.TJKeller.xyz";
+	rootDesc = "TJK's git repositories, served by cgit";
+	scanPath = "/srv/git";
+	sectionFromStartpath = 0;
+	maxRepoCount = 100;
+in {
+
+	containers.cgit = {
+		autoStart = true;
+		privateNetwork = true;
+		ephemeral = true;
+		hostBridge = "br-lan1";
+		localMacAddress = "02:00:00:00:77:08";
+
+		bindMounts = {
+			${scanPath} = {
+				hostPath = "/nix/persist/cgit/srv/git";
+				isReadOnly = false;
+			};
+		};
+
+		config = { pkgs, lib, config, ... }: {
+			# Networking
+			networking.interfaces.eth0.useDHCP = true;
+			networking.firewall.allowedTCPPorts = [ 80 22 9418 ];  # nginx, ssh, git-daemon
+
+			# Enable ssh service
+			services.openssh.enable = true;
+
+			# Create git user for ssh access
+			# git user and group are uid/gid 41 as defined by gitDaemon & nixpkgs/nixos/modules/misc/ids.nix
+			users.users.git = {
+				isSystemUser = true;
+				group = "git";
+				home = scanPath;  # Serve from git user's home to allow cloning git@cgit:repo
+				createHome = true;
+				homeMode = "750";  # Allow read permissions for group members
+				shell = pkgs.bash;
+				#openssh = { inherit authorizedKeys; };
+			};
+			users.groups.git.members = [ "nginx" ];  # Create the git group and add nginx user as a member so scanPath can be served by cgit
+
+			# Enable cgit service
+			services.cgit.main = {
+				enable = true;
+				inherit scanPath;
+				nginx.virtualHost = "cgit";
+				user = "git";
+				group = "git";
+				gitHttpBackend.checkExportOkFiles = true;  # only serve repos containing git-daemon-export-ok
+				settings = {
+					# Based on joseluisq/alpine-cgit
+					root-title = rootTitle;
+					root-desc = rootDesc;
+
+					source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
+					about-filter  = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
+
+					readme = [ ":README" ":README.html" ":README.md" ":README.txt" ];
+
+					# Cache
+					#cache-root=/var/cache/cgit
+					#cache-size=2000
+
+					enable-index-links = 1;
+					enable-index-owner = 0;
+					enable-remote-branches = 1;
+					enable-log-filecount = 1;
+					enable-log-linecount = 1;
+					enable-git-config = 1;
+					snapshots = "tar.xz zip";
+
+					robots = "noindex, nofollow";
+
+					scan-path = scanPath;
+					virtual-root = "/";
+					section-from-path = sectionFromStartpath;
+					max-repo-count = maxRepoCount;
+
+					clone-prefix = "https://${publicUrl} git://${publicUrl}";
+					max-stats = "month";
+
+					enable-http-clone = false;  # optional: let git-http-backend handle all clones
+					strict-export = "git-daemon-export-ok";
+				};
+			};
+			services.nginx.virtualHosts."cgit".default = true;
+
+			# Enable git program
+			programs.git.enable = true;
+
+			# Enable git daemon
+			services.gitDaemon = {
+				enable = true;
+				basePath = scanPath;
+				exportAll = false;  # only export repos containing git-daemon-export-ok
+				listenAddress = "0.0.0.0";
+				port = 9418;
+			};
+
+			system.stateVersion = "26.05";
+		};
+	};
+}