blob: 99273014dda0548f722bf86bd4a35bf63adfb8e4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
let
publicUrl = "git.tjkeller.xyz";
rootTitle = "git.TJKeller.xyz";
rootDesc = "TJK's git repositories, served by cgit";
scanPath = "/srv/git";
sectionFromStartpath = 0;
maxRepoCount = 100;
in {
containers.cgit = {
autoStart = true;
privateNetwork = true;
ephemeral = true;
hostBridge = "br-lan1";
localMacAddress = "02:00:00:00:77:08";
bindMounts = {
${scanPath} = {
hostPath = "/nix/persist/cgit/srv/git";
isReadOnly = false;
};
};
config = { pkgs, lib, config, ... }: {
# Networking
networking.interfaces.eth0.useDHCP = true;
networking.firewall.allowedTCPPorts = [ 80 22 9418 ]; # nginx, ssh, git-daemon
# Enable ssh service
services.openssh.enable = true;
# Create git user for ssh access
# git user and group are uid/gid 41 as defined by gitDaemon & nixpkgs/nixos/modules/misc/ids.nix
users.users.git = {
isSystemUser = true;
group = "git";
home = scanPath; # Serve from git user's home to allow cloning git@cgit:repo
createHome = true;
homeMode = "750"; # Allow read permissions for group members
shell = pkgs.bash;
#openssh = { inherit authorizedKeys; };
};
users.groups.git.members = [ "nginx" ]; # Create the git group and add nginx user as a member so scanPath can be served by cgit
# Enable cgit service
services.cgit.main = {
enable = true;
inherit scanPath;
nginx.virtualHost = "cgit";
user = "git";
group = "git";
gitHttpBackend.checkExportOkFiles = true; # only serve repos containing git-daemon-export-ok
settings = {
# Based on joseluisq/alpine-cgit
root-title = rootTitle;
root-desc = rootDesc;
source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
readme = [ ":README" ":README.html" ":README.md" ":README.txt" ];
# Cache
#cache-root=/var/cache/cgit
#cache-size=2000
enable-index-links = 1;
enable-index-owner = 0;
enable-remote-branches = 1;
enable-log-filecount = 1;
enable-log-linecount = 1;
enable-git-config = 1;
snapshots = "tar.xz zip";
robots = "noindex, nofollow";
scan-path = scanPath;
virtual-root = "/";
section-from-path = sectionFromStartpath;
max-repo-count = maxRepoCount;
clone-prefix = "https://${publicUrl} git://${publicUrl}";
max-stats = "month";
enable-http-clone = false; # optional: let git-http-backend handle all clones
strict-export = "git-daemon-export-ok";
};
};
services.nginx.virtualHosts."cgit".default = true;
# Enable git program
programs.git.enable = true;
# Enable git daemon
services.gitDaemon = {
enable = true;
basePath = scanPath;
exportAll = false; # only export repos containing git-daemon-export-ok
listenAddress = "0.0.0.0";
port = 9418;
};
system.stateVersion = "26.05";
};
};
}
|
