diff options
| -rw-r--r-- | hosts/omega-relay/default.nix | 5 | ||||
| -rw-r--r-- | secrets/omega-relay/git_authorized_keys | 1 | ||||
| -rw-r--r-- | services/cgit.nix | 70 |
3 files changed, 76 insertions, 0 deletions
diff --git a/hosts/omega-relay/default.nix b/hosts/omega-relay/default.nix index 62bbab6..542b843 100644 --- a/hosts/omega-relay/default.nix +++ b/hosts/omega-relay/default.nix @@ -20,6 +20,7 @@ ../../services/bulwark.nix ../../services/mail2.nix ../../services/ddns.nix + ../../services/cgit.nix ]; addons = { @@ -52,6 +53,10 @@ in { prometheus.enableExporters = true; + cgit = { + enable = true; + domain = "git.wilkuu.nl"; + }; desecDyn = { enable = true; domains."wilkuu.xyz" = { diff --git a/secrets/omega-relay/git_authorized_keys b/secrets/omega-relay/git_authorized_keys new file mode 100644 index 0000000..b5d5e49 --- /dev/null +++ b/secrets/omega-relay/git_authorized_keys @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDjrfPWGUSBMImIxhournQyOwOSwZDLyM7ftr4OjtRiU5NWYTdN1zHkCsBGMe3/YOS0PeEVm/kQG4WS0/ZqcbRa8+FV1+3g64PF1+dHZUcSqiAHN/7t6qVyrSG3LITmoTSB+VFjahUT+uZNmV9Mbp8SWf2pGKetnn92jAoB3GzDVx6U4u2arE7j4LKDoJSOOHFBOK28cP43cY3zrL6GWM4eYlfM5pe/BKO6mrpRmIeitUweIxsFeWjDTD3lzL0YkGS7wLcVuy0uRn1sC/2V7Z4exknYv2J2JKQe/KNFGul8ixGoSJI2Ct/4MIhgUptPC2AzRT0PZ3m0h6/aOpjauGlB wilkuu@5g-ray-emitter diff --git a/services/cgit.nix b/services/cgit.nix new file mode 100644 index 0000000..07d4024 --- /dev/null +++ b/services/cgit.nix @@ -0,0 +1,70 @@ +{pkgs, lib, config, ...}: let + inherit (lib) mkIf mkOption mkEnableOption types; + cfg = config.wilkuu.services.cgit; + cgit_dark = pkgs.fetchFromGitHub { + owner = "jb3"; + repo = "cgit-dark"; + rev = "f82cde4b29834d31465a5dafa00de527ef6853b0"; + hash = "sha256-fSOelKDf1lHHRuyg/F81l8rAFrc6u7mAEFBX1Ua3V10="; + }; +in { + options.wilkuu.services.cgit = { + enable = mkEnableOption "remote git and cgit"; + domain = mkOption { + description = "Domain to run cgit on"; + example = "git.wilkuu.xyz"; + default = "git.${config.networking.hostName}.local"; + type = types.str; + }; + }; + config = mkIf cfg.enable { + users.groups.git = {}; + users.users.git = { + group = "git"; + enable = true; + isSystemUser = true; + home = "/srv/git/"; + createHome = true; + shell = "${pkgs.git}/bin/git-shell"; + openssh.authorizedKeys.keyFiles = [ + ../secrets/${config.networking.hostName}/git_authorized_keys + ]; + }; + + services.openssh = { + enable = true; + extraConfig = '' + Match user git + AllowTcpForwarding no + AllowAgentForwarding no + PasswordAuthentication no + KbdInteractiveAuthentication no + PermitTTY no + X11Forwarding no + ''; + + }; + services.openssh.settings.AllowUsers = ["git"]; + services.cgit."${cfg.domain}" = { + enable = true; + group = "git"; + user = "git"; + scanPath = "/srv/git"; + settings = { + enable-follow-links = true; + source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py"; + # css = "${cgit_dark}/cgit-themed.css"; + # css = "https://raw.githubusercontent.com/jb3/cgit-dark/f82cde4b29834d31465a5dafa00de527ef6853b0/cgit-themed.css"; + }; + gitHttpBackend = { + enable = true; + checkExportOkFiles = false; # TODO: Reconsider later + }; + }; + services.nginx.virtualHosts.${cfg.domain} = { + forceSSL = true; + enableACME = true; + }; + }; + +} |