1 files changed, 70 insertions, 0 deletions
diff --git a/services/cgit.nix b/services/cgit.nix
new file mode 100644
index 0000000..07d4024
--- /dev/null
+++ b/services/cgit.nix
@@ -0,0 +1,70 @@
+{pkgs, lib, config, ...}: let 
+  inherit (lib) mkIf mkOption mkEnableOption types; 
+  cfg = config.wilkuu.services.cgit; 
+  cgit_dark = pkgs.fetchFromGitHub {
+    owner = "jb3";
+    repo = "cgit-dark";
+    rev = "f82cde4b29834d31465a5dafa00de527ef6853b0";
+    hash =  "sha256-fSOelKDf1lHHRuyg/F81l8rAFrc6u7mAEFBX1Ua3V10=";
+  };
+in  {
+  options.wilkuu.services.cgit = {
+    enable = mkEnableOption "remote git and cgit";  
+    domain = mkOption {
+      description = "Domain to run cgit on"; 
+      example = "git.wilkuu.xyz";  
+      default = "git.${config.networking.hostName}.local";
+      type = types.str;
+    }; 
+  };
+  config = mkIf cfg.enable {
+    users.groups.git = {};
+    users.users.git = {
+      group = "git"; 
+      enable = true;
+      isSystemUser = true;  
+      home = "/srv/git/";
+      createHome = true; 
+      shell = "${pkgs.git}/bin/git-shell"; 
+      openssh.authorizedKeys.keyFiles = [
+        ../secrets/${config.networking.hostName}/git_authorized_keys
+      ];
+    };  
+
+    services.openssh = {
+      enable = true; 
+      extraConfig = ''
+        Match user git
+          AllowTcpForwarding no
+          AllowAgentForwarding no 
+          PasswordAuthentication no 
+          KbdInteractiveAuthentication no 
+          PermitTTY no 
+          X11Forwarding no
+      '';
+    
+    };
+    services.openssh.settings.AllowUsers = ["git"];
+    services.cgit."${cfg.domain}" = {
+      enable = true; 
+      group = "git";
+      user  = "git"; 
+      scanPath = "/srv/git";
+      settings = {
+        enable-follow-links = true;
+        source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
+        # css = "${cgit_dark}/cgit-themed.css";
+        # css = "https://raw.githubusercontent.com/jb3/cgit-dark/f82cde4b29834d31465a5dafa00de527ef6853b0/cgit-themed.css";
+      };
+      gitHttpBackend = {
+        enable = true; 
+        checkExportOkFiles = false; # TODO: Reconsider later
+      };
+    };
+    services.nginx.virtualHosts.${cfg.domain} = {
+        forceSSL = true;
+        enableACME = true;
+    };
+  };
+
+}