blob: 7bb2ea0f74184bc522abef321867f3c6e805864b (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
{
pkgs,
...
}:
{
nixpkgs.overlays = [
(import ../overlays/git-fix)
];
users.users.git = {
isSystemUser = true;
group = "git";
home = "/var/lib/git";
createHome = false; # tmpfiles creates it
shell = "${pkgs.git}/bin/git-shell";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAC/BtvW1c1RbBI8eeGo7oOH2y9byBaxWVDHsErgaE+s kjtsanaktsidis@KJMacbookGroq.local"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHsyhMLrlNiffDrqz0s46hZF8IdR9/qX63TUyllK0LCA kj@KJ-PC"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPS77sno1zVa6uO+2wCbBK489snNIp3uvymca2cHX/33 kjtsanaktsidis@labsrv01"
];
};
users.groups.git = { };
systemd.tmpfiles.rules = [
"d /var/lib/git 0755 git git -"
];
services.openssh.extraConfig = ''
Match User git
PasswordAuthentication no
PubkeyAuthentication yes
X11Forwarding no
AllowTcpForwarding no
PermitTTY no
'';
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.fcgiwrap.instances."git-http" = {
socket.user = "nginx";
socket.group = "nginx";
process.user = "git";
process.group = "git";
socket.type = "unix";
socket.address = "/run/fcgiwrap-git-http.sock";
};
services.nginx = {
enable = true;
virtualHosts."git.kjtsanaktsidis.id.au" = {
forceSSL = false;
enableACME = false;
locations = {
# Block HTTP pushes explicitly (receive-pack)
"~ ^/git/.+\\.git/git-receive-pack$" = {
return = "403";
};
# Smart HTTP for clone/fetch
"~ ^/git(/.+\\.git)(/.*)?$" = {
extraConfig = ''
client_max_body_size 0;
include ${pkgs.nginx}/conf/fastcgi_params;
fastcgi_param SCRIPT_FILENAME ${pkgs.git}/libexec/git-core/git-http-backend;
fastcgi_param GIT_PROJECT_ROOT /var/lib/git;
fastcgi_param GIT_HTTP_EXPORT_ALL "";
fastcgi_param PATH_INFO $1$2;
fastcgi_param REMOTE_USER $remote_user;
fastcgi_pass unix:/run/fcgiwrap-git-http.sock;
'';
};
};
};
};
}
|
