profiles/git-server: move gitolite and cgit

6 files changed, 130 insertions, 159 deletions

diff --git a/hosts/tahoe/default.nix b/hosts/tahoe/default.nix
index 17d0ae4..f3174e5 100644
--- a/hosts/tahoe/default.nix
+++ b/hosts/tahoe/default.nix
@@ -13,6 +13,7 @@ in
     "${self}/profiles/acme.nix"
     "${self}/profiles/nginx.nix"
     "${self}/profiles/unifi.nix"
+    "${self}/profiles/git-server.nix"
     "${self}/profiles/music-server.nix"
     "${self}/profiles/hardware/amd.nix"
   ];
diff --git a/hosts/tahoe/services.nix b/hosts/tahoe/services.nix
index 94ee6bb..b8a1b34 100644
--- a/hosts/tahoe/services.nix
+++ b/hosts/tahoe/services.nix
@@ -27,14 +27,6 @@ in
       promtail.enable = true;
       node-exporter.enable = true;
     };
-
-    cgit = {
-      enable = true;
-    };
-    gitolite = {
-      enable = true;
-      stateDir = "/var/lib/gitolite";
-    };
     syncthing.enable = true;
     backup = {
       enable = true;
diff --git a/modules/services/cgit/default.nix b/modules/services/cgit/default.nix
deleted file mode 100644
index e00790c..0000000
--- a/modules/services/cgit/default.nix
+++ /dev/null
@@ -1,112 +0,0 @@
-{ config, pkgs, lib, ... }:
-let
-  cfg = config.my.services.cgit;
-
-  # there's no need for web crawlers on that site
-  robots-deny = pkgs.writeText "robots.txt" ''
-    User-agent: *
-    Disallow: /
-  '';
-
-  cgitrc = ''
-    # Global configuration
-    virtual-root=/
-
-    enable-http-clone=1
-    clone-url=https://git.fcuny.net/$CGIT_REPO_URL
-
-    # I've fewer than 150 repos, all should be able to be listed on
-    # the main page
-    max-repo-count=150
-
-    # limit to year for the stats
-    max-stats=year
-
-    snapshots=tar.gz
-
-    source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
-    about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh
-
-    enable-git-config=1
-    enable-index-owner=0
-
-    remove-suffix=1
-
-    # sort repositories by section and branches by date
-    repository-sort=age
-    branch-sort=age
-
-    readme=:README.md
-    readme=:README.org
-    readme=:readme.org
-
-    # print the number of modified files
-    enable-log-filecount=1
-    # print the number of modified lines
-    enable-log-linecount=1
-    enable-follow-links=1
-    enable-blame=1
-
-    root-title=¯\_(°ペ)_/¯
-    root-desc=source code of my various projects
-
-    # don't index or follow
-    robots="noindex, nofollow"
-
-    project-list=/var/lib/gitolite/projects.list
-    scan-path=/var/lib/gitolite/repositories
-  '';
-in
-{
-  options.my.services.cgit = with lib; {
-    enable = mkEnableOption "git web viewer";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.fcgiwrap = {
-      enable = true;
-      user = "git";
-      group = "git";
-    };
-
-    services.nginx.virtualHosts."git.fcuny.net" = {
-      # make cgit the default site: if a request goes through nginx
-      # without a host header, this will be the default site we serve
-      # for that request.
-      default = true;
-      forceSSL = true;
-      enableACME = true;
-      listen = [
-        {
-          addr = "192.168.6.40";
-          port = 443;
-          ssl = true;
-        }
-        {
-          addr = "192.168.6.40";
-          port = 80;
-          ssl = false;
-        }
-      ];
-      locations = {
-        "~* ^.+.(css|png|ico)$" = { root = "${pkgs.cgit}/cgit"; };
-        # as per https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md
-        # if you want to map a single file make sure the location starts with a =, e.g =/i.gif instead of /i.gif.
-        "=/robots.txt".alias = robots-deny;
-        "/".extraConfig = ''
-          include ${pkgs.nginx}/conf/fastcgi_params;
-          fastcgi_param CGIT_CONFIG ${pkgs.writeText "cgitrc" cgitrc};
-          fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
-          fastcgi_split_path_info ^(/?)(.+)$;
-          fastcgi_param PATH_INFO $fastcgi_path_info;
-          fastcgi_param HTTP_HOST $server_name;
-          fastcgi_param QUERY_STRING $args;
-          fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
-          if ($http_user_agent ~* "(Blackbox Exporter)" ) {
-            access_log off;
-          }
-        '';
-      };
-    };
-  };
-}
diff --git a/modules/services/default.nix b/modules/services/default.nix
index 3d24cbb..4b2dcba 100644
--- a/modules/services/default.nix
+++ b/modules/services/default.nix
@@ -4,8 +4,6 @@
   imports = [
     ./avahi
     ./backup
-    ./cgit
-    ./gitolite
     ./monitoring
     ./samba
     ./sendsms
diff --git a/modules/services/gitolite/default.nix b/modules/services/gitolite/default.nix
deleted file mode 100644
index 1cfab29..0000000
--- a/modules/services/gitolite/default.nix
+++ /dev/null
@@ -1,37 +0,0 @@
-{ config, pkgs, lib, ... }:
-let cfg = config.my.services.gitolite;
-in
-{
-  options.my.services.gitolite = with lib; {
-    enable = mkEnableOption "gitolite";
-    stateDir = mkOption {
-      type = types.str;
-      example = "/var/lib/gitolite";
-      description = "gitolite base directory";
-    };
-  };
-
-  # FIXME: I also ran the following as the git user:
-  # git config --global init.defaultBranch main
-  # to ensure that new repositories are created with the default
-  # branch set to `main'.
-  config = lib.mkIf cfg.enable {
-    services.gitolite = {
-      enable = true;
-      dataDir = cfg.stateDir;
-      adminPubkey = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo=";
-      user = "git";
-      group = "git";
-      extraGitoliteRc = ''
-        # Make dirs/files group readable, needed for webserver/cgit. (Default
-        # setting is 0077.)
-        $RC{UMASK} = 0027;
-        $RC{GIT_CONFIG_KEYS} = 'cgit.desc cgit.hide cgit.ignore cgit.owner cgit.section';
-        $RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local";
-        push( @{$RC{ENABLE}}, 'symbolic-ref' );
-      '';
-    };
-
-    my.services.backup = { paths = [ cfg.stateDir ]; };
-  };
-}
diff --git a/profiles/git-server.nix b/profiles/git-server.nix
new file mode 100644
index 0000000..c49f0e1
--- /dev/null
+++ b/profiles/git-server.nix
@@ -0,0 +1,129 @@
+{ config, pkgs, lib, ... }:
+let
+  vhostName = "git.fcuny.net";
+  stateDir = "/var/lib/gitolite";
+
+  # there's no need for web crawlers on that site
+  robots-deny = pkgs.writeText "robots.txt" ''
+    User-agent: *
+    Disallow: /
+  '';
+
+  cgitrc = ''
+    # Global configuration
+    virtual-root=/
+
+    enable-http-clone=1
+    clone-url=https://${vhostName}/$CGIT_REPO_URL
+
+    # I've fewer than 150 repos, all should be able to be listed on
+    # the main page
+    max-repo-count=150
+
+    # limit to year for the stats
+    max-stats=year
+
+    snapshots=tar.gz
+
+    source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
+    about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh
+
+    enable-git-config=1
+    enable-index-owner=0
+
+    remove-suffix=1
+
+    # sort repositories by section and branches by date
+    repository-sort=age
+    branch-sort=age
+
+    readme=:README.md
+    readme=:README.org
+    readme=:readme.org
+
+    # print the number of modified files
+    enable-log-filecount=1
+
+    # print the number of modified lines
+    enable-log-linecount=1
+    enable-follow-links=1
+    enable-blame=1
+
+    root-title=¯\_(°ペ)_/¯
+    root-desc=source code of my various projects
+
+    # don't index or follow
+    robots="noindex, nofollow"
+
+    project-list=${stateDir}/projects.list
+    scan-path=${stateDir}/repositories
+  '';
+in
+{
+
+  # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-servers/fcgiwrap.nix
+  services.fcgiwrap = {
+    enable = true;
+    user = "git";
+    group = "git";
+  };
+
+  services.nginx.virtualHosts."${vhostName}" = {
+    # make cgit the default site: if a request goes through nginx
+    # without a host header, this will be the default site we serve
+    # for that request.
+    default = true;
+    forceSSL = true;
+    enableACME = true;
+    listen = [
+      {
+        addr = "192.168.6.40";
+        port = 443;
+        ssl = true;
+      }
+      {
+        addr = "192.168.6.40";
+        port = 80;
+        ssl = false;
+      }
+    ];
+    locations = {
+      "~* ^.+.(css|png|ico)$" = { root = "${pkgs.cgit}/cgit"; };
+      # as per https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md
+      # if you want to map a single file make sure the location starts with a =, e.g =/i.gif instead of /i.gif.
+      "=/robots.txt".alias = robots-deny;
+      "/".extraConfig = ''
+        include ${pkgs.nginx}/conf/fastcgi_params;
+        fastcgi_param CGIT_CONFIG ${pkgs.writeText "cgitrc" cgitrc};
+        fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
+        fastcgi_split_path_info ^(/?)(.+)$;
+        fastcgi_param PATH_INFO $fastcgi_path_info;
+        fastcgi_param HTTP_HOST $server_name;
+        fastcgi_param QUERY_STRING $args;
+        fastcgi_pass unix:${config.services.fcgiwrap.socketAddress};
+        if ($http_user_agent ~* "(Blackbox Exporter)" ) {
+          access_log off;
+        }
+      '';
+    };
+  };
+
+  # https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/misc/gitolite.nix
+  services.gitolite = {
+    enable = true;
+    dataDir = stateDir;
+    adminPubkey = "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIGX4+CuUjiX6Doi4n6RqmznzFUyRrxKhEFvuIxROzXDKAAAABHNzaDo=";
+    user = "git";
+    group = "git";
+    extraGitoliteRc = ''
+      # Make dirs/files group readable, needed for webserver/cgit. (Default
+      # setting is 0077.)
+      $RC{UMASK} = 0027;
+      $RC{GIT_CONFIG_KEYS} = 'cgit.desc cgit.hide cgit.ignore cgit.owner cgit.section';
+      $RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local";
+      push( @{$RC{ENABLE}}, 'symbolic-ref' );
+    '';
+  };
+
+  my.services.backup.paths = [ cfg.stateDir ];
+}