servers/mermet/nginx/sourcephile.fr/git.nix

   1 { domain, ... }:
   2 { pkgs, lib, config, ... }:
   3 let
   4   inherit (config) networking;
   5   inherit (config.services) gitweb gitolite nginx;
   6   srv = "git";
   7   gitwebSocket = "/run/gitweb/gitweb.sock";
   8 in
   9 {
  10 services.nginx = {
  11   commonHttpConfig = ''
  12     fastcgi_cache_path ${nginx.cacheDir}/fastcgi_cache:${domain}:${srv}
  13                        keys_zone=${domain}/${srv}:2M
  14                        inactive=10m
  15                        levels=1:2
  16                        max_size=32M;
  17   '';
  18   virtualHosts."${srv}" = {
  19     serverName = "${srv}.${domain}";
  20     serverAliases = [ "code.${domain}" ];
  21     forceSSL = true;
  22     useACMEHost = domain;
  23     extraConfig = ''
  24       access_log ${nginx.logDir}/${domain}/${srv}/access.log json buffer=32k;
  25       error_log  ${nginx.logDir}/${domain}/${srv}/error.log warn;
  26     '';
  27     locations = {
  28       "/" = {
  29         extraConfig = ''
  30           include ${pkgs.nginx}/conf/fastcgi_params;
  31           ${nginx.configs.https_add_headers}
  32           add_header X-Cache $upstream_cache_status;
  33           fastcgi_cache ${domain}/${srv};
  34           fastcgi_cache_valid 200 1m;
  35           fastcgi_cache_valid 404 30m;
  36           fastcgi_max_temp_file_size 1M;
  37           # Used by gitweb's pathinfo feature
  38           fastcgi_param PATH_INFO $fastcgi_script_name;
  39           fastcgi_param GITWEB_CONFIG ${gitweb.gitwebConfigFile};
  40           fastcgi_pass unix:${gitwebSocket};
  41         '';
  42       };
  43       "/static/" = {
  44         alias = "${pkgs.gitweb}/static/";
  45         extraConfig = ''
  46           access_log off;
  47         '';
  48       };
  49       "/static-custom/" = {
  50         root = pkgs.writeTextDir "static-custom/style.css" ''
  51           .project_list {
  52             width:100%;
  53           }
  54         '';
  55         extraConfig = ''
  56           access_log off;
  57         '';
  58       };
  59       "/robots.txt" = {
  60         root = pkgs.writeTextDir "robots.txt" ''
  61           User-agent: *
  62           Disallow: /*/blame/*
  63           Disallow: /*/blobdiff/*
  64           Disallow: /*/commitdiff/*
  65           Disallow: /*/commitdiff_plain/*
  66           Disallow: /*/patch/*
  67           Disallow: /*/search/*
  68           Disallow: /*/snapshot/*
  69           Disallow: /*a=blame*
  70           Disallow: /*a=blobdiff*
  71           Disallow: /*a=commitdiff*
  72           Disallow: /*a=commitdiff_plain*
  73           Disallow: /*a=patch*
  74           Disallow: /*a=search*
  75           Disallow: /*a=snapshot*
  76         '';
  77         extraConfig = ''
  78           access_log off;
  79         '';
  80       };
  81     };
  82   };
  83 };
  84 systemd.services.nginx.preStart = lib.mkBefore ''
  85   install -D -d -m 750 -o ${nginx.user} -g ${nginx.group} ${nginx.logDir}/${domain}/${srv}/
  86 '';
  87 systemd.services.gitweb = {
  88   description = "GitWeb FastCGI service";
  89   script = "${pkgs.gitweb}/gitweb.cgi --fastcgi --nproc=1";
  90   environment  = {
  91     FCGI_SOCKET_PATH = gitwebSocket;
  92     FCGI_SOCKET_PERM = "432"; # decimal of 660 in octal, since current CGI::Fast doesn't use perl's oct()
  93   };
  94   serviceConfig = {
  95     User             = gitolite.user;
  96     Group            = nginx.group;
  97     RuntimeDirectory = [ "gitweb" ];
  98     Restart          = "always";
  99     RestartSec       = 10;
 100   };
 101   wantedBy = [ "multi-user.target" ];
 102 };
 103 services.gitweb = {
 104   gitwebTheme = false;
 105   projectroot = "${gitolite.dataDir}/repositories";
 106   extraConfig = ''
 107     use utf8;
 108     my $s = $cgi->https() ? "s"  : "";
 109     @extra_breadcrumbs = (["${networking.domainBase}" => "http''${s}://${domain}"]);
 110     $site_name = "Git — Sourcephile";
 111     $home_link_str = "git";
 112     $projects_list = "${gitolite.dataDir}/projects.list";
 113     $projects_list_description_width = 50;
 114     $projects_list_group_categories = 1;
 115     $default_projects_order = "age";
 116     $default_text_plain_charset = 'utf-8';
 117     #$fallback_encoding = "utf-8";
 118     $omit_owner = 1;
 119     $export_ok = "git-daemon-export-ok";
 120     $prevent_xss = 0;
 121     @git_base_url_list =
 122      ( "git://${srv}.${domain}"
 123      , "git\@${srv}.${domain}:"
 124      );
 125     # NOTE: more readable URL.
 126     $feature{'pathinfo'}{'default'} = [1];
 127     @stylesheets = ( "/static/gitweb.css"
 128                    , "/static-custom/style.css"
 129                    );
 130     $logo        =  "/static/git-logo.png";
 131     $favicon     =  "/static/git-favicon.png";
 132     $javascript  =  "/static/gitweb.js";
 133     $feature{'highlight'}{'default'} = [1];
 134   '';
 135 };
 136 }