]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/gitolite.nix
nix: daily GC on mermet
[sourcephile-nix.git] / machines / mermet / gitolite.nix
1 { inputs, pkgs, lib, config, ... }:
2 let
3 inherit (lib) types;
4 inherit (config) networking;
5 inherit (config.services) gitolite;
6 inherit (config.users) users groups;
7 gitolite-admin = "julm";
8 in
9 {
10 # Make confortable to call gitolite from a shell
11 # (but mind to prefix it by sudo -u git)
12 environment.systemPackages = [ pkgs.gitolite ];
13
14 services = {
15 gitolite = {
16 enable = true;
17 user = "git";
18 group = users."git-daemon".name;
19 adminPubkey = builtins.readFile (inputs.secrets + "/members/ssh/julm.pub");
20 extraGitoliteRc = ''
21 $RC{UMASK} = 0027; # NOTE: no quote around in Perl, so it's octal
22 $RC{LOG_DEST} = 'repo-log,syslog';
23 $RC{LOG_FACILITY} = 'local0';
24 #$RC{GIT_CONFIG_KEYS} = 'hooks.* gitweb.*';
25 $RC{GIT_CONFIG_KEYS} = '.*';
26 #$RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local"
27 # if -d "$rc{GL_ADMIN_BASE}/local";
28 $RC{LOCAL_CODE} = "$ENV{HOME}/local";
29 push(@{$RC{ENABLE}}, ( 'Alias'
30 , 'cgit'
31 # NOTE: without this "cgit" option,
32 # the repositories' "description" files are not modified
33 , 'D'
34 , 'Shell ${gitolite-admin}'
35 , 'create'
36 , 'expand-deny-messages'
37 , 'fork'
38 , 'keysubdirs-as-groups'
39 , 'readme'
40 , (-d "$ENV{HOME}/local" ? 'repo-specific-hooks' : ())
41 , 'ssh-authkeys-split'
42 ));
43 '';
44 };
45 };
46 systemd.services.gitolite-init = {
47 preStart = ''
48 # Allow git-daemon to enter ~git
49 chmod g+x "${gitolite.dataDir}"
50 install -D -d -o ${gitolite.user} -g ${gitolite.group} -m 750 \
51 ${gitolite.dataDir}/local \
52 ${gitolite.dataDir}/local/hooks \
53 ${gitolite.dataDir}/local/hooks/common \
54 ${gitolite.dataDir}/local/hooks/repo-specific
55 '';
56 };
57 networking.nftables.ruleset = ''
58 add rule inet filter net2fw tcp dport 9418 counter accept comment "Git"
59 '';
60 systemd.services.git-daemon = {
61 # NOTE: not using nixpkgs' gitDaemon, to avoid running it as root.
62 after = [ "network.target" ];
63 wantedBy = [ "multi-user.target" ];
64 serviceConfig = {
65 User = users."git-daemon".name;
66 Group = groups."git-daemon".name;
67 Restart = "always";
68 RestartSec = 5;
69 };
70 script = "${pkgs.git}/bin/git daemon --verbose --reuseaddr"
71 + " --base-path=${gitolite.dataDir}/repositories"
72 #+ (optionalString (cfg.listenAddress != "") "--listen=${cfg.listenAddress} ")
73 #+ "--port=${toString cfg.port} "
74 ;
75 };
76 users.users."git-daemon" = {
77 uid = config.ids.uids.git;
78 description = "Git daemon user";
79 };
80 }