install/logical/friot/gitolite.nix

   1 {pkgs, lib, config, system, ...}:
   2 let inherit (builtins.extraBuiltins) pass;
   3     inherit (lib) types;
   4     inherit (config) networking;
   5     inherit (config.services) gitolite;
   6     inherit (config.users) users groups;
   7     gitolite-admin = "julm";
   8 in
   9 {
  10   config = {
  11     environment.systemPackages = [ pkgs.gitolite ];
  12       # NOTE: make confortable to call gitolite from a shell
  13       #      (but mind the sudo -u git).
  14
  15     services = {
  16       gitolite = {
  17         enable = true;
  18         user   = "git";
  19         group  = users."git-daemon".name;
  20         adminPubkey = pass "${networking.domainBase}/ssh/pub/${gitolite-admin}";
  21         extraGitoliteRc = ''
  22           $RC{UMASK}           = 0027; # NOTE: no quote around in Perl, so it's octal
  23           $RC{LOG_DEST}        = 'repo-log,syslog';
  24           $RC{LOG_FACILITY}    = 'local0';
  25           #$RC{GIT_CONFIG_KEYS} = 'hooks.* gitweb.*';
  26           $RC{GIT_CONFIG_KEYS} = '.*';
  27           #$RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local"
  28           #  if -d "$rc{GL_ADMIN_BASE}/local";
  29           $RC{LOCAL_CODE} = "$ENV{HOME}/local";
  30           push(@{$RC{ENABLE}}, ( 'Alias'
  31                                , 'cgit'
  32                                  # NOTE: without this "cgit" option,
  33                                  # the repositories' "description" files are not modified
  34                                , 'D'
  35                                , 'Shell ${gitolite-admin}'
  36                                , 'create'
  37                                , 'expand-deny-messages'
  38                                , 'fork'
  39                                , 'keysubdirs-as-groups'
  40                                , 'readme'
  41                                , (-d "$ENV{HOME}/local" ? 'repo-specific-hooks' : ())
  42                                , 'ssh-authkeys-split'
  43                                ));
  44         '';
  45       };
  46     };
  47     systemd.services.gitolite-init = {
  48       preStart = ''
  49         chmod g+x "${gitolite.dataDir}"
  50           # NOTE: allow git-daemon to enter ~git
  51         install -D -d -o ${gitolite.user} -g ${gitolite.group} -m 750 \
  52          ${gitolite.dataDir}/local \
  53          ${gitolite.dataDir}/local/hooks \
  54          ${gitolite.dataDir}/local/hooks/common \
  55          ${gitolite.dataDir}/local/hooks/repo-specific
  56       '';
  57     };
  58     systemd.services.git-daemon = {
  59       # NOTE: not using nixpkgs' gitDaemon, to avoid running it as root.
  60       after = [ "network.target" ];
  61       wantedBy = [ "multi-user.target" ];
  62       serviceConfig = {
  63         User       = users."git-daemon".name;
  64         Group      = groups."git-daemon".name;
  65         Restart    = "always";
  66         RestartSec = 5;
  67       };
  68       script = "${pkgs.git}/bin/git daemon --verbose --reuseaddr"
  69         + " --base-path=${gitolite.dataDir}/repositories"
  70         #+ (optionalString (cfg.listenAddress != "") "--listen=${cfg.listenAddress} ")
  71         #+ "--port=${toString cfg.port} "
  72         ;
  73     };
  74     users.users = lib.singleton
  75       { name = "git-daemon";
  76         uid = config.ids.uids.git;
  77         description = "Git daemon user";
  78       };
  79   };
  80 }