hosts/mermet/nginx/sourcephile.fr/git.nix

   1 { domain, ... }:
   2 { pkgs, lib, config, ... }:
   3 let
   4   inherit (config.services) gitweb gitolite nginx;
   5   srv = "git";
   6   gitwebSocket = "/run/gitweb/gitweb.sock";
   7 in
   8 {
   9   services.nginx = {
  10     commonHttpConfig = ''
  11       fastcgi_cache_path /var/cache/nginx/${domain}/${srv}/fastcgi
  12         keys_zone=${domain}/${srv}/fastcgi:2M
  13         inactive=10m
  14         levels=1:2
  15         max_size=32M
  16         use_temp_path=off;
  17       limit_req_zone $binary_remote_addr zone=${domain}_git:10m rate=10r/s;
  18     '';
  19     virtualHosts."${srv}.${domain}" = {
  20       forceSSL = true;
  21       useACMEHost = domain;
  22       extraConfig = ''
  23         access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
  24         error_log  /var/log/nginx/${domain}/${srv}/error.log warn;
  25       '';
  26       locations = {
  27         "/" = {
  28           extraConfig = ''
  29             include ${pkgs.nginx}/conf/fastcgi_params;
  30             ${nginx.configs.https_add_headers}
  31             add_header X-Cache $upstream_cache_status;
  32             fastcgi_cache ${domain}/${srv}/fastcgi;
  33             fastcgi_cache_valid 200 1m;
  34             fastcgi_cache_valid 404 3m;
  35             fastcgi_max_temp_file_size 1M;
  36             # Used by gitweb's pathinfo feature
  37             fastcgi_param PATH_INFO $fastcgi_script_name;
  38             fastcgi_param GITWEB_CONFIG ${gitweb.gitwebConfigFile};
  39             fastcgi_pass unix:${gitwebSocket};
  40             limit_req zone=${domain}_git burst=12 delay=8;
  41           '';
  42         };
  43         "/static/" = {
  44           alias = "${pkgs.gitweb}/static/";
  45           extraConfig = ''
  46             access_log off;
  47           '';
  48         };
  49         "/static-custom/" = {
  50           root = pkgs.writeTextDir "static-custom/style.css" ''
  51             .project_list {
  52               width:100%;
  53             }
  54           '';
  55           extraConfig = ''
  56             access_log off;
  57           '';
  58         };
  59         "/robots.txt" = {
  60           root = pkgs.writeTextDir "robots.txt" ''
  61             User-agent: *
  62             Disallow: /*/blame/*
  63             Disallow: /*/blobdiff/*
  64             Disallow: /*/commitdiff/*
  65             Disallow: /*/commitdiff_plain/*
  66             Disallow: /*/patch/*
  67             Disallow: /*/search/*
  68             Disallow: /*/snapshot/*
  69             Disallow: /*a=blame*
  70             Disallow: /*a=blobdiff*
  71             Disallow: /*a=commitdiff*
  72             Disallow: /*a=commitdiff_plain*
  73             Disallow: /*a=patch*
  74             Disallow: /*a=search*
  75             Disallow: /*a=snapshot*
  76           '';
  77           extraConfig = ''
  78             access_log off;
  79           '';
  80         };
  81       };
  82     };
  83   };
  84   systemd.services.nginx.serviceConfig.LogsDirectory = lib.mkForce [ "nginx/${domain}/${srv}" ];
  85   systemd.services.gitweb = {
  86     description = "GitWeb FastCGI service";
  87     script = "${pkgs.gitweb}/gitweb.cgi --fastcgi --nproc=1";
  88     environment = {
  89       FCGI_SOCKET_PATH = gitwebSocket;
  90       FCGI_SOCKET_PERM = "432"; # decimal of 660 in octal, since current CGI::Fast doesn't use perl's oct()
  91     };
  92     serviceConfig = {
  93       User = gitolite.user;
  94       Group = nginx.group;
  95       RuntimeDirectory = [ "gitweb" ];
  96       Restart = "always";
  97       RestartSec = 10;
  98     };
  99     wantedBy = [ "multi-user.target" ];
 100   };
 101   services.gitweb = {
 102     gitwebTheme = false;
 103     projectroot = "${gitolite.dataDir}/repositories";
 104     extraConfig = ''
 105       use utf8;
 106       my $s = $cgi->https() ? "s"  : "";
 107       @extra_breadcrumbs = (["sourcephile" => "http''${s}://${domain}"]);
 108       $site_name = "Git — Sourcephile";
 109       $home_link_str = "git";
 110       $projects_list = "${gitolite.dataDir}/projects.list";
 111       $projects_list_description_width = 50;
 112       $projects_list_group_categories = 1;
 113       $default_projects_order = "age";
 114       $default_text_plain_charset = "utf-8";
 115       $fallback_encoding = "utf-8";
 116       $mimetypes_file = "${pkgs.runCommand "mime.types" {} ''
 117         substitute ${pkgs.mailcap}/etc/nginx/mime.types $out \
 118           --replace text/html "text/html;charset=utf-8"
 119       ''}";
 120       $omit_owner = 1;
 121       $export_ok = "git-daemon-export-ok";
 122       $prevent_xss = 0;
 123       @git_base_url_list =
 124        ( "git://${srv}.${domain}"
 125        , "git\@${srv}.${domain}:"
 126        );
 127       # NOTE: more readable URL.
 128       $feature{'pathinfo'}{'default'} = [1];
 129       @stylesheets = ( "/static/gitweb.css"
 130                      , "/static-custom/style.css"
 131                      );
 132       $logo        =  "/static/git-logo.png";
 133       $favicon     =  "/static/git-favicon.png";
 134       $javascript  =  "/static/gitweb.js";
 135       $feature{'highlight'}{'default'} = [1];
 136     '';
 137   };
 138 }