install/logical/friot/gitolite.nix

   1 {pkgs, lib, config, system, ...}:
   2 let inherit (builtins.extraBuiltins) pass;
   3     inherit (lib) types;
   4     inherit (config) networking;
   5     inherit (config.services) gitolite;
   6     inherit (config.users) users groups;
   7     gitolite-admin = "julm";
   8 in
   9 {
  10   config = {
  11     environment.systemPackages = [ pkgs.gitolite ];
  12       # NOTE: make confortable to call gitolite from a shell
  13       #      (but mind the sudo -u git).
  14
  15     services = {
  16       gitolite = {
  17         enable = true;
  18         user   = "git";
  19         group  = users."git-daemon".name;
  20         adminPubkey = pass "${networking.domainBase}/ssh/pub/${gitolite-admin}";
  21         extraGitoliteRc = ''
  22           $RC{UMASK}           = 0027; # NOTE: no quote around in Perl, so it's octal
  23           $RC{LOG_DEST}        = 'repo-log,syslog';
  24           $RC{LOG_FACILITY}    = 'local0';
  25           #$RC{GIT_CONFIG_KEYS} = 'hooks.* gitweb.*';
  26           $RC{GIT_CONFIG_KEYS} = '.*';
  27           #$RC{LOCAL_CODE} = "$rc{GL_ADMIN_BASE}/local"
  28           #  if -d "$rc{GL_ADMIN_BASE}/local";
  29           $RC{LOCAL_CODE} = "$ENV{HOME}/local";
  30           push(@{$RC{ENABLE}}, ( 'Alias'
  31                                #, 'cgit'
  32                                , 'D'
  33                                , 'Shell ${gitolite-admin}'
  34                                , 'create'
  35                                , 'expand-deny-messages'
  36                                , 'fork'
  37                                , 'keysubdirs-as-groups'
  38                                , 'readme'
  39                                , (-d "$ENV{HOME}/local" ? 'repo-specific-hooks' : ())
  40                                , 'ssh-authkeys-split'
  41                                ));
  42         '';
  43       };
  44     };
  45     systemd.services.gitolite-init = {
  46       preStart = ''
  47         chmod g+x "${gitolite.dataDir}"
  48           # NOTE: allow git-daemon to enter ~git
  49         install -D -d -o ${gitolite.user} -g ${gitolite.group} -m 750 \
  50          ${gitolite.dataDir}/local \
  51          ${gitolite.dataDir}/local/hooks \
  52          ${gitolite.dataDir}/local/hooks/common \
  53          ${gitolite.dataDir}/local/hooks/repo-specific
  54       '';
  55     };
  56     systemd.services.git-daemon = {
  57       # NOTE: not using nixpkgs' gitDaemon, to avoid running it as root.
  58       after = [ "network.target" ];
  59       wantedBy = [ "multi-user.target" ];
  60       serviceConfig = {
  61         User       = users."git-daemon".name;
  62         Group      = groups."git-daemon".name;
  63         Restart    = "always";
  64         RestartSec = 5;
  65       };
  66       script = "${pkgs.git}/bin/git daemon --verbose --reuseaddr"
  67         + " --base-path=${gitolite.dataDir}/repositories"
  68         #+ (optionalString (cfg.listenAddress != "") "--listen=${cfg.listenAddress} ")
  69         #+ "--port=${toString cfg.port} "
  70         ;
  71     };
  72     users.users = lib.singleton
  73       { name = "git-daemon";
  74         uid = config.ids.uids.git;
  75         description = "Git daemon user";
  76       };
  77   };
  78 }