grace/dots

dotfiles/nix configs

git clone https://git.gae.moe/grace/dots

Grace Yodermore stuff4db52e6

idk
branchesidkmainvulcanwafrn-testingall refs →
6.8 KiB300 linesraw
1{
2  config,
3  pkgs,
4  lib,
5  ...
6}:
7
8let
9  # TODO: make this use the home manager in nix-path? set in system.nix
10  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/master.tar.gz";
11
12  gitDir = "/mnt/ext/git";
13  cgitPriv = "${gitDir}/cgitpriv";
14  cgitPub = "${gitDir}/cgitpub";
15  gitoliteKeys = {
16    gitolite-admin = [
17      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA6Eq2yVsZrCH8so7f3ygH0UWp6WkOxbhLNFC9QewKwoAAAABHNzaDo= grace_yoder@outlook.com"
18      # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINySDE+jaYpuAWUdPQf/JcAWETeHgmh+T5Y4GUa7MfeM grace@turing"
19    ];
20
21    grace = [ ];
22    grace-read = [ ];
23  };
24
25  mkGitoliteKey =
26    user: key:
27    ''command="${pkgs.gitolite}/bin/gitolite-shell ${user}",restrict ${key}'';
28
29  gitoliteAuthorizedKeys =
30    lib.concatStringsSep "\n" (
31      lib.flatten (
32        lib.mapAttrsToList (
33          user: keys:
34          map (mkGitoliteKey user) keys
35        ) gitoliteKeys
36      )
37    );
38
39  fixGitolitePermissions = pkgs.writeShellScript "fix-gitolite-permissions" ''
40    set -eu
41
42    ${pkgs.coreutils}/bin/mkdir -p ${gitDir}/.ssh
43
44    ${pkgs.coreutils}/bin/chown git:git ${gitDir}
45    ${pkgs.coreutils}/bin/chmod 0750 ${gitDir}
46
47    ${pkgs.coreutils}/bin/chown git:git ${gitDir}/.ssh
48    ${pkgs.coreutils}/bin/chmod 0700 ${gitDir}/.ssh
49
50    if [ -e ${gitDir}/.ssh/authorized_keys ]; then
51      ${pkgs.coreutils}/bin/chown git:git \
52        ${gitDir}/.ssh/authorized_keys
53
54      ${pkgs.coreutils}/bin/chmod 0600 \
55        ${gitDir}/.ssh/authorized_keys
56    fi
57  '';
58  publicCgitrc = pkgs.writeText "cgit-public.rc" ''
59    virtual-root=/
60
61    css=/cgit.css
62    logo=/cgit.png
63    favicon=/favicon.ico
64
65    root-title=git.gae.moe
66    remove-suffix=1
67
68    enable-git-config=1
69
70    readme=:README.md
71    readme=:README
72    about-filter=${pkgs.writeShellScript "cgit-about-filter" ''
73      case "$1" in
74        *.md)
75          exec ${pkgs.pandoc}/bin/pandoc \
76            --from=gfm \
77            --to=html
78          ;;
79        *)
80          exec ${pkgs.coreutils}/bin/cat
81          ;;
82      esac
83    ''}
84
85    scan-path=${cgitPub}
86  '';
87  privateCgitrc = pkgs.writeText "cgit-private.rc" ''
88    virtual-root=/
89
90    css=/cgit.css
91    logo=/cgit.png
92    favicon=/favicon.ico
93
94    root-title=Private repositories
95    remove-suffix=1
96
97    enable-git-config=1
98
99    readme=:README.md
100    readme=:README
101    about-filter=${pkgs.writeShellScript "cgit-about-filter" ''
102      case "$1" in
103        *.md)
104          exec ${pkgs.pandoc}/bin/pandoc \
105            --from=gfm \
106            --to=html
107          ;;
108        *)
109          exec ${pkgs.coreutils}/bin/cat
110          ;;
111      esac
112    ''}
113
114    scan-path=${cgitPriv}
115  '';
116in
117{
118  services.gitolite = {
119    enable = true;
120
121    user = "git";
122    group = "git";
123
124    dataDir = "${gitDir}";
125
126    adminPubkey =
127      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA6Eq2yVsZrCH8so7f3ygH0UWp6WkOxbhLNFC9QewKwoAAAABHNzaDo= grace_yoder@outlook.com";
128    extraGitoliteRc = ''
129      $RC{GIT_CONFIG_KEYS} = 'gitweb\.owner gitweb\.description gitweb\.category';
130    '';
131  };
132  # home-manager.users.git.home.stateVersion = "26.11";
133  # home-manager.users.git.programs.git = {
134  #   lfs.enable = true;
135  #   # TODO: set repos. can use wildcards?
136  #   maintenance.enable = true;
137  #   settings.init.defaultBranch = "main";
138  # };
139  programs.git = {
140  enable = true;
141  
142  config.init.defaultBranch = "main";
143};
144
145
146
147  environment.etc."ssh/git-user-ca.pub" = {
148    mode = "0644";
149    user = "root";
150    group = "root";
151
152    text = ''
153      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuc4HCdyEMu4uiYhlokSXmu+68hkm7j6CqVwjDkCeSj grace.pink
154    '';
155  };
156
157  environment.etc."ssh/git-principals" = {
158    mode = "0644";
159    user = "root";
160    group = "root";
161
162    text = ''
163      command="${pkgs.gitolite}/bin/gitolite-shell grace",restrict t:dev
164      command="${pkgs.gitolite}/bin/gitolite-shell grace-read",restrict u:grace
165    '';
166  };
167
168  environment.etc."ssh/git-authorized-keys" = {
169    mode = "0644";
170    user = "root";
171    group = "root";
172
173    text = gitoliteAuthorizedKeys + "\n";
174  };
175
176  services.openssh = {
177    enable = true;
178    extraConfig = ''
179      Match User git
180        TrustedUserCAKeys /etc/ssh/git-user-ca.pub
181        AuthorizedPrincipalsFile /etc/ssh/git-principals
182        AuthorizedKeysFile /etc/ssh/git-authorized-keys
183
184        PubkeyAuthentication yes
185        PasswordAuthentication no
186        KbdInteractiveAuthentication no
187
188        DisableForwarding yes
189        PermitTTY no
190        PermitUserRC no
191        X11Forwarding no
192    '';
193  };
194
195  services.fcgiwrap.instances = {
196    cgit-public = {
197      process = {
198        user = "git";
199        group = "git";
200      };
201
202      socket = {
203        user = "caddy";
204        group = "caddy";
205        mode = "0600";
206      };
207    };
208
209    cgit-private = {
210      process = {
211        user = "git";
212        group = "git";
213      };
214
215      socket = {
216        user = "caddy";
217        group = "caddy";
218        mode = "0600";
219      };
220    };
221  };
222
223  services.caddy = {
224    enable = true;
225
226    virtualHosts."beta.git.gae.moe".extraConfig = ''
227      @cgitStatic path \
228        /cgit.css \
229        /cgit.js \
230        /cgit.png \
231        /favicon.ico \
232        /robots.txt
233
234      handle @cgitStatic {
235        root * ${pkgs.cgit}/cgit
236        file_server
237      }
238
239      handle {
240        reverse_proxy unix/${config.services.fcgiwrap.instances.cgit-public.socket.address} {
241          transport fastcgi {
242            env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi
243            env SCRIPT_NAME /
244            env PATH_INFO {http.request.uri.path}
245            env CGIT_CONFIG ${publicCgitrc}
246            capture_stderr
247          }
248        }
249      }
250    '';
251
252    virtualHosts."git.k.gae.moe".extraConfig = ''
253      @notTailscale {
254        not remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
255      }
256
257      abort @notTailscale
258
259      @cgitStatic path \
260        /cgit.css \
261        /cgit.js \
262        /cgit.png \
263        /favicon.ico \
264        /robots.txt
265
266      handle @cgitStatic {
267        root * ${pkgs.cgit}/cgit
268        file_server
269      }
270
271      handle {
272        reverse_proxy unix/${config.services.fcgiwrap.instances.cgit-private.socket.address} {
273          transport fastcgi {
274            env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi
275            env SCRIPT_NAME /
276            env PATH_INFO {http.request.uri.path}
277            env CGIT_CONFIG ${privateCgitrc}
278            capture_stderr
279          }
280        }
281      }
282    '';
283  };
284
285  systemd.tmpfiles.rules = [
286    "d ${gitDir} 0750 git git -"
287    "d ${gitDir}/.ssh 0700 git git -"
288
289    "d ${cgitPub} 0755 git git -"
290    "d ${cgitPriv} 0755 git git -"
291
292    "L+ ${cgitPub}/grace - - - - ${gitDir}/repositories/grace"
293    # "L+ ${cgitPub}/person - - - - ${gitDir}/repositories/person"
294
295    "L+ ${cgitPriv}/private - - - - ${gitDir}/repositories/private"
296    "L+ ${cgitPriv}/classes - - - - ${gitDir}/repositories/classes"
297
298  ];
299
300}