grace/dots

dotfiles/nix configs

git clone https://git.gae.moe/grace/dots

Grace Yoderhamano againfdde154

vulcan
branchesidkmainvulcanwafrn-testingall refs →
3.2 KiB133 linesraw
1{
2  config,
3  pkgs,
4  lib,
5  ...
6}:
7
8let
9  gitoliteKeys = {
10    gitolite-admin = [
11      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA6Eq2yVsZrCH8so7f3ygH0UWp6WkOxbhLNFC9QewKwoAAAABHNzaDo= grace_yoder@outlook.com"
12      # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINySDE+jaYpuAWUdPQf/JcAWETeHgmh+T5Y4GUa7MfeM grace@turing"
13    ];
14
15    grace = [ ];
16    grace-read = [ ];
17  };
18
19  mkGitoliteKey =
20    user: key:
21    ''command="${pkgs.gitolite}/bin/gitolite-shell ${user}",restrict ${key}'';
22
23  gitoliteAuthorizedKeys =
24    lib.concatStringsSep "\n" (
25      lib.flatten (
26        lib.mapAttrsToList (
27          user: keys:
28          map (mkGitoliteKey user) keys
29        ) gitoliteKeys
30      )
31    );
32
33  fixGitolitePermissions = pkgs.writeShellScript "fix-gitolite-permissions" ''
34    set -eu
35
36    ${pkgs.coreutils}/bin/mkdir -p /var/lib/git-server/.ssh
37
38    ${pkgs.coreutils}/bin/chown git:git /var/lib/git-server
39    ${pkgs.coreutils}/bin/chmod 0750 /var/lib/git-server
40
41    ${pkgs.coreutils}/bin/chown git:git /var/lib/git-server/.ssh
42    ${pkgs.coreutils}/bin/chmod 0700 /var/lib/git-server/.ssh
43
44    if [ -e /var/lib/git-server/.ssh/authorized_keys ]; then
45      ${pkgs.coreutils}/bin/chown git:git \
46        /var/lib/git-server/.ssh/authorized_keys
47
48      ${pkgs.coreutils}/bin/chmod 0600 \
49        /var/lib/git-server/.ssh/authorized_keys
50    fi
51  '';
52in
53{
54  services.gitolite = {
55    enable = true;
56
57    user = "git";
58    group = "git";
59
60    dataDir = "/var/lib/git-server";
61
62    adminPubkey =
63      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA6Eq2yVsZrCH8so7f3ygH0UWp6WkOxbhLNFC9QewKwoAAAABHNzaDo= grace_yoder@outlook.com";
64  };
65
66  # IMPORTANT:
67  # mode != "symlink" makes these REAL /etc files instead of
68  # symlinks through /nix/store, which sshd StrictModes rejects.
69
70  environment.etc."ssh/git-user-ca.pub" = {
71    mode = "0644";
72    user = "root";
73    group = "root";
74
75    text = ''
76      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuc4HCdyEMu4uiYhlokSXmu+68hkm7j6CqVwjDkCeSj grace.pink
77    '';
78  };
79
80  environment.etc."ssh/git-principals" = {
81    mode = "0644";
82    user = "root";
83    group = "root";
84
85    text = ''
86      command="${pkgs.gitolite}/bin/gitolite-shell grace",restrict t:dev
87      command="${pkgs.gitolite}/bin/gitolite-shell grace-read",restrict u:grace
88    '';
89  };
90
91  environment.etc."ssh/git-authorized-keys" = {
92    mode = "0644";
93    user = "root";
94    group = "root";
95
96    text = gitoliteAuthorizedKeys + "\n";
97  };
98
99  services.openssh = {
100    enable = true;
101
102    ports = [
103      22
104      2222
105    ];
106
107    extraConfig = ''
108      Match User git
109        TrustedUserCAKeys /etc/ssh/git-user-ca.pub
110        AuthorizedPrincipalsFile /etc/ssh/git-principals
111        AuthorizedKeysFile /etc/ssh/git-authorized-keys
112
113        PubkeyAuthentication yes
114        PasswordAuthentication no
115        KbdInteractiveAuthentication no
116
117        DisableForwarding yes
118        PermitTTY no
119        PermitUserRC no
120        X11Forwarding no
121    '';
122  };
123
124  systemd.services.gitolite-init.serviceConfig.ExecStartPre =
125    lib.mkBefore [
126      "+${fixGitolitePermissions}"
127    ];
128
129  systemd.tmpfiles.rules = [
130    "d /var/lib/git-server 0750 git git -"
131    "d /var/lib/git-server/.ssh 0700 git git -"
132  ];
133}