grace/dots

dotfiles/nix configs

git clone https://git.gae.moe/grace/dots

Grace Yoderwafrn testing44ae0ad

wafrn-testing
branchesidkmainvulcanwafrn-testingall refs →
6.9 KiB301 linesraw
1{
2  config,
3  pkgs,
4  lib,
5  ...
6}:
7
8let
9  # TODO: make this use the home manager in nix-path? set in system.nix
10  home-manager = builtins.fetchTarball "https://github.com/nix-community/home-manager/archive/master.tar.gz";
11
12  gitDir = "/mnt/ext/git";
13  cgitPriv = "${gitDir}/cgitpriv";
14  cgitPub = "${gitDir}/cgitpub";
15  gitoliteKeys = {
16    gitolite-admin = [
17      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA6Eq2yVsZrCH8so7f3ygH0UWp6WkOxbhLNFC9QewKwoAAAABHNzaDo= grace_yoder@outlook.com"
18      # "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINySDE+jaYpuAWUdPQf/JcAWETeHgmh+T5Y4GUa7MfeM grace@turing"
19    ];
20
21    grace = [ ];
22    grace-read = [ ];
23  };
24
25  mkGitoliteKey =
26    user: key:
27    ''command="${pkgs.gitolite}/bin/gitolite-shell ${user}",restrict ${key}'';
28
29  gitoliteAuthorizedKeys =
30    lib.concatStringsSep "\n" (
31      lib.flatten (
32        lib.mapAttrsToList (
33          user: keys:
34          map (mkGitoliteKey user) keys
35        ) gitoliteKeys
36      )
37    );
38
39  fixGitolitePermissions = pkgs.writeShellScript "fix-gitolite-permissions" ''
40    set -eu
41
42    ${pkgs.coreutils}/bin/mkdir -p ${gitDir}/.ssh
43
44    ${pkgs.coreutils}/bin/chown git:git ${gitDir}
45    ${pkgs.coreutils}/bin/chmod 0750 ${gitDir}
46
47    ${pkgs.coreutils}/bin/chown git:git ${gitDir}/.ssh
48    ${pkgs.coreutils}/bin/chmod 0700 ${gitDir}/.ssh
49
50    if [ -e ${gitDir}/.ssh/authorized_keys ]; then
51      ${pkgs.coreutils}/bin/chown git:git \
52        ${gitDir}/.ssh/authorized_keys
53
54      ${pkgs.coreutils}/bin/chmod 0600 \
55        ${gitDir}/.ssh/authorized_keys
56    fi
57  '';
58  publicCgitrc = pkgs.writeText "cgit-public.rc" ''
59    virtual-root=/
60
61    css=/cgit.css
62    logo=/cgit.png
63    favicon=/favicon.ico
64
65    root-title=git.gae.moe
66    remove-suffix=1
67
68    enable-git-config=1
69
70    readme=:README.md
71    readme=:README
72    about-filter=${pkgs.writeShellScript "cgit-about-filter" ''
73      case "$1" in
74        *.md)
75          exec ${pkgs.pandoc}/bin/pandoc \
76            --from=gfm \
77            --to=html
78          ;;
79        *)
80          exec ${pkgs.coreutils}/bin/cat
81          ;;
82      esac
83    ''}
84
85    scan-path=${cgitPub}
86  '';
87  privateCgitrc = pkgs.writeText "cgit-private.rc" ''
88    virtual-root=/
89
90    css=/cgit.css
91    logo=/cgit.png
92    favicon=/favicon.ico
93
94    root-title=Private repositories
95    remove-suffix=1
96
97    enable-git-config=1
98
99    readme=:README.md
100    readme=:README
101    about-filter=${pkgs.writeShellScript "cgit-about-filter" ''
102      case "$1" in
103        *.md)
104          exec ${pkgs.pandoc}/bin/pandoc \
105            --from=gfm \
106            --to=html
107          ;;
108        *)
109          exec ${pkgs.coreutils}/bin/cat
110          ;;
111      esac
112    ''}
113
114    scan-path=${cgitPriv}
115  '';
116in
117{
118  services.gitolite = {
119    enable = true;
120
121    user = "git";
122    group = "git";
123
124    dataDir = "${gitDir}";
125
126    adminPubkey =
127      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA6Eq2yVsZrCH8so7f3ygH0UWp6WkOxbhLNFC9QewKwoAAAABHNzaDo= grace_yoder@outlook.com";
128    extraGitoliteRc = ''
129      $RC{GIT_CONFIG_KEYS} = 'gitweb\.owner gitweb\.description gitweb\.category';
130    '';
131  };
132  # home-manager.users.git.home.stateVersion = "26.11";
133  # home-manager.users.git.programs.git = {
134  #   lfs.enable = true;
135  #   # TODO: set repos. can use wildcards?
136  #   maintenance.enable = true;
137  #   settings.init.defaultBranch = "main";
138  # };
139  programs.git = {
140  enable = true;
141  
142  config.init.defaultBranch = "main";
143};
144
145
146
147  environment.etc."ssh/git-user-ca.pub" = {
148    mode = "0644";
149    user = "root";
150    group = "root";
151
152    text = ''
153      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEuc4HCdyEMu4uiYhlokSXmu+68hkm7j6CqVwjDkCeSj grace.pink
154    '';
155  };
156
157  environment.etc."ssh/git-principals" = {
158    mode = "0644";
159    user = "root";
160    group = "root";
161
162    text = ''
163      command="${pkgs.gitolite}/bin/gitolite-shell grace",restrict t:dev
164      command="${pkgs.gitolite}/bin/gitolite-shell root",restrict u:root
165      command="${pkgs.gitolite}/bin/gitolite-shell grace-read",restrict u:grace
166    '';
167  };
168
169  environment.etc."ssh/git-authorized-keys" = {
170    mode = "0644";
171    user = "root";
172    group = "root";
173
174    text = gitoliteAuthorizedKeys + "\n";
175  };
176
177  services.openssh = {
178    enable = true;
179    extraConfig = ''
180      Match User git
181        TrustedUserCAKeys /etc/ssh/git-user-ca.pub
182        AuthorizedPrincipalsFile /etc/ssh/git-principals
183        AuthorizedKeysFile /etc/ssh/git-authorized-keys
184
185        PubkeyAuthentication yes
186        PasswordAuthentication no
187        KbdInteractiveAuthentication no
188
189        DisableForwarding yes
190        PermitTTY no
191        PermitUserRC no
192        X11Forwarding no
193    '';
194  };
195
196  services.fcgiwrap.instances = {
197    cgit-public = {
198      process = {
199        user = "git";
200        group = "git";
201      };
202
203      socket = {
204        user = "caddy";
205        group = "caddy";
206        mode = "0600";
207      };
208    };
209
210    cgit-private = {
211      process = {
212        user = "git";
213        group = "git";
214      };
215
216      socket = {
217        user = "caddy";
218        group = "caddy";
219        mode = "0600";
220      };
221    };
222  };
223
224  services.caddy = {
225    enable = true;
226
227    virtualHosts."beta.git.gae.moe".extraConfig = ''
228      @cgitStatic path \
229        /cgit.css \
230        /cgit.js \
231        /cgit.png \
232        /favicon.ico \
233        /robots.txt
234
235      handle @cgitStatic {
236        root * ${pkgs.cgit}/cgit
237        file_server
238      }
239
240      handle {
241        reverse_proxy unix/${config.services.fcgiwrap.instances.cgit-public.socket.address} {
242          transport fastcgi {
243            env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi
244            env SCRIPT_NAME /
245            env PATH_INFO {http.request.uri.path}
246            env CGIT_CONFIG ${publicCgitrc}
247            capture_stderr
248          }
249        }
250      }
251    '';
252
253    virtualHosts."git.k.gae.moe".extraConfig = ''
254      @notTailscale {
255        not remote_ip 100.64.0.0/10 fd7a:115c:a1e0::/48
256      }
257
258      abort @notTailscale
259
260      @cgitStatic path \
261        /cgit.css \
262        /cgit.js \
263        /cgit.png \
264        /favicon.ico \
265        /robots.txt
266
267      handle @cgitStatic {
268        root * ${pkgs.cgit}/cgit
269        file_server
270      }
271
272      handle {
273        reverse_proxy unix/${config.services.fcgiwrap.instances.cgit-private.socket.address} {
274          transport fastcgi {
275            env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi
276            env SCRIPT_NAME /
277            env PATH_INFO {http.request.uri.path}
278            env CGIT_CONFIG ${privateCgitrc}
279            capture_stderr
280          }
281        }
282      }
283    '';
284  };
285
286  systemd.tmpfiles.rules = [
287    "d ${gitDir} 0750 git git -"
288    "d ${gitDir}/.ssh 0700 git git -"
289
290    "d ${cgitPub} 0755 git git -"
291    "d ${cgitPriv} 0755 git git -"
292
293    "L+ ${cgitPub}/grace - - - - ${gitDir}/repositories/grace"
294    # "L+ ${cgitPub}/person - - - - ${gitDir}/repositories/person"
295
296    "L+ ${cgitPriv}/private - - - - ${gitDir}/repositories/private"
297    "L+ ${cgitPriv}/classes - - - - ${gitDir}/repositories/classes"
298
299  ];
300
301}