refactor git into cgit, git-daemon and git-http-backend

16 files changed, 207 insertions, 174 deletions

diff --git a/playbook.yml b/playbook.yml
index c9a1444..a2e6880 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -40,9 +40,13 @@
   roles:
     - nginx
     - fcgiwrap
-    - git
+    - git-daemon
+    - cgit
+    - git-http-backend
   vars_files:
     - common.yml
+    - git.yml
+    - fcgiwrap.yml
 
 - name: Install ln
   hosts: "{{ services.ln.host }}"
diff --git a/roles/cgit/tasks/main.yml b/roles/cgit/tasks/main.yml
new file mode 100644
index 0000000..d9f96bc
--- /dev/null
+++ b/roles/cgit/tasks/main.yml
@@ -0,0 +1,69 @@
+- name: Install cgit
+  community.general.apk:
+    name: cgit
+
+- name: Add git readonly group
+  ansible.builtin.group:
+    name: "{{ git_readonly_group }}"
+
+- name: Configure read-write git user
+  ansible.builtin.user:
+    name: "{{ git_readwrite_user }}"
+    group: "{{ git_readwrite_group }}"
+    groups:
+      - "{{ git_readonly_group }}"
+    append: true
+
+- name: Create git directory in attached storage
+  ansible.builtin.file:
+    path: /media/seagate/git
+    state: directory
+    owner: "{{ git_readwrite_user }}"
+    group: "{{ git_readonly_group }}"
+    mode: "750"
+
+- name: Set owners recursively in git directory in attached storage
+  ansible.builtin.file:
+    path: /media/seagate/git
+    state: directory
+    owner: "{{ git_readwrite_user }}"
+    group: "{{ git_readonly_group }}"
+    recurse: true
+
+- name: Symlink git directory to storage medium
+  ansible.builtin.file:
+    src: /media/seagate/git
+    dest: "{{ git_directory }}"
+    owner: "{{ git_readwrite_user }}"
+    group: "{{ git_readonly_group }}"
+    state: link
+    mode: "750"
+
+- name: Install git.joeac.net nginx site config
+  register: cgit_nginx_site
+  vars:
+    fcgiwrap_socket: /run/fcgiwrap.sock
+  ansible.builtin.template:
+    src: nginx/git.joeac.net.conf
+    dest: /etc/nginx/http.d/git.joeac.net.conf
+    owner: "{{ git_readwrite_user }}"
+    group: "{{ git_readwrite_group }}"
+    mode: "660"
+
+- name: Create git.joeac.net nginx log directory
+  ansible.builtin.file:
+    path: /var/log/nginx/git.joeac.net
+    state: directory
+
+- name: Restart nginx daemon and configure to start on boot
+  when: cgit_nginx_site is changed
+  ansible.builtin.service:
+    name: nginx
+    enabled: true
+    state: restarted
+
+- name: Install cgit config
+  ansible.builtin.template:
+    src: cgitrc
+    dest: /etc/cgitrc
+    mode: "+r"
diff --git a/roles/git/files/cgitrc b/roles/cgit/templates/cgitrc
index 3b6d9c8..64ba6d4 100644
--- a/roles/git/files/cgitrc
+++ b/roles/cgit/templates/cgitrc
@@ -1,7 +1,7 @@
 root-title=joeac's git repositories
 root-desc=
-strict-export=git-daemon-export-ok
-scan-path=/srv/git
+strict-export={{ git_export_ok_file }}
+scan-path={{ git_directory }}
 virtual-root=/
 about-filter=/usr/lib/cgit/filters/about-formatting.sh
 readme=:README.md
diff --git a/roles/cgit/templates/nginx/git.joeac.net.conf b/roles/cgit/templates/nginx/git.joeac.net.conf
new file mode 100644
index 0000000..704665e
--- /dev/null
+++ b/roles/cgit/templates/nginx/git.joeac.net.conf
@@ -0,0 +1,22 @@
+server {
+  listen       {{ services.git.port }};
+  listen  [::]:{{ services.git.port }};
+  server_name  {{ ( subdomains | selectattr('service', 'eq', 'git') | first ).full_domain }};
+
+  root         /usr/share/webapps/cgit;
+  try_files    $uri @cgit;
+
+  access_log /var/log/nginx/git.joeac.net/access.log;
+  error_log /var/log/nginx/git.joeac.net/error.log;
+
+  location @cgit {
+      include             fastcgi_params;
+      fastcgi_param       SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi;
+      fastcgi_param       PATH_INFO       $uri;
+      fastcgi_param       QUERY_STRING    $args;
+      fastcgi_param       HTTP_HOST       $server_name;
+      fastcgi_pass        unix:{{ fcgiwrap_socket }};
+  }
+
+  include {{ git_nginx_include_directory }}/*.conf;
+}
diff --git a/roles/fcgiwrap/tasks/main.yml b/roles/fcgiwrap/tasks/main.yml
index 32a2dba..4eba5f1 100644
--- a/roles/fcgiwrap/tasks/main.yml
+++ b/roles/fcgiwrap/tasks/main.yml
@@ -5,7 +5,6 @@
 - name: Configure fcgiwrap daemon
   register: fcgiwrap_conf
   vars:
-    fcgiwrap_socket: /run/fcgiwrap.sock
     fcgiwrap_user: nginx
     fcgiwrap_group: nginx
   ansible.builtin.template:
diff --git a/roles/git-daemon/tasks/main.yml b/roles/git-daemon/tasks/main.yml
new file mode 100644
index 0000000..5508b1e
--- /dev/null
+++ b/roles/git-daemon/tasks/main.yml
@@ -0,0 +1,35 @@
+- name: Install git daemon
+  community.general.apk:
+    name: git-daemon-openrc
+
+- name: Create read-only git user
+  ansible.builtin.user:
+    name: "{{ git_readonly_user }}"
+    group: "{{ git_readonly_group }}"
+
+- name: Configure git daemon
+  register: gitd_conf
+  ansible.builtin.template:
+    src: conf.d/git-daemon
+    dest: /etc/conf.d/git-daemon
+
+- name: Restart git daemon and configure to start on boot
+  when: gitd_conf is changed
+  ansible.builtin.service:
+    name: git-daemon
+    enabled: true
+    state: restarted
+
+- name: Start git daemon and configure to start on boot
+  when: not ( gitd_conf is changed )
+  ansible.builtin.service:
+    name: git-daemon
+    enabled: true
+    state: started
+
+- name: Mark git directory safe in system-wide git config
+  register: gitconfig
+  community.general.git_config:
+    name: safe.directory
+    add_mode: add
+    value: "{{ git_directory }}/*"
diff --git a/roles/git-daemon/templates/conf.d/git-daemon b/roles/git-daemon/templates/conf.d/git-daemon
new file mode 100644
index 0000000..8a757d1
--- /dev/null
+++ b/roles/git-daemon/templates/conf.d/git-daemon
@@ -0,0 +1,3 @@
+GITDAEMON_OPTS="--syslog --base-path={{ git_directory }}"
+GIT_USER="{{ git_readonly_user }}"
+GIT_GROUP="{{ git_readonly_group }}"
diff --git a/roles/git/files/htpasswd b/roles/git-http-backend/files/htpasswd
index a32d3e2..a32d3e2 100644
--- a/roles/git/files/htpasswd
+++ b/roles/git-http-backend/files/htpasswd
diff --git a/roles/git-http-backend/tasks/main.yml b/roles/git-http-backend/tasks/main.yml
new file mode 100644
index 0000000..9dccf60
--- /dev/null
+++ b/roles/git-http-backend/tasks/main.yml
@@ -0,0 +1,41 @@
+- name: Install git
+  community.general.apk:
+    name: git
+
+- name: Create git.joeac.net nginx include directory
+  ansible.builtin.file:
+    path: "{{ git_nginx_include_directory }}"
+    state: directory
+    owner: nginx
+    group: nginx
+
+- name: Install htpasswd file
+  ansible.builtin.copy:
+    src: htpasswd
+    dest: /etc/nginx/.htpasswd
+    owner: "{{ git_readwrite_user }}"
+    group: "{{ git_readwrite_group }}"
+    mode: "400"
+
+- name: Install git-http-backend nginx directives
+  register: nginx_conf
+  vars:
+    fcgiwrap_socket: /run/fcgiwrap.sock
+  ansible.builtin.template:
+    src: git-http-backend.conf
+    dest: "{{ git_nginx_include_directory }}/git-http-backend.conf"
+    owner: "{{ git_readwrite_user }}"
+    group: "{{ git_readwrite_group }}"
+    mode: "660"
+
+- name: Restart nginx service if config changed
+  when: nginx_conf is changed
+  ansible.builtin.service:
+    name: nginx
+    state: restarted
+
+- name: Mark git directory safe in system-wide git config
+  community.general.git_config:
+    name: safe.directory
+    add_mode: add
+    value: "{{ git_directory }}/*"
diff --git a/roles/git-http-backend/templates/git-http-backend.conf b/roles/git-http-backend/templates/git-http-backend.conf
new file mode 100644
index 0000000..26e012b
--- /dev/null
+++ b/roles/git-http-backend/templates/git-http-backend.conf
@@ -0,0 +1,22 @@
+location ~ /(.+)/(HEAD|info/refs|objects|git-upload-pack|git-receive-pack) {
+  if (-f /srv/git/$1/{{ git_export_ok_file }}) {
+    set $auth_basic   "private-write repository";
+  }
+  if (!-f /srv/git/$1/{{ git_export_ok_file }}) {
+    set $auth_basic   "private repository";
+  }
+  if ($arg_service != git-receive-pack) {
+    set $auth_basic   off;
+  }
+  auth_basic          $auth_basic;
+  auth_basic_user_file .htpasswd;
+
+  include             fastcgi_params;
+  fastcgi_param       SCRIPT_FILENAME     /usr/libexec/git-core/git-http-backend;
+  fastcgi_param       PATH_INFO           $uri;
+  fastcgi_param       GIT_PROJECT_ROOT    /srv/git;
+  fastcgi_param       GIT_HTTP_EXPORT_ALL 1;
+  fastcgi_param       REMOTE_USER         $remote_user;
+  fastcgi_param       HOME                /srv/git;
+  fastcgi_pass        unix:{{ fcgiwrap_socket }};
+}
diff --git a/roles/git/files/.gitconfig b/roles/git/files/.gitconfig
deleted file mode 100644
index 78fdfcf..0000000
--- a/roles/git/files/.gitconfig
+++ /dev/null
@@ -1,3 +0,0 @@
-[safe]
-	directory = /srv/git/*
-	directory = /media/seagate/git/*
diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml
deleted file mode 100644
index da4bbf2..0000000
--- a/roles/git/tasks/main.yml
+++ /dev/null
@@ -1,122 +0,0 @@
-- name: Install cgit, git, and shadow
-  community.general.apk:
-    name:
-      - cgit
-      - git
-      - shadow
-
-- name: Add git group
-  ansible.builtin.group:
-    name: git
-
-- name: Append 'git' group to nginx user
-  ansible.builtin.user:
-    name: nginx
-    groups:
-      - git
-    append: true
-
-- name: Create git directory in attached storage
-  ansible.builtin.file:
-    path: /media/seagate/git
-    state: directory
-    owner: nginx
-    group: git
-    mode: "750"
-
-- name: Set owners recursively in git directory in attached storage
-  ansible.builtin.file:
-    path: /media/seagate/git
-    state: directory
-    owner: nginx
-    group: git
-    recurse: true
-
-- name: Symlink git directory to /srv/git
-  ansible.builtin.file:
-    src: /media/seagate/git
-    dest: /srv/git
-    owner: nginx
-    group: git
-    state: link
-    mode: "750"
-
-- name: Install htpasswd file
-  ansible.builtin.copy:
-    src: htpasswd
-    dest: /etc/nginx/.htpasswd
-    owner: nginx
-    group: nginx
-    mode: "400"
-
-- name: Install git.joeac.net nginx site config
-  register: cgit_nginx_site
-  vars:
-    fcgiwrap_socket: /run/fcgiwrap.sock
-  ansible.builtin.template:
-    src: nginx/git.joeac.net.conf
-    dest: /etc/nginx/http.d/git.joeac.net.conf
-    owner: nginx
-    group: nginx
-    mode: "660"
-
-- name: Create git.joeac.net nginx log directory
-  ansible.builtin.file:
-    path: /var/log/nginx/git.joeac.net
-    state: directory
-
-- name: Restart nginx daemon and configure to start on boot
-  when: cgit_nginx_site is changed
-  ansible.builtin.service:
-    name: nginx
-    enabled: true
-    state: restarted
-
-- name: Start nginx daemon and configure to start on boot
-  when: not ( cgit_nginx_site is changed )
-  ansible.builtin.service:
-    name: nginx
-    enabled: true
-    state: started
-
-- name: Install cgit config
-  ansible.builtin.copy:
-    src: cgitrc
-    dest: /etc/cgitrc
-    mode: "+r"
-
-- name: Install git daemon
-  community.general.apk:
-    name: git-daemon-openrc
-
-- name: Configure git daemon
-  register: gitd_conf
-  ansible.builtin.template:
-    src: conf.d/git-daemon
-    dest: /etc/conf.d/git-daemon
-
-- name: Create gitd user
-  ansible.builtin.user:
-    name: gitd
-    group: git
-
-- name: Mark /srv/git/* safe in system-wide git config
-  register: gitconfig
-  community.general.git_config:
-    name: safe.directory
-    add_mode: add
-    value: /srv/git/*
-
-- name: Restart git daemon and configure to start on boot
-  when: gitd_conf is changed
-  ansible.builtin.service:
-    name: git-daemon
-    enabled: true
-    state: restarted
-
-- name: Start git daemon and configure to start on boot
-  when: not ( gitd_conf is changed )
-  ansible.builtin.service:
-    name: git-daemon
-    enabled: true
-    state: started
diff --git a/roles/git/templates/conf.d/git-daemon b/roles/git/templates/conf.d/git-daemon
deleted file mode 100644
index c50b66b..0000000
--- a/roles/git/templates/conf.d/git-daemon
+++ /dev/null
@@ -1,3 +0,0 @@
-GITDAEMON_OPTS="--syslog --base-path=/srv/git"
-GIT_USER="gitd"
-GIT_GROUP="git"
diff --git a/roles/git/templates/nginx/git.joeac.net.conf b/roles/git/templates/nginx/git.joeac.net.conf
deleted file mode 100644
index e09a655..0000000
--- a/roles/git/templates/nginx/git.joeac.net.conf
+++ /dev/null
@@ -1,42 +0,0 @@
-server {
-  listen       {{ services.git.port }};
-  listen  [::]:{{ services.git.port }};
-  server_name  {{ ( subdomains | selectattr('service', 'eq', 'git') | first ).full_domain }};
-
-  root         /usr/share/webapps/cgit;
-  try_files    $uri @cgit;
-
-  access_log /var/log/nginx/git.joeac.net/access.log;
-  error_log /var/log/nginx/git.joeac.net/error.log;
-
-  location ~ /(.+)/(HEAD|info/refs|objects|git-upload-pack|git-receive-pack) {
-    if (-f /srv/git/$1/git-daemon-export-ok) {
-      set $auth_basic   "private-write repository";
-    }
-    if (!-f /srv/git/$1/git-daemon-export-ok) {
-      set $auth_basic   "private repository";
-    }
-    if ($arg_service != git-receive-pack) {
-      set $auth_basic   off;
-    }
-    auth_basic          $auth_basic;
-    auth_basic_user_file .htpasswd;
-    include             fastcgi_params;
-    fastcgi_param       SCRIPT_FILENAME     /usr/libexec/git-core/git-http-backend;
-    fastcgi_param       PATH_INFO           $uri;
-    fastcgi_param       GIT_PROJECT_ROOT    /srv/git;
-    fastcgi_param       GIT_HTTP_EXPORT_ALL 1;
-    fastcgi_param       REMOTE_USER         $remote_user;
-    fastcgi_param       HOME                /srv/git;
-    fastcgi_pass        unix:{{ fcgiwrap_socket }};
-  }
-
-  location @cgit {
-      include             fastcgi_params;
-      fastcgi_param       SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi;
-      fastcgi_param       PATH_INFO       $uri;
-      fastcgi_param       QUERY_STRING    $args;
-      fastcgi_param       HTTP_HOST       $server_name;
-      fastcgi_pass        unix:{{ fcgiwrap_socket }};
-  }
-}
diff --git a/vars/fcgiwrap.yml b/vars/fcgiwrap.yml
new file mode 100644
index 0000000..d1ae7ca
--- /dev/null
+++ b/vars/fcgiwrap.yml
@@ -0,0 +1 @@
+fcgiwrap_socket: /run/fcgiwrap.sock
diff --git a/vars/git.yml b/vars/git.yml
new file mode 100644
index 0000000..ed6bce7
--- /dev/null
+++ b/vars/git.yml
@@ -0,0 +1,7 @@
+git_nginx_include_directory: /etc/nginx/git.joeac.net.d
+git_directory: /srv/git
+git_export_ok_file: git-daemon-export-ok
+git_readonly_user: gitd
+git_readonly_group: git
+git_readwrite_user: nginx
+git_readwrite_group: nginx