serves git over https:// and git://

4 files changed, 88 insertions, 60 deletions

diff --git a/roles/git/files/htpasswd b/roles/git/files/htpasswd
new file mode 100644
index 0000000..a32d3e2
--- /dev/null
+++ b/roles/git/files/htpasswd
@@ -0,0 +1,9 @@
+$ANSIBLE_VAULT;1.2;AES256;ansible
+35346161393133303561303166386236386666346531643864393063383437626565366331353061
+3761366332303239353638613938356662306565346439380a613738376436353563326335393064
+64626337336238313164636437643566383136383830623636363036663762356462663465636166
+3666323734343835660a643566636532386630346138396331373266623031616535353266396563
+33643936633234623136616436646536356661343132356562656462616334316233353161323831
+61346232326235393839393431623532383164393430363663646630343132653266613537613736
+65393332663232316131386561346464373961313062303132396330353839663761613635666231
+66306431656336376334
diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml
index 67083f7..033400e 100644
--- a/roles/git/tasks/main.yml
+++ b/roles/git/tasks/main.yml
@@ -11,32 +11,9 @@
   ansible.builtin.group:
     name: git
 
-- name: Add git user
+- name: Append 'git' group to nginx user
   ansible.builtin.user:
-    name: git
-    group: git
-
-- name: Find existing shells
-  register: existing_shells
-  changed_when: false
-  ansible.builtin.command: cat /etc/shells
-
-- name: Add git-shell to /etc/shells
-  when: "'/git-shell' not in existing_shells.stdout"
-  ansible.builtin.shell: which git-shell >> /etc/shells
-
-- name: Find current git login shell
-  register: current_git_login_shell
-  ansible.builtin.shell: "cat /etc/passwd | grep ^git: | grep -o [^:]*$"
-
-- name: Set git login shell to git-shell
-  when: "'git-shell' not in current_git_login_shell"
-  ansible.builtin.shell: chsh -s $(which git-shell) git
-
-- name: Create fcgiwrap user and append 'git' group
-  ansible.builtin.user:
-    name: "{{ fcgiwrap_user }}"
-    group: "{{ fcgiwrap_group }}"
+    name: nginx
     groups:
       - git
     append: true
@@ -45,21 +22,33 @@
   ansible.builtin.file:
     path: /media/seagate/git
     state: directory
-    owner: git
+    owner: nginx
     group: git
     mode: "750"
 
+- name: Set owners recursively in git directory in attached storage
+  ansible.builtin.file:
+    path: /media/seagate/git
+    state: directory
+    owner: nginx
+    group: git
+    recurse: true
+
 - name: Symlink git directory to /srv/git
   ansible.builtin.file:
     src: /media/seagate/git
     dest: /srv/git
-    owner: git
+    owner: nginx
     group: git
     state: link
     mode: "750"
 
 - name: Configure fcgiwrap daemon
   register: fcgiwrap_conf
+  vars:
+    fcgiwrap_socket: /run/fcgiwrap.sock
+    fcgiwrap_user: nginx
+    fcgiwrap_group: nginx
   ansible.builtin.template:
     src: conf.d/fcgiwrap
     dest: /etc/conf.d/fcgiwrap
@@ -85,11 +74,21 @@
     path: /etc/nginx/http.d/default.conf
     state: absent
 
-- name: Install cgit nginx site config
+- name: Install htpasswd file
+  ansible.builtin.copy:
+    src: htpasswd
+    dest: /etc/nginx/.htpasswd
+    owner: nginx
+    group: nginx
+    mode: "400"
+
+- name: Install git.joeac.net nginx site config
   register: cgit_nginx_site
+  vars:
+    fcgiwrap_socket: /run/fcgiwrap.sock
   ansible.builtin.template:
-    src: nginx/cgit.conf
-    dest: /etc/nginx/http.d/cgit.conf
+    src: nginx/git.joeac.net.conf
+    dest: /etc/nginx/http.d/git.joeac.net.conf
     owner: nginx
     group: nginx
     mode: "660"
@@ -134,24 +133,22 @@
     name: gitd
     group: git
 
-- name: Mark git directory safe for gitd git operations
-  register: gitd_gitconfig
-  ansible.builtin.copy:
-    src: .gitconfig
-    dest: ~gitd/.gitconfig
-    owner: gitd
-    group: git
-    mode: "644"
+- name: Mark /srv/git/* safe in system-wide git config
+  register: gitconfig
+  community.general.git_config:
+    name: safe.directory
+    add_mode: add
+    value: /srv/git/*
 
 - name: Restart git daemon and configure to start on boot
-  when: gitd_conf is changed or gitd_gitconfig is changed
+  when: gitd_conf is changed
   ansible.builtin.service:
     name: git-daemon
     enabled: true
     state: restarted
 
 - name: Start git daemon and configure to start on boot
-  when: not ( gitd_conf is changed or gitd_gitconfig is changed )
+  when: not ( gitd_conf is changed )
   ansible.builtin.service:
     name: git-daemon
     enabled: true
diff --git a/roles/git/templates/nginx/cgit.conf b/roles/git/templates/nginx/cgit.conf
deleted file mode 100644
index 7d29608..0000000
--- a/roles/git/templates/nginx/cgit.conf
+++ /dev/null
@@ -1,20 +0,0 @@
-server {
-  listen       {{ services.git.port }};
-  listen  [::]:{{ services.git.port }};
-  server_name  {{ ( subdomains | selectattr('service', 'eq', 'git') | first ).full_domain }};
-
-  root         /usr/share/webapps/cgit;
-  try_files    $uri @cgit;
-
-  access_log /var/log/nginx/git.joeac.net/access.log;
-  error_log /var/log/nginx/git.joeac.net/error.log;
-
-  location @cgit {
-      include             fastcgi_params;
-      fastcgi_param       SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi;
-      fastcgi_param       PATH_INFO       $uri;
-      fastcgi_param       QUERY_STRING    $args;
-      fastcgi_param       HTTP_HOST       $server_name;
-      fastcgi_pass        unix:/run/fcgiwrap/fcgiwrap.sock;
-  }
-}
diff --git a/roles/git/templates/nginx/git.joeac.net.conf b/roles/git/templates/nginx/git.joeac.net.conf
new file mode 100644
index 0000000..e09a655
--- /dev/null
+++ b/roles/git/templates/nginx/git.joeac.net.conf
@@ -0,0 +1,42 @@
+server {
+  listen       {{ services.git.port }};
+  listen  [::]:{{ services.git.port }};
+  server_name  {{ ( subdomains | selectattr('service', 'eq', 'git') | first ).full_domain }};
+
+  root         /usr/share/webapps/cgit;
+  try_files    $uri @cgit;
+
+  access_log /var/log/nginx/git.joeac.net/access.log;
+  error_log /var/log/nginx/git.joeac.net/error.log;
+
+  location ~ /(.+)/(HEAD|info/refs|objects|git-upload-pack|git-receive-pack) {
+    if (-f /srv/git/$1/git-daemon-export-ok) {
+      set $auth_basic   "private-write repository";
+    }
+    if (!-f /srv/git/$1/git-daemon-export-ok) {
+      set $auth_basic   "private repository";
+    }
+    if ($arg_service != git-receive-pack) {
+      set $auth_basic   off;
+    }
+    auth_basic          $auth_basic;
+    auth_basic_user_file .htpasswd;
+    include             fastcgi_params;
+    fastcgi_param       SCRIPT_FILENAME     /usr/libexec/git-core/git-http-backend;
+    fastcgi_param       PATH_INFO           $uri;
+    fastcgi_param       GIT_PROJECT_ROOT    /srv/git;
+    fastcgi_param       GIT_HTTP_EXPORT_ALL 1;
+    fastcgi_param       REMOTE_USER         $remote_user;
+    fastcgi_param       HOME                /srv/git;
+    fastcgi_pass        unix:{{ fcgiwrap_socket }};
+  }
+
+  location @cgit {
+      include             fastcgi_params;
+      fastcgi_param       SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi;
+      fastcgi_param       PATH_INFO       $uri;
+      fastcgi_param       QUERY_STRING    $args;
+      fastcgi_param       HTTP_HOST       $server_name;
+      fastcgi_pass        unix:{{ fcgiwrap_socket }};
+  }
+}