summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--playbook.yml6
-rw-r--r--roles/cgit/tasks/main.yml69
-rw-r--r--roles/cgit/templates/cgitrc (renamed from roles/git/files/cgitrc)4
-rw-r--r--roles/cgit/templates/nginx/git.joeac.net.conf22
-rw-r--r--roles/fcgiwrap/tasks/main.yml1
-rw-r--r--roles/git-daemon/tasks/main.yml35
-rw-r--r--roles/git-daemon/templates/conf.d/git-daemon3
-rw-r--r--roles/git-http-backend/files/htpasswd (renamed from roles/git/files/htpasswd)0
-rw-r--r--roles/git-http-backend/tasks/main.yml41
-rw-r--r--roles/git-http-backend/templates/git-http-backend.conf22
-rw-r--r--roles/git/files/.gitconfig3
-rw-r--r--roles/git/tasks/main.yml122
-rw-r--r--roles/git/templates/conf.d/git-daemon3
-rw-r--r--roles/git/templates/nginx/git.joeac.net.conf42
-rw-r--r--vars/fcgiwrap.yml1
-rw-r--r--vars/git.yml7
16 files changed, 207 insertions, 174 deletions
diff --git a/playbook.yml b/playbook.yml
index c9a1444..a2e6880 100644
--- a/playbook.yml
+++ b/playbook.yml
@@ -40,9 +40,13 @@
roles:
- nginx
- fcgiwrap
- - git
+ - git-daemon
+ - cgit
+ - git-http-backend
vars_files:
- common.yml
+ - git.yml
+ - fcgiwrap.yml
- name: Install ln
hosts: "{{ services.ln.host }}"
diff --git a/roles/cgit/tasks/main.yml b/roles/cgit/tasks/main.yml
new file mode 100644
index 0000000..d9f96bc
--- /dev/null
+++ b/roles/cgit/tasks/main.yml
@@ -0,0 +1,69 @@
+- name: Install cgit
+ community.general.apk:
+ name: cgit
+
+- name: Add git readonly group
+ ansible.builtin.group:
+ name: "{{ git_readonly_group }}"
+
+- name: Configure read-write git user
+ ansible.builtin.user:
+ name: "{{ git_readwrite_user }}"
+ group: "{{ git_readwrite_group }}"
+ groups:
+ - "{{ git_readonly_group }}"
+ append: true
+
+- name: Create git directory in attached storage
+ ansible.builtin.file:
+ path: /media/seagate/git
+ state: directory
+ owner: "{{ git_readwrite_user }}"
+ group: "{{ git_readonly_group }}"
+ mode: "750"
+
+- name: Set owners recursively in git directory in attached storage
+ ansible.builtin.file:
+ path: /media/seagate/git
+ state: directory
+ owner: "{{ git_readwrite_user }}"
+ group: "{{ git_readonly_group }}"
+ recurse: true
+
+- name: Symlink git directory to storage medium
+ ansible.builtin.file:
+ src: /media/seagate/git
+ dest: "{{ git_directory }}"
+ owner: "{{ git_readwrite_user }}"
+ group: "{{ git_readonly_group }}"
+ state: link
+ mode: "750"
+
+- name: Install git.joeac.net nginx site config
+ register: cgit_nginx_site
+ vars:
+ fcgiwrap_socket: /run/fcgiwrap.sock
+ ansible.builtin.template:
+ src: nginx/git.joeac.net.conf
+ dest: /etc/nginx/http.d/git.joeac.net.conf
+ owner: "{{ git_readwrite_user }}"
+ group: "{{ git_readwrite_group }}"
+ mode: "660"
+
+- name: Create git.joeac.net nginx log directory
+ ansible.builtin.file:
+ path: /var/log/nginx/git.joeac.net
+ state: directory
+
+- name: Restart nginx daemon and configure to start on boot
+ when: cgit_nginx_site is changed
+ ansible.builtin.service:
+ name: nginx
+ enabled: true
+ state: restarted
+
+- name: Install cgit config
+ ansible.builtin.template:
+ src: cgitrc
+ dest: /etc/cgitrc
+ mode: "+r"
diff --git a/roles/git/files/cgitrc b/roles/cgit/templates/cgitrc
index 3b6d9c8..64ba6d4 100644
--- a/roles/git/files/cgitrc
+++ b/roles/cgit/templates/cgitrc
@@ -1,7 +1,7 @@
root-title=joeac's git repositories
root-desc=
-strict-export=git-daemon-export-ok
-scan-path=/srv/git
+strict-export={{ git_export_ok_file }}
+scan-path={{ git_directory }}
virtual-root=/
about-filter=/usr/lib/cgit/filters/about-formatting.sh
readme=:README.md
diff --git a/roles/cgit/templates/nginx/git.joeac.net.conf b/roles/cgit/templates/nginx/git.joeac.net.conf
new file mode 100644
index 0000000..704665e
--- /dev/null
+++ b/roles/cgit/templates/nginx/git.joeac.net.conf
@@ -0,0 +1,22 @@
+server {
+ listen {{ services.git.port }};
+ listen [::]:{{ services.git.port }};
+ server_name {{ ( subdomains | selectattr('service', 'eq', 'git') | first ).full_domain }};
+
+ root /usr/share/webapps/cgit;
+ try_files $uri @cgit;
+
+ access_log /var/log/nginx/git.joeac.net/access.log;
+ error_log /var/log/nginx/git.joeac.net/error.log;
+
+ location @cgit {
+ include fastcgi_params;
+ fastcgi_param SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi;
+ fastcgi_param PATH_INFO $uri;
+ fastcgi_param QUERY_STRING $args;
+ fastcgi_param HTTP_HOST $server_name;
+ fastcgi_pass unix:{{ fcgiwrap_socket }};
+ }
+
+ include {{ git_nginx_include_directory }}/*.conf;
+}
diff --git a/roles/fcgiwrap/tasks/main.yml b/roles/fcgiwrap/tasks/main.yml
index 32a2dba..4eba5f1 100644
--- a/roles/fcgiwrap/tasks/main.yml
+++ b/roles/fcgiwrap/tasks/main.yml
@@ -5,7 +5,6 @@
- name: Configure fcgiwrap daemon
register: fcgiwrap_conf
vars:
- fcgiwrap_socket: /run/fcgiwrap.sock
fcgiwrap_user: nginx
fcgiwrap_group: nginx
ansible.builtin.template:
diff --git a/roles/git-daemon/tasks/main.yml b/roles/git-daemon/tasks/main.yml
new file mode 100644
index 0000000..5508b1e
--- /dev/null
+++ b/roles/git-daemon/tasks/main.yml
@@ -0,0 +1,35 @@
+- name: Install git daemon
+ community.general.apk:
+ name: git-daemon-openrc
+
+- name: Create read-only git user
+ ansible.builtin.user:
+ name: "{{ git_readonly_user }}"
+ group: "{{ git_readonly_group }}"
+
+- name: Configure git daemon
+ register: gitd_conf
+ ansible.builtin.template:
+ src: conf.d/git-daemon
+ dest: /etc/conf.d/git-daemon
+
+- name: Restart git daemon and configure to start on boot
+ when: gitd_conf is changed
+ ansible.builtin.service:
+ name: git-daemon
+ enabled: true
+ state: restarted
+
+- name: Start git daemon and configure to start on boot
+ when: not ( gitd_conf is changed )
+ ansible.builtin.service:
+ name: git-daemon
+ enabled: true
+ state: started
+
+- name: Mark git directory safe in system-wide git config
+ register: gitconfig
+ community.general.git_config:
+ name: safe.directory
+ add_mode: add
+ value: "{{ git_directory }}/*"
diff --git a/roles/git-daemon/templates/conf.d/git-daemon b/roles/git-daemon/templates/conf.d/git-daemon
new file mode 100644
index 0000000..8a757d1
--- /dev/null
+++ b/roles/git-daemon/templates/conf.d/git-daemon
@@ -0,0 +1,3 @@
+GITDAEMON_OPTS="--syslog --base-path={{ git_directory }}"
+GIT_USER="{{ git_readonly_user }}"
+GIT_GROUP="{{ git_readonly_group }}"
diff --git a/roles/git/files/htpasswd b/roles/git-http-backend/files/htpasswd
index a32d3e2..a32d3e2 100644
--- a/roles/git/files/htpasswd
+++ b/roles/git-http-backend/files/htpasswd
diff --git a/roles/git-http-backend/tasks/main.yml b/roles/git-http-backend/tasks/main.yml
new file mode 100644
index 0000000..9dccf60
--- /dev/null
+++ b/roles/git-http-backend/tasks/main.yml
@@ -0,0 +1,41 @@
+- name: Install git
+ community.general.apk:
+ name: git
+
+- name: Create git.joeac.net nginx include directory
+ ansible.builtin.file:
+ path: "{{ git_nginx_include_directory }}"
+ state: directory
+ owner: nginx
+ group: nginx
+
+- name: Install htpasswd file
+ ansible.builtin.copy:
+ src: htpasswd
+ dest: /etc/nginx/.htpasswd
+ owner: "{{ git_readwrite_user }}"
+ group: "{{ git_readwrite_group }}"
+ mode: "400"
+
+- name: Install git-http-backend nginx directives
+ register: nginx_conf
+ vars:
+ fcgiwrap_socket: /run/fcgiwrap.sock
+ ansible.builtin.template:
+ src: git-http-backend.conf
+ dest: "{{ git_nginx_include_directory }}/git-http-backend.conf"
+ owner: "{{ git_readwrite_user }}"
+ group: "{{ git_readwrite_group }}"
+ mode: "660"
+
+- name: Restart nginx service if config changed
+ when: nginx_conf is changed
+ ansible.builtin.service:
+ name: nginx
+ state: restarted
+
+- name: Mark git directory safe in system-wide git config
+ community.general.git_config:
+ name: safe.directory
+ add_mode: add
+ value: "{{ git_directory }}/*"
diff --git a/roles/git-http-backend/templates/git-http-backend.conf b/roles/git-http-backend/templates/git-http-backend.conf
new file mode 100644
index 0000000..26e012b
--- /dev/null
+++ b/roles/git-http-backend/templates/git-http-backend.conf
@@ -0,0 +1,22 @@
+location ~ /(.+)/(HEAD|info/refs|objects|git-upload-pack|git-receive-pack) {
+ if (-f /srv/git/$1/{{ git_export_ok_file }}) {
+ set $auth_basic "private-write repository";
+ }
+ if (!-f /srv/git/$1/{{ git_export_ok_file }}) {
+ set $auth_basic "private repository";
+ }
+ if ($arg_service != git-receive-pack) {
+ set $auth_basic off;
+ }
+ auth_basic $auth_basic;
+ auth_basic_user_file .htpasswd;
+
+ include fastcgi_params;
+ fastcgi_param SCRIPT_FILENAME /usr/libexec/git-core/git-http-backend;
+ fastcgi_param PATH_INFO $uri;
+ fastcgi_param GIT_PROJECT_ROOT /srv/git;
+ fastcgi_param GIT_HTTP_EXPORT_ALL 1;
+ fastcgi_param REMOTE_USER $remote_user;
+ fastcgi_param HOME /srv/git;
+ fastcgi_pass unix:{{ fcgiwrap_socket }};
+}
diff --git a/roles/git/files/.gitconfig b/roles/git/files/.gitconfig
deleted file mode 100644
index 78fdfcf..0000000
--- a/roles/git/files/.gitconfig
+++ /dev/null
@@ -1,3 +0,0 @@
-[safe]
- directory = /srv/git/*
- directory = /media/seagate/git/*
diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml
deleted file mode 100644
index da4bbf2..0000000
--- a/roles/git/tasks/main.yml
+++ /dev/null
@@ -1,122 +0,0 @@
-- name: Install cgit, git, and shadow
- community.general.apk:
- name:
- - cgit
- - git
- - shadow
-
-- name: Add git group
- ansible.builtin.group:
- name: git
-
-- name: Append 'git' group to nginx user
- ansible.builtin.user:
- name: nginx
- groups:
- - git
- append: true
-
-- name: Create git directory in attached storage
- ansible.builtin.file:
- path: /media/seagate/git
- state: directory
- owner: nginx
- group: git
- mode: "750"
-
-- name: Set owners recursively in git directory in attached storage
- ansible.builtin.file:
- path: /media/seagate/git
- state: directory
- owner: nginx
- group: git
- recurse: true
-
-- name: Symlink git directory to /srv/git
- ansible.builtin.file:
- src: /media/seagate/git
- dest: /srv/git
- owner: nginx
- group: git
- state: link
- mode: "750"
-
-- name: Install htpasswd file
- ansible.builtin.copy:
- src: htpasswd
- dest: /etc/nginx/.htpasswd
- owner: nginx
- group: nginx
- mode: "400"
-
-- name: Install git.joeac.net nginx site config
- register: cgit_nginx_site
- vars:
- fcgiwrap_socket: /run/fcgiwrap.sock
- ansible.builtin.template:
- src: nginx/git.joeac.net.conf
- dest: /etc/nginx/http.d/git.joeac.net.conf
- owner: nginx
- group: nginx
- mode: "660"
-
-- name: Create git.joeac.net nginx log directory
- ansible.builtin.file:
- path: /var/log/nginx/git.joeac.net
- state: directory
-
-- name: Restart nginx daemon and configure to start on boot
- when: cgit_nginx_site is changed
- ansible.builtin.service:
- name: nginx
- enabled: true
- state: restarted
-
-- name: Start nginx daemon and configure to start on boot
- when: not ( cgit_nginx_site is changed )
- ansible.builtin.service:
- name: nginx
- enabled: true
- state: started
-
-- name: Install cgit config
- ansible.builtin.copy:
- src: cgitrc
- dest: /etc/cgitrc
- mode: "+r"
-
-- name: Install git daemon
- community.general.apk:
- name: git-daemon-openrc
-
-- name: Configure git daemon
- register: gitd_conf
- ansible.builtin.template:
- src: conf.d/git-daemon
- dest: /etc/conf.d/git-daemon
-
-- name: Create gitd user
- ansible.builtin.user:
- name: gitd
- group: git
-
-- name: Mark /srv/git/* safe in system-wide git config
- register: gitconfig
- community.general.git_config:
- name: safe.directory
- add_mode: add
- value: /srv/git/*
-
-- name: Restart git daemon and configure to start on boot
- when: gitd_conf is changed
- ansible.builtin.service:
- name: git-daemon
- enabled: true
- state: restarted
-
-- name: Start git daemon and configure to start on boot
- when: not ( gitd_conf is changed )
- ansible.builtin.service:
- name: git-daemon
- enabled: true
- state: started
diff --git a/roles/git/templates/conf.d/git-daemon b/roles/git/templates/conf.d/git-daemon
deleted file mode 100644
index c50b66b..0000000
--- a/roles/git/templates/conf.d/git-daemon
+++ /dev/null
@@ -1,3 +0,0 @@
-GITDAEMON_OPTS="--syslog --base-path=/srv/git"
-GIT_USER="gitd"
-GIT_GROUP="git"
diff --git a/roles/git/templates/nginx/git.joeac.net.conf b/roles/git/templates/nginx/git.joeac.net.conf
deleted file mode 100644
index e09a655..0000000
--- a/roles/git/templates/nginx/git.joeac.net.conf
+++ /dev/null
@@ -1,42 +0,0 @@
-server {
- listen {{ services.git.port }};
- listen [::]:{{ services.git.port }};
- server_name {{ ( subdomains | selectattr('service', 'eq', 'git') | first ).full_domain }};
-
- root /usr/share/webapps/cgit;
- try_files $uri @cgit;
-
- access_log /var/log/nginx/git.joeac.net/access.log;
- error_log /var/log/nginx/git.joeac.net/error.log;
-
- location ~ /(.+)/(HEAD|info/refs|objects|git-upload-pack|git-receive-pack) {
- if (-f /srv/git/$1/git-daemon-export-ok) {
- set $auth_basic "private-write repository";
- }
- if (!-f /srv/git/$1/git-daemon-export-ok) {
- set $auth_basic "private repository";
- }
- if ($arg_service != git-receive-pack) {
- set $auth_basic off;
- }
- auth_basic $auth_basic;
- auth_basic_user_file .htpasswd;
- include fastcgi_params;
- fastcgi_param SCRIPT_FILENAME /usr/libexec/git-core/git-http-backend;
- fastcgi_param PATH_INFO $uri;
- fastcgi_param GIT_PROJECT_ROOT /srv/git;
- fastcgi_param GIT_HTTP_EXPORT_ALL 1;
- fastcgi_param REMOTE_USER $remote_user;
- fastcgi_param HOME /srv/git;
- fastcgi_pass unix:{{ fcgiwrap_socket }};
- }
-
- location @cgit {
- include fastcgi_params;
- fastcgi_param SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi;
- fastcgi_param PATH_INFO $uri;
- fastcgi_param QUERY_STRING $args;
- fastcgi_param HTTP_HOST $server_name;
- fastcgi_pass unix:{{ fcgiwrap_socket }};
- }
-}
diff --git a/vars/fcgiwrap.yml b/vars/fcgiwrap.yml
new file mode 100644
index 0000000..d1ae7ca
--- /dev/null
+++ b/vars/fcgiwrap.yml
@@ -0,0 +1 @@
+fcgiwrap_socket: /run/fcgiwrap.sock
diff --git a/vars/git.yml b/vars/git.yml
new file mode 100644
index 0000000..ed6bce7
--- /dev/null
+++ b/vars/git.yml
@@ -0,0 +1,7 @@
+git_nginx_include_directory: /etc/nginx/git.joeac.net.d
+git_directory: /srv/git
+git_export_ok_file: git-daemon-export-ok
+git_readonly_user: gitd
+git_readonly_group: git
+git_readwrite_user: nginx
+git_readwrite_group: nginx
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-08 12:47:13 +0000