3 files changed, 72 insertions, 0 deletions
diff --git a/roles/git-http-backend/files/htpasswd b/roles/git-http-backend/files/htpasswd
new file mode 100644
index 0000000..a32d3e2
--- /dev/null
+++ b/roles/git-http-backend/files/htpasswd
@@ -0,0 +1,9 @@
+$ANSIBLE_VAULT;1.2;AES256;ansible
+35346161393133303561303166386236386666346531643864393063383437626565366331353061
+3761366332303239353638613938356662306565346439380a613738376436353563326335393064
+64626337336238313164636437643566383136383830623636363036663762356462663465636166
+3666323734343835660a643566636532386630346138396331373266623031616535353266396563
+33643936633234623136616436646536356661343132356562656462616334316233353161323831
+61346232326235393839393431623532383164393430363663646630343132653266613537613736
+65393332663232316131386561346464373961313062303132396330353839663761613635666231
+66306431656336376334
diff --git a/roles/git-http-backend/tasks/main.yml b/roles/git-http-backend/tasks/main.yml
new file mode 100644
index 0000000..9dccf60
--- /dev/null
+++ b/roles/git-http-backend/tasks/main.yml
@@ -0,0 +1,41 @@
+- name: Install git
+  community.general.apk:
+    name: git
+
+- name: Create git.joeac.net nginx include directory
+  ansible.builtin.file:
+    path: "{{ git_nginx_include_directory }}"
+    state: directory
+    owner: nginx
+    group: nginx
+
+- name: Install htpasswd file
+  ansible.builtin.copy:
+    src: htpasswd
+    dest: /etc/nginx/.htpasswd
+    owner: "{{ git_readwrite_user }}"
+    group: "{{ git_readwrite_group }}"
+    mode: "400"
+
+- name: Install git-http-backend nginx directives
+  register: nginx_conf
+  vars:
+    fcgiwrap_socket: /run/fcgiwrap.sock
+  ansible.builtin.template:
+    src: git-http-backend.conf
+    dest: "{{ git_nginx_include_directory }}/git-http-backend.conf"
+    owner: "{{ git_readwrite_user }}"
+    group: "{{ git_readwrite_group }}"
+    mode: "660"
+
+- name: Restart nginx service if config changed
+  when: nginx_conf is changed
+  ansible.builtin.service:
+    name: nginx
+    state: restarted
+
+- name: Mark git directory safe in system-wide git config
+  community.general.git_config:
+    name: safe.directory
+    add_mode: add
+    value: "{{ git_directory }}/*"
diff --git a/roles/git-http-backend/templates/git-http-backend.conf b/roles/git-http-backend/templates/git-http-backend.conf
new file mode 100644
index 0000000..26e012b
--- /dev/null
+++ b/roles/git-http-backend/templates/git-http-backend.conf
@@ -0,0 +1,22 @@
+location ~ /(.+)/(HEAD|info/refs|objects|git-upload-pack|git-receive-pack) {
+  if (-f /srv/git/$1/{{ git_export_ok_file }}) {
+    set $auth_basic   "private-write repository";
+  }
+  if (!-f /srv/git/$1/{{ git_export_ok_file }}) {
+    set $auth_basic   "private repository";
+  }
+  if ($arg_service != git-receive-pack) {
+    set $auth_basic   off;
+  }
+  auth_basic          $auth_basic;
+  auth_basic_user_file .htpasswd;
+
+  include             fastcgi_params;
+  fastcgi_param       SCRIPT_FILENAME     /usr/libexec/git-core/git-http-backend;
+  fastcgi_param       PATH_INFO           $uri;
+  fastcgi_param       GIT_PROJECT_ROOT    /srv/git;
+  fastcgi_param       GIT_HTTP_EXPORT_ALL 1;
+  fastcgi_param       REMOTE_USER         $remote_user;
+  fastcgi_param       HOME                /srv/git;
+  fastcgi_pass        unix:{{ fcgiwrap_socket }};
+}