6 files changed, 187 insertions, 0 deletions
diff --git a/roles/git/files/.gitconfig b/roles/git/files/.gitconfig
new file mode 100644
index 0000000..78fdfcf
--- /dev/null
+++ b/roles/git/files/.gitconfig
@@ -0,0 +1,3 @@
+[safe]
+	directory = /srv/git/*
+	directory = /media/seagate/git/*
diff --git a/roles/git/files/cgitrc b/roles/git/files/cgitrc
new file mode 100644
index 0000000..9d9d99c
--- /dev/null
+++ b/roles/git/files/cgitrc
@@ -0,0 +1,8 @@
+root-title=joeac's git repositories
+root-desc=
+strict-export=git-daemon-export-ok
+scan-path=/srv/git
+virtual-root=/
+about-filter=/usr/lib/cgit/filters/about-formatting.sh
+readme=:README.md
+snapshots=tar.gz zip
diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml
new file mode 100644
index 0000000..a676d0b
--- /dev/null
+++ b/roles/git/tasks/main.yml
@@ -0,0 +1,153 @@
+- name: Install cgit, fcgiwrap, git, nginx, and shadow
+  community.general.apk:
+    name:
+      - cgit
+      - fcgiwrap
+      - git
+      - nginx
+      - shadow
+
+- name: Add git group
+  ansible.builtin.group:
+    name: git
+
+- name: Add git user
+  ansible.builtin.user:
+    name: git
+    group: git
+
+- name: Find existing shells
+  register: existing_shells
+  changed_when: false
+  ansible.builtin.command: cat /etc/shells
+
+- name: Add git-shell to /etc/shells
+  when: "'/git-shell' not in existing_shells.stdout"
+  ansible.builtin.shell: which git-shell >> /etc/shells
+
+- name: Find current git login shell
+  register: current_git_login_shell
+  ansible.builtin.shell: "cat /etc/passwd | grep ^git: | grep -o [^:]*$"
+
+- name: Set git login shell to git-shell
+  when: "'git-shell' not in current_git_login_shell"
+  ansible.builtin.shell: chsh -s $(which git-shell) git
+
+- name: Create fcgiwrap user and append 'git' group
+  ansible.builtin.user:
+    name: "{{ fcgiwrap_user }}"
+    group: "{{ fcgiwrap_group }}"
+    groups:
+      - git
+    append: true
+
+- name: Create git directory in attached storage
+  ansible.builtin.file:
+    path: /media/seagate/git
+    state: directory
+    owner: git
+    group: git
+    mode: "750"
+
+- name: Symlink git directory to /srv/git
+  ansible.builtin.file:
+    src: /media/seagate/git
+    dest: /srv/git
+    owner: git
+    group: git
+    state: link
+    mode: "750"
+
+- name: Configure fcgiwrap daemon
+  register: fcgiwrap_conf
+  ansible.builtin.template:
+    src: conf.d/fcgiwrap
+    dest: /etc/conf.d/fcgiwrap
+    mode: "644"
+
+- name: Restart fcgiwrap daemon and configure to start on boot
+  when: fcgiwrap_conf is changed
+  ansible.builtin.service:
+    name: fcgiwrap
+    enabled: true
+    state: restarted
+
+- name: Start fcgiwrap daemon and configure to start on boot
+  when: not ( fcgiwrap_conf is changed )
+  ansible.builtin.service:
+    name: fcgiwrap
+    enabled: true
+    state: started
+
+- name: Remove default nginx site config
+  register: default_nginx_site
+  ansible.builtin.file:
+    path: /etc/nginx/http.d/default.conf
+    state: absent
+
+- name: Install cgit nginx site config
+  register: cgit_nginx_site
+  ansible.builtin.template:
+    src: nginx/cgit.conf
+    dest: /etc/nginx/http.d/cgit.conf
+    owner: nginx
+    group: nginx
+    mode: "660"
+
+- name: Restart nginx daemon and configure to start on boot
+  when: default_nginx_site is changed or cgit_nginx_site is changed
+  ansible.builtin.service:
+    name: nginx
+    enabled: true
+    state: restarted
+
+- name: Start nginx daemon and configure to start on boot
+  when: not ( default_nginx_site is changed or cgit_nginx_site is changed )
+  ansible.builtin.service:
+    name: nginx
+    enabled: true
+    state: started
+
+- name: Install cgit config
+  ansible.builtin.copy:
+    src: cgitrc
+    dest: /etc/cgitrc
+    mode: "+r"
+
+- name: Install git daemon
+  community.general.apk:
+    name: git-daemon-openrc
+
+- name: Configure git daemon
+  register: gitd_conf
+  ansible.builtin.template:
+    src: conf.d/git-daemon
+    dest: /etc/conf.d/git-daemon
+
+- name: Create gitd user
+  ansible.builtin.user:
+    name: gitd
+    group: git
+
+- name: Mark git directory safe for gitd git operations
+  register: gitd_gitconfig
+  ansible.builtin.copy:
+    src: .gitconfig
+    dest: ~gitd/.gitconfig
+    owner: gitd
+    group: git
+    mode: "644"
+
+- name: Restart git daemon and configure to start on boot
+  when: gitd_conf is changed or gitd_gitconfig is changed
+  ansible.builtin.service:
+    name: git-daemon
+    enabled: true
+    state: restarted
+
+- name: Start git daemon and configure to start on boot
+  when: not ( gitd_conf is changed or gitd_gitconfig is changed )
+  ansible.builtin.service:
+    name: git-daemon
+    enabled: true
+    state: started
diff --git a/roles/git/templates/conf.d/fcgiwrap b/roles/git/templates/conf.d/fcgiwrap
new file mode 100644
index 0000000..65a40e8
--- /dev/null
+++ b/roles/git/templates/conf.d/fcgiwrap
@@ -0,0 +1,3 @@
+socket=unix:{{ fcgiwrap_socket }}
+user={{ fcgiwrap_user }}
+group={{ fcgiwrap_group }}
diff --git a/roles/git/templates/conf.d/git-daemon b/roles/git/templates/conf.d/git-daemon
new file mode 100644
index 0000000..c50b66b
--- /dev/null
+++ b/roles/git/templates/conf.d/git-daemon
@@ -0,0 +1,3 @@
+GITDAEMON_OPTS="--syslog --base-path=/srv/git"
+GIT_USER="gitd"
+GIT_GROUP="git"
diff --git a/roles/git/templates/nginx/cgit.conf b/roles/git/templates/nginx/cgit.conf
new file mode 100644
index 0000000..456173b
--- /dev/null
+++ b/roles/git/templates/nginx/cgit.conf
@@ -0,0 +1,17 @@
+server {
+  listen       {{ services.git.port }};
+  listen  [::]:{{ services.git.port }};
+  server_name  {{ ( subdomains | selectattr('service', 'eq', 'git') | first ).full_domain }};
+
+  root         /usr/share/webapps/cgit;
+  try_files    $uri @cgit;
+
+  location @cgit {
+      include             fastcgi_params;
+      fastcgi_param       SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi;
+      fastcgi_param       PATH_INFO       $uri;
+      fastcgi_param       QUERY_STRING    $args;
+      fastcgi_param       HTTP_HOST       $server_name;
+      fastcgi_pass        unix:/run/fcgiwrap/fcgiwrap.sock;
+  }
+}