From 690f218cbdf89327408ea75f2d21fde257a29411 Mon Sep 17 00:00:00 2001 From: Joe Carstairs Date: Wed, 26 Aug 2026 10:27:32 +0100 Subject: refactor git into cgit, git-daemon and git-http-backend --- playbook.yml | 6 +- roles/cgit/tasks/main.yml | 69 ++++++++++++ roles/cgit/templates/cgitrc | 9 ++ roles/cgit/templates/nginx/git.joeac.net.conf | 22 ++++ roles/fcgiwrap/tasks/main.yml | 1 - roles/git-daemon/tasks/main.yml | 35 ++++++ roles/git-daemon/templates/conf.d/git-daemon | 3 + roles/git-http-backend/files/htpasswd | 9 ++ roles/git-http-backend/tasks/main.yml | 41 +++++++ .../templates/git-http-backend.conf | 22 ++++ roles/git/files/.gitconfig | 3 - roles/git/files/cgitrc | 9 -- roles/git/files/htpasswd | 9 -- roles/git/tasks/main.yml | 122 --------------------- roles/git/templates/conf.d/git-daemon | 3 - roles/git/templates/nginx/git.joeac.net.conf | 42 ------- vars/fcgiwrap.yml | 1 + vars/git.yml | 7 ++ 18 files changed, 223 insertions(+), 190 deletions(-) create mode 100644 roles/cgit/tasks/main.yml create mode 100644 roles/cgit/templates/cgitrc create mode 100644 roles/cgit/templates/nginx/git.joeac.net.conf create mode 100644 roles/git-daemon/tasks/main.yml create mode 100644 roles/git-daemon/templates/conf.d/git-daemon create mode 100644 roles/git-http-backend/files/htpasswd create mode 100644 roles/git-http-backend/tasks/main.yml create mode 100644 roles/git-http-backend/templates/git-http-backend.conf delete mode 100644 roles/git/files/.gitconfig delete mode 100644 roles/git/files/cgitrc delete mode 100644 roles/git/files/htpasswd delete mode 100644 roles/git/tasks/main.yml delete mode 100644 roles/git/templates/conf.d/git-daemon delete mode 100644 roles/git/templates/nginx/git.joeac.net.conf create mode 100644 vars/fcgiwrap.yml create mode 100644 vars/git.yml diff --git a/playbook.yml b/playbook.yml index c9a1444..a2e6880 100644 --- a/playbook.yml +++ b/playbook.yml @@ -40,9 +40,13 @@ roles: - nginx - fcgiwrap - - git + - git-daemon + - cgit + - git-http-backend vars_files: - common.yml + - git.yml + - fcgiwrap.yml - name: Install ln hosts: "{{ services.ln.host }}" diff --git a/roles/cgit/tasks/main.yml b/roles/cgit/tasks/main.yml new file mode 100644 index 0000000..d9f96bc --- /dev/null +++ b/roles/cgit/tasks/main.yml @@ -0,0 +1,69 @@ +- name: Install cgit + community.general.apk: + name: cgit + +- name: Add git readonly group + ansible.builtin.group: + name: "{{ git_readonly_group }}" + +- name: Configure read-write git user + ansible.builtin.user: + name: "{{ git_readwrite_user }}" + group: "{{ git_readwrite_group }}" + groups: + - "{{ git_readonly_group }}" + append: true + +- name: Create git directory in attached storage + ansible.builtin.file: + path: /media/seagate/git + state: directory + owner: "{{ git_readwrite_user }}" + group: "{{ git_readonly_group }}" + mode: "750" + +- name: Set owners recursively in git directory in attached storage + ansible.builtin.file: + path: /media/seagate/git + state: directory + owner: "{{ git_readwrite_user }}" + group: "{{ git_readonly_group }}" + recurse: true + +- name: Symlink git directory to storage medium + ansible.builtin.file: + src: /media/seagate/git + dest: "{{ git_directory }}" + owner: "{{ git_readwrite_user }}" + group: "{{ git_readonly_group }}" + state: link + mode: "750" + +- name: Install git.joeac.net nginx site config + register: cgit_nginx_site + vars: + fcgiwrap_socket: /run/fcgiwrap.sock + ansible.builtin.template: + src: nginx/git.joeac.net.conf + dest: /etc/nginx/http.d/git.joeac.net.conf + owner: "{{ git_readwrite_user }}" + group: "{{ git_readwrite_group }}" + mode: "660" + +- name: Create git.joeac.net nginx log directory + ansible.builtin.file: + path: /var/log/nginx/git.joeac.net + state: directory + +- name: Restart nginx daemon and configure to start on boot + when: cgit_nginx_site is changed + ansible.builtin.service: + name: nginx + enabled: true + state: restarted + +- name: Install cgit config + ansible.builtin.template: + src: cgitrc + dest: /etc/cgitrc + mode: "+r" diff --git a/roles/cgit/templates/cgitrc b/roles/cgit/templates/cgitrc new file mode 100644 index 0000000..64ba6d4 --- /dev/null +++ b/roles/cgit/templates/cgitrc @@ -0,0 +1,9 @@ +root-title=joeac's git repositories +root-desc= +strict-export={{ git_export_ok_file }} +scan-path={{ git_directory }} +virtual-root=/ +about-filter=/usr/lib/cgit/filters/about-formatting.sh +readme=:README.md +snapshots=tar.gz zip +clone-prefix=git://git.joeac.net https://git.joeac.net diff --git a/roles/cgit/templates/nginx/git.joeac.net.conf b/roles/cgit/templates/nginx/git.joeac.net.conf new file mode 100644 index 0000000..704665e --- /dev/null +++ b/roles/cgit/templates/nginx/git.joeac.net.conf @@ -0,0 +1,22 @@ +server { + listen {{ services.git.port }}; + listen [::]:{{ services.git.port }}; + server_name {{ ( subdomains | selectattr('service', 'eq', 'git') | first ).full_domain }}; + + root /usr/share/webapps/cgit; + try_files $uri @cgit; + + access_log /var/log/nginx/git.joeac.net/access.log; + error_log /var/log/nginx/git.joeac.net/error.log; + + location @cgit { + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi; + fastcgi_param PATH_INFO $uri; + fastcgi_param QUERY_STRING $args; + fastcgi_param HTTP_HOST $server_name; + fastcgi_pass unix:{{ fcgiwrap_socket }}; + } + + include {{ git_nginx_include_directory }}/*.conf; +} diff --git a/roles/fcgiwrap/tasks/main.yml b/roles/fcgiwrap/tasks/main.yml index 32a2dba..4eba5f1 100644 --- a/roles/fcgiwrap/tasks/main.yml +++ b/roles/fcgiwrap/tasks/main.yml @@ -5,7 +5,6 @@ - name: Configure fcgiwrap daemon register: fcgiwrap_conf vars: - fcgiwrap_socket: /run/fcgiwrap.sock fcgiwrap_user: nginx fcgiwrap_group: nginx ansible.builtin.template: diff --git a/roles/git-daemon/tasks/main.yml b/roles/git-daemon/tasks/main.yml new file mode 100644 index 0000000..5508b1e --- /dev/null +++ b/roles/git-daemon/tasks/main.yml @@ -0,0 +1,35 @@ +- name: Install git daemon + community.general.apk: + name: git-daemon-openrc + +- name: Create read-only git user + ansible.builtin.user: + name: "{{ git_readonly_user }}" + group: "{{ git_readonly_group }}" + +- name: Configure git daemon + register: gitd_conf + ansible.builtin.template: + src: conf.d/git-daemon + dest: /etc/conf.d/git-daemon + +- name: Restart git daemon and configure to start on boot + when: gitd_conf is changed + ansible.builtin.service: + name: git-daemon + enabled: true + state: restarted + +- name: Start git daemon and configure to start on boot + when: not ( gitd_conf is changed ) + ansible.builtin.service: + name: git-daemon + enabled: true + state: started + +- name: Mark git directory safe in system-wide git config + register: gitconfig + community.general.git_config: + name: safe.directory + add_mode: add + value: "{{ git_directory }}/*" diff --git a/roles/git-daemon/templates/conf.d/git-daemon b/roles/git-daemon/templates/conf.d/git-daemon new file mode 100644 index 0000000..8a757d1 --- /dev/null +++ b/roles/git-daemon/templates/conf.d/git-daemon @@ -0,0 +1,3 @@ +GITDAEMON_OPTS="--syslog --base-path={{ git_directory }}" +GIT_USER="{{ git_readonly_user }}" +GIT_GROUP="{{ git_readonly_group }}" diff --git a/roles/git-http-backend/files/htpasswd b/roles/git-http-backend/files/htpasswd new file mode 100644 index 0000000..a32d3e2 --- /dev/null +++ b/roles/git-http-backend/files/htpasswd @@ -0,0 +1,9 @@ +$ANSIBLE_VAULT;1.2;AES256;ansible +35346161393133303561303166386236386666346531643864393063383437626565366331353061 +3761366332303239353638613938356662306565346439380a613738376436353563326335393064 +64626337336238313164636437643566383136383830623636363036663762356462663465636166 +3666323734343835660a643566636532386630346138396331373266623031616535353266396563 +33643936633234623136616436646536356661343132356562656462616334316233353161323831 +61346232326235393839393431623532383164393430363663646630343132653266613537613736 +65393332663232316131386561346464373961313062303132396330353839663761613635666231 +66306431656336376334 diff --git a/roles/git-http-backend/tasks/main.yml b/roles/git-http-backend/tasks/main.yml new file mode 100644 index 0000000..9dccf60 --- /dev/null +++ b/roles/git-http-backend/tasks/main.yml @@ -0,0 +1,41 @@ +- name: Install git + community.general.apk: + name: git + +- name: Create git.joeac.net nginx include directory + ansible.builtin.file: + path: "{{ git_nginx_include_directory }}" + state: directory + owner: nginx + group: nginx + +- name: Install htpasswd file + ansible.builtin.copy: + src: htpasswd + dest: /etc/nginx/.htpasswd + owner: "{{ git_readwrite_user }}" + group: "{{ git_readwrite_group }}" + mode: "400" + +- name: Install git-http-backend nginx directives + register: nginx_conf + vars: + fcgiwrap_socket: /run/fcgiwrap.sock + ansible.builtin.template: + src: git-http-backend.conf + dest: "{{ git_nginx_include_directory }}/git-http-backend.conf" + owner: "{{ git_readwrite_user }}" + group: "{{ git_readwrite_group }}" + mode: "660" + +- name: Restart nginx service if config changed + when: nginx_conf is changed + ansible.builtin.service: + name: nginx + state: restarted + +- name: Mark git directory safe in system-wide git config + community.general.git_config: + name: safe.directory + add_mode: add + value: "{{ git_directory }}/*" diff --git a/roles/git-http-backend/templates/git-http-backend.conf b/roles/git-http-backend/templates/git-http-backend.conf new file mode 100644 index 0000000..26e012b --- /dev/null +++ b/roles/git-http-backend/templates/git-http-backend.conf @@ -0,0 +1,22 @@ +location ~ /(.+)/(HEAD|info/refs|objects|git-upload-pack|git-receive-pack) { + if (-f /srv/git/$1/{{ git_export_ok_file }}) { + set $auth_basic "private-write repository"; + } + if (!-f /srv/git/$1/{{ git_export_ok_file }}) { + set $auth_basic "private repository"; + } + if ($arg_service != git-receive-pack) { + set $auth_basic off; + } + auth_basic $auth_basic; + auth_basic_user_file .htpasswd; + + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME /usr/libexec/git-core/git-http-backend; + fastcgi_param PATH_INFO $uri; + fastcgi_param GIT_PROJECT_ROOT /srv/git; + fastcgi_param GIT_HTTP_EXPORT_ALL 1; + fastcgi_param REMOTE_USER $remote_user; + fastcgi_param HOME /srv/git; + fastcgi_pass unix:{{ fcgiwrap_socket }}; +} diff --git a/roles/git/files/.gitconfig b/roles/git/files/.gitconfig deleted file mode 100644 index 78fdfcf..0000000 --- a/roles/git/files/.gitconfig +++ /dev/null @@ -1,3 +0,0 @@ -[safe] - directory = /srv/git/* - directory = /media/seagate/git/* diff --git a/roles/git/files/cgitrc b/roles/git/files/cgitrc deleted file mode 100644 index 3b6d9c8..0000000 --- a/roles/git/files/cgitrc +++ /dev/null @@ -1,9 +0,0 @@ -root-title=joeac's git repositories -root-desc= -strict-export=git-daemon-export-ok -scan-path=/srv/git -virtual-root=/ -about-filter=/usr/lib/cgit/filters/about-formatting.sh -readme=:README.md -snapshots=tar.gz zip -clone-prefix=git://git.joeac.net https://git.joeac.net diff --git a/roles/git/files/htpasswd b/roles/git/files/htpasswd deleted file mode 100644 index a32d3e2..0000000 --- a/roles/git/files/htpasswd +++ /dev/null @@ -1,9 +0,0 @@ -$ANSIBLE_VAULT;1.2;AES256;ansible -35346161393133303561303166386236386666346531643864393063383437626565366331353061 -3761366332303239353638613938356662306565346439380a613738376436353563326335393064 -64626337336238313164636437643566383136383830623636363036663762356462663465636166 -3666323734343835660a643566636532386630346138396331373266623031616535353266396563 -33643936633234623136616436646536356661343132356562656462616334316233353161323831 -61346232326235393839393431623532383164393430363663646630343132653266613537613736 -65393332663232316131386561346464373961313062303132396330353839663761613635666231 -66306431656336376334 diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml deleted file mode 100644 index da4bbf2..0000000 --- a/roles/git/tasks/main.yml +++ /dev/null @@ -1,122 +0,0 @@ -- name: Install cgit, git, and shadow - community.general.apk: - name: - - cgit - - git - - shadow - -- name: Add git group - ansible.builtin.group: - name: git - -- name: Append 'git' group to nginx user - ansible.builtin.user: - name: nginx - groups: - - git - append: true - -- name: Create git directory in attached storage - ansible.builtin.file: - path: /media/seagate/git - state: directory - owner: nginx - group: git - mode: "750" - -- name: Set owners recursively in git directory in attached storage - ansible.builtin.file: - path: /media/seagate/git - state: directory - owner: nginx - group: git - recurse: true - -- name: Symlink git directory to /srv/git - ansible.builtin.file: - src: /media/seagate/git - dest: /srv/git - owner: nginx - group: git - state: link - mode: "750" - -- name: Install htpasswd file - ansible.builtin.copy: - src: htpasswd - dest: /etc/nginx/.htpasswd - owner: nginx - group: nginx - mode: "400" - -- name: Install git.joeac.net nginx site config - register: cgit_nginx_site - vars: - fcgiwrap_socket: /run/fcgiwrap.sock - ansible.builtin.template: - src: nginx/git.joeac.net.conf - dest: /etc/nginx/http.d/git.joeac.net.conf - owner: nginx - group: nginx - mode: "660" - -- name: Create git.joeac.net nginx log directory - ansible.builtin.file: - path: /var/log/nginx/git.joeac.net - state: directory - -- name: Restart nginx daemon and configure to start on boot - when: cgit_nginx_site is changed - ansible.builtin.service: - name: nginx - enabled: true - state: restarted - -- name: Start nginx daemon and configure to start on boot - when: not ( cgit_nginx_site is changed ) - ansible.builtin.service: - name: nginx - enabled: true - state: started - -- name: Install cgit config - ansible.builtin.copy: - src: cgitrc - dest: /etc/cgitrc - mode: "+r" - -- name: Install git daemon - community.general.apk: - name: git-daemon-openrc - -- name: Configure git daemon - register: gitd_conf - ansible.builtin.template: - src: conf.d/git-daemon - dest: /etc/conf.d/git-daemon - -- name: Create gitd user - ansible.builtin.user: - name: gitd - group: git - -- name: Mark /srv/git/* safe in system-wide git config - register: gitconfig - community.general.git_config: - name: safe.directory - add_mode: add - value: /srv/git/* - -- name: Restart git daemon and configure to start on boot - when: gitd_conf is changed - ansible.builtin.service: - name: git-daemon - enabled: true - state: restarted - -- name: Start git daemon and configure to start on boot - when: not ( gitd_conf is changed ) - ansible.builtin.service: - name: git-daemon - enabled: true - state: started diff --git a/roles/git/templates/conf.d/git-daemon b/roles/git/templates/conf.d/git-daemon deleted file mode 100644 index c50b66b..0000000 --- a/roles/git/templates/conf.d/git-daemon +++ /dev/null @@ -1,3 +0,0 @@ -GITDAEMON_OPTS="--syslog --base-path=/srv/git" -GIT_USER="gitd" -GIT_GROUP="git" diff --git a/roles/git/templates/nginx/git.joeac.net.conf b/roles/git/templates/nginx/git.joeac.net.conf deleted file mode 100644 index e09a655..0000000 --- a/roles/git/templates/nginx/git.joeac.net.conf +++ /dev/null @@ -1,42 +0,0 @@ -server { - listen {{ services.git.port }}; - listen [::]:{{ services.git.port }}; - server_name {{ ( subdomains | selectattr('service', 'eq', 'git') | first ).full_domain }}; - - root /usr/share/webapps/cgit; - try_files $uri @cgit; - - access_log /var/log/nginx/git.joeac.net/access.log; - error_log /var/log/nginx/git.joeac.net/error.log; - - location ~ /(.+)/(HEAD|info/refs|objects|git-upload-pack|git-receive-pack) { - if (-f /srv/git/$1/git-daemon-export-ok) { - set $auth_basic "private-write repository"; - } - if (!-f /srv/git/$1/git-daemon-export-ok) { - set $auth_basic "private repository"; - } - if ($arg_service != git-receive-pack) { - set $auth_basic off; - } - auth_basic $auth_basic; - auth_basic_user_file .htpasswd; - include fastcgi_params; - fastcgi_param SCRIPT_FILENAME /usr/libexec/git-core/git-http-backend; - fastcgi_param PATH_INFO $uri; - fastcgi_param GIT_PROJECT_ROOT /srv/git; - fastcgi_param GIT_HTTP_EXPORT_ALL 1; - fastcgi_param REMOTE_USER $remote_user; - fastcgi_param HOME /srv/git; - fastcgi_pass unix:{{ fcgiwrap_socket }}; - } - - location @cgit { - include fastcgi_params; - fastcgi_param SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi; - fastcgi_param PATH_INFO $uri; - fastcgi_param QUERY_STRING $args; - fastcgi_param HTTP_HOST $server_name; - fastcgi_pass unix:{{ fcgiwrap_socket }}; - } -} diff --git a/vars/fcgiwrap.yml b/vars/fcgiwrap.yml new file mode 100644 index 0000000..d1ae7ca --- /dev/null +++ b/vars/fcgiwrap.yml @@ -0,0 +1 @@ +fcgiwrap_socket: /run/fcgiwrap.sock diff --git a/vars/git.yml b/vars/git.yml new file mode 100644 index 0000000..ed6bce7 --- /dev/null +++ b/vars/git.yml @@ -0,0 +1,7 @@ +git_nginx_include_directory: /etc/nginx/git.joeac.net.d +git_directory: /srv/git +git_export_ok_file: git-daemon-export-ok +git_readonly_user: gitd +git_readonly_group: git +git_readwrite_user: nginx +git_readwrite_group: nginx -- cgit v1.2.3