server {
  listen       {{ services.git.port }};
  listen  [::]:{{ services.git.port }};
  server_name  {{ ( subdomains | selectattr('service', 'eq', 'git') | first ).full_domain }};

  root         /usr/share/webapps/cgit;
  try_files    $uri @cgit;

  access_log /var/log/nginx/git.joeac.net/access.log;
  error_log /var/log/nginx/git.joeac.net/error.log;

  location ~ /(.+)/(HEAD|info/refs|objects|git-upload-pack|git-receive-pack) {
    if (-f /srv/git/$1/git-daemon-export-ok) {
      set $auth_basic   "private-write repository";
    }
    if (!-f /srv/git/$1/git-daemon-export-ok) {
      set $auth_basic   "private repository";
    }
    if ($arg_service != git-receive-pack) {
      set $auth_basic   off;
    }
    auth_basic          $auth_basic;
    auth_basic_user_file .htpasswd;
    include             fastcgi_params;
    fastcgi_param       SCRIPT_FILENAME     /usr/libexec/git-core/git-http-backend;
    fastcgi_param       PATH_INFO           $uri;
    fastcgi_param       GIT_PROJECT_ROOT    /srv/git;
    fastcgi_param       GIT_HTTP_EXPORT_ALL 1;
    fastcgi_param       REMOTE_USER         $remote_user;
    fastcgi_param       HOME                /srv/git;
    fastcgi_pass        unix:{{ fcgiwrap_socket }};
  }

  location @cgit {
      include             fastcgi_params;
      fastcgi_param       SCRIPT_FILENAME /usr/share/webapps/cgit/cgit.cgi;
      fastcgi_param       PATH_INFO       $uri;
      fastcgi_param       QUERY_STRING    $args;
      fastcgi_param       HTTP_HOST       $server_name;
      fastcgi_pass        unix:{{ fcgiwrap_socket }};
  }
}