1 files changed, 153 insertions, 0 deletions
diff --git a/ansible/roles/git/tasks/main.yml b/ansible/roles/git/tasks/main.yml
new file mode 100644
index 0000000..a676d0b
--- /dev/null
+++ b/ansible/roles/git/tasks/main.yml
@@ -0,0 +1,153 @@
+- name: Install cgit, fcgiwrap, git, nginx, and shadow
+  community.general.apk:
+    name:
+      - cgit
+      - fcgiwrap
+      - git
+      - nginx
+      - shadow
+
+- name: Add git group
+  ansible.builtin.group:
+    name: git
+
+- name: Add git user
+  ansible.builtin.user:
+    name: git
+    group: git
+
+- name: Find existing shells
+  register: existing_shells
+  changed_when: false
+  ansible.builtin.command: cat /etc/shells
+
+- name: Add git-shell to /etc/shells
+  when: "'/git-shell' not in existing_shells.stdout"
+  ansible.builtin.shell: which git-shell >> /etc/shells
+
+- name: Find current git login shell
+  register: current_git_login_shell
+  ansible.builtin.shell: "cat /etc/passwd | grep ^git: | grep -o [^:]*$"
+
+- name: Set git login shell to git-shell
+  when: "'git-shell' not in current_git_login_shell"
+  ansible.builtin.shell: chsh -s $(which git-shell) git
+
+- name: Create fcgiwrap user and append 'git' group
+  ansible.builtin.user:
+    name: "{{ fcgiwrap_user }}"
+    group: "{{ fcgiwrap_group }}"
+    groups:
+      - git
+    append: true
+
+- name: Create git directory in attached storage
+  ansible.builtin.file:
+    path: /media/seagate/git
+    state: directory
+    owner: git
+    group: git
+    mode: "750"
+
+- name: Symlink git directory to /srv/git
+  ansible.builtin.file:
+    src: /media/seagate/git
+    dest: /srv/git
+    owner: git
+    group: git
+    state: link
+    mode: "750"
+
+- name: Configure fcgiwrap daemon
+  register: fcgiwrap_conf
+  ansible.builtin.template:
+    src: conf.d/fcgiwrap
+    dest: /etc/conf.d/fcgiwrap
+    mode: "644"
+
+- name: Restart fcgiwrap daemon and configure to start on boot
+  when: fcgiwrap_conf is changed
+  ansible.builtin.service:
+    name: fcgiwrap
+    enabled: true
+    state: restarted
+
+- name: Start fcgiwrap daemon and configure to start on boot
+  when: not ( fcgiwrap_conf is changed )
+  ansible.builtin.service:
+    name: fcgiwrap
+    enabled: true
+    state: started
+
+- name: Remove default nginx site config
+  register: default_nginx_site
+  ansible.builtin.file:
+    path: /etc/nginx/http.d/default.conf
+    state: absent
+
+- name: Install cgit nginx site config
+  register: cgit_nginx_site
+  ansible.builtin.template:
+    src: nginx/cgit.conf
+    dest: /etc/nginx/http.d/cgit.conf
+    owner: nginx
+    group: nginx
+    mode: "660"
+
+- name: Restart nginx daemon and configure to start on boot
+  when: default_nginx_site is changed or cgit_nginx_site is changed
+  ansible.builtin.service:
+    name: nginx
+    enabled: true
+    state: restarted
+
+- name: Start nginx daemon and configure to start on boot
+  when: not ( default_nginx_site is changed or cgit_nginx_site is changed )
+  ansible.builtin.service:
+    name: nginx
+    enabled: true
+    state: started
+
+- name: Install cgit config
+  ansible.builtin.copy:
+    src: cgitrc
+    dest: /etc/cgitrc
+    mode: "+r"
+
+- name: Install git daemon
+  community.general.apk:
+    name: git-daemon-openrc
+
+- name: Configure git daemon
+  register: gitd_conf
+  ansible.builtin.template:
+    src: conf.d/git-daemon
+    dest: /etc/conf.d/git-daemon
+
+- name: Create gitd user
+  ansible.builtin.user:
+    name: gitd
+    group: git
+
+- name: Mark git directory safe for gitd git operations
+  register: gitd_gitconfig
+  ansible.builtin.copy:
+    src: .gitconfig
+    dest: ~gitd/.gitconfig
+    owner: gitd
+    group: git
+    mode: "644"
+
+- name: Restart git daemon and configure to start on boot
+  when: gitd_conf is changed or gitd_gitconfig is changed
+  ansible.builtin.service:
+    name: git-daemon
+    enabled: true
+    state: restarted
+
+- name: Start git daemon and configure to start on boot
+  when: not ( gitd_conf is changed or gitd_gitconfig is changed )
+  ansible.builtin.service:
+    name: git-daemon
+    enabled: true
+    state: started