diff options
| author | Miguel Dalberto Pedro <miguel.pedro@precisioninno.com> | 2026-10-29 16:42:44 -0300 |
|---|---|---|
| committer | Miguel Dalberto Pedro <miguel.pedro@precisioninno.com> | 2026-10-29 16:42:44 -0300 |
| commit | eab4f5746a69783e4e3a3c05808ab58b5d2f494d (patch) | |
| tree | ff6e149dccbd5ccc999d9e4f648bed823433ffab /AGENT_INSTRUCTIONS.md | |
| parent | 4b7379914a1865f07b2c54252234cc90158fc253 (diff) | |
| download | my-infra-eab4f5746a69783e4e3a3c05808ab58b5d2f494d.tar.gz my-infra-eab4f5746a69783e4e3a3c05808ab58b5d2f494d.zip | |
- Enable cgit role (cgit_enabled: true) for git.miguelpedro.xyz.br
- Provision dedicated 'git' user/group (/srv/git, git-shell, authorized_keys)
- Add custom git-shell commands ('init' and 'list') for remote bare repo creation
- Configure /etc/cgitrc with HTTP clone support, Pygments syntax highlighting, and README rendering
- Add Nginx virtual host with automatic TLS upgrade once Let's Encrypt cert is present
- Update DISCOVERY_REPORT.md, COMMAND_LOG.md, README.md, and AGENT_INSTRUCTIONS.md per Self-Updating Protocol
Diffstat (limited to 'AGENT_INSTRUCTIONS.md')
| -rw-r--r-- | AGENT_INSTRUCTIONS.md | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/AGENT_INSTRUCTIONS.md b/AGENT_INSTRUCTIONS.md index 45410d3..b6c6e4c 100644 --- a/AGENT_INSTRUCTIONS.md +++ b/AGENT_INSTRUCTIONS.md @@ -51,3 +51,14 @@ Before ending your session or creating a final commit, you **MUST** update the r - Created roles for `common`, `certbot`, `valkey`, `searxng`, `nginx`, and scaffolded `cgit` (`cgit_enabled: false`) for upcoming deployment. - Cleaned up unused Nginx stub symlink (`/etc/nginx/sites-enabled/miguelpedro.xyz.br` which pointed to `example.com`) via `nginx_remove_unused_sites`. - **Verification:** Verified playbook against live VPS with `ansible-playbook site.yml --check --diff`. + + +### [2026-10-29] Deploy cgit + fcgiwrap & Dedicated `git` SSH Server +- **Agent Action:** + - Enabled `cgit_enabled: true` in `group_vars/all/vars.yml`. + - Expanded `roles/cgit` to install `cgit`, `fcgiwrap`, `python3-pygments`, `python3-markdown`, and `python3-docutils`. + - Provisioned dedicated `git` system user/group (`999:989`, home `/srv/git`, shell `/usr/bin/git-shell`) with SSH `authorized_keys` and custom `git-shell-commands` (`init` and `list`). + - Added `www-data` to the `git` group and configured `/var/www/.gitconfig` (`safe.directory = *`) so `cgit`/`fcgiwrap` can read bare repositories in `/srv/git`. + - Configured `/etc/cgitrc` with HTTP clone support (`enable-http-clone=1`), syntax highlighting, and README rendering. + - Deployed `/etc/nginx/sites-available/cgit.conf` (and enabled symlink) for `git.miguelpedro.xyz.br`, blocking `git-receive-pack` over HTTP (`403`) and auto-upgrading to TLS once the Certbot certificate for `git.miguelpedro.xyz.br` is present. +- **Verification:** Applied `ansible-playbook site.yml --tags "cgit" --diff`, verified `cgit v1.2.3` HTTP response, CSS delivery, and `ssh git@miguelpedro.xyz.br list`, and confirmed full idempotency (`ok=42 changed=0`). |