feat(cgit): deploy cgit, fcgiwrap, and dedicated git SSH serverHEADmaster

- Enable cgit role (cgit_enabled: true) for git.miguelpedro.xyz.br
- Provision dedicated 'git' user/group (/srv/git, git-shell, authorized_keys)
- Add custom git-shell commands ('init' and 'list') for remote bare repo creation
- Configure /etc/cgitrc with HTTP clone support, Pygments syntax highlighting, and README rendering
- Add Nginx virtual host with automatic TLS upgrade once Let's Encrypt cert is present
- Update DISCOVERY_REPORT.md, COMMAND_LOG.md, README.md, and AGENT_INSTRUCTIONS.md per Self-Updating Protocol

1 files changed, 60 insertions, 0 deletions

diff --git a/roles/cgit/templates/site-cgit.conf.j2 b/roles/cgit/templates/site-cgit.conf.j2
index 557c364..36753d3 100644
--- a/roles/cgit/templates/site-cgit.conf.j2
+++ b/roles/cgit/templates/site-cgit.conf.j2
@@ -1,3 +1,55 @@
+{% if cgit_tls_cert.stat.exists | default(false) %}
+server {
+    server_name {{ cgit_domain }};
+
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    root /usr/share/cgit;
+    try_files $uri @cgit;
+
+    # Serve static cgit assets directly
+    location ~* ^/cgit-css/(.*)$ {
+        alias /usr/share/cgit/$1;
+        expires 30d;
+    }
+
+    # Block git-Receive-pack over HTTP (pushing is strictly via SSH as git@)
+    location ~ ^/.*/git-receive-pack$ {
+        return 403;
+    }
+
+    location @cgit {
+        include fastcgi_params;
+        fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
+        fastcgi_param PATH_INFO $uri;
+        fastcgi_param QUERY_STRING $args;
+        fastcgi_param HTTP_HOST $server_name;
+        fastcgi_pass unix:/run/fcgiwrap.socket;
+    }
+
+    listen 443 ssl; # managed by Certbot / Ansible
+    listen [::]:443 ssl; # managed by Certbot / Ansible
+    ssl_certificate /etc/letsencrypt/live/{{ cgit_domain }}/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/{{ cgit_domain }}/privkey.pem;
+    include /etc/letsencrypt/options-ssl-nginx.conf;
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+}
+
+server {
+    if ($host = {{ cgit_domain }}) {
+        return 301 https://$host$request_uri;
+    }
+
+    listen 80;
+    listen [::]:80;
+    server_name {{ cgit_domain }};
+    return 404;
+}
+{% else %}
 server {
     listen 80;
     listen [::]:80;
@@ -6,8 +58,15 @@ server {
     root /usr/share/cgit;
     try_files $uri @cgit;
 
+    # Serve static cgit assets directly
     location ~* ^/cgit-css/(.*)$ {
         alias /usr/share/cgit/$1;
+        expires 30d;
+    }
+
+    # Block git-receive-pack over HTTP (pushing is strictly via SSH as git@)
+    location ~ ^/.*/git-receive-pack$ {
+        return 403;
     }
 
     location @cgit {
@@ -19,3 +78,4 @@ server {
         fastcgi_pass unix:/run/fcgiwrap.socket;
     }
 }
+{% endif %}