diff options
Diffstat (limited to 'DISCOVERY_REPORT.md')
| -rw-r--r-- | DISCOVERY_REPORT.md | 26 |
1 files changed, 23 insertions, 3 deletions
diff --git a/DISCOVERY_REPORT.md b/DISCOVERY_REPORT.md index ab45750..dea8c08 100644 --- a/DISCOVERY_REPORT.md +++ b/DISCOVERY_REPORT.md @@ -16,6 +16,11 @@ Internet (Ports 80/443) [ Nginx Reverse Proxy & Web Server ] (/etc/nginx) ├── miguelpedro.xyz.br / www.miguelpedro.xyz.br ──► Static files (/var/www/html) ├── _ (default_server :80) ───────────────────────► Static files + /searxng sub-path + ├── git.miguelpedro.xyz.br (:80 / :443) + │ │ + │ ▼ (Unix Socket: /run/fcgiwrap.socket) + │ [ fcgiwrap Daemon ] ──► /usr/lib/cgit/cgit.cgi (/etc/cgitrc) + │ Scans bare Git repos in /srv/git (user/group `git` 999:989) └── searx.miguelpedro.xyz.br (HTTPS :443) │ ▼ (Unix Socket: /usr/local/searxng/run/socket) @@ -46,13 +51,27 @@ Internet (Ports 80/443) - Security headers: `X-Frame-Options "SAMEORIGIN"`, `X-Content-Type-Options "nosniff"`, `Referrer-Policy "no-referrer"`, `Strict-Transport-Security "max-age=31536000; includeSubDomains"`. - Proxies `location /` via `uwsgi_pass unix:///usr/local/searxng/run/socket;` with `HTTP_HOST`, `HTTP_CONNECTION`, `HTTP_X_SCHEME`, `HTTP_X_REAL_IP`, and `HTTP_X_FORWARDED_FOR`. - Port 80 redirect block for `searx.miguelpedro.xyz.br` (301 to HTTPS). - 3. **`miguelpedro.xyz.br` (`-> /etc/nginx/sites-available/miguelpedro.xyz.br`)**: - - Port 80 stub with `server_name example.com www.example.com;` pointing to `/var/www/miguelpedro.xyz.br/html` (currently an empty directory, while the active `miguelpedro.xyz.br` site is served from `sites-available/default`). + 3. **`cgit.conf` (`-> /etc/nginx/sites-available/cgit.conf`)**: + - Serves `git.miguelpedro.xyz.br`, mapping static assets `/cgit-css/*` to `/usr/share/cgit/` and passing CGI requests to `unix:/run/fcgiwrap.socket` (`/usr/lib/cgit/cgit.cgi`). Blocks `git-receive-pack` over HTTP (`403`) so pushes remain strictly over SSH. Automatically upgrades to HTTPS once `/etc/letsencrypt/live/git.miguelpedro.xyz.br/fullchain.pem` is provisioned. + 4. **`miguelpedro.xyz.br` (disabled stub in `/etc/nginx/sites-available/miguelpedro.xyz.br`)**: + - Symlink removed from `/etc/nginx/sites-enabled/` via Ansible (`nginx_remove_unused_sites`). - **Default App Includes (`/etc/nginx/default.d/`):** - `/etc/nginx/default.d/searxng.conf -> /etc/nginx/default.apps-available/searxng.conf` (created by SearXNG's official installation script, exposing `location /searxng` on the default server block). --- +## 2b. cgit & Git Server (`git.miguelpedro.xyz.br`) + +- **Packages:** `cgit`, `fcgiwrap`, `git`, `python3-pygments`, `python3-markdown`, `python3-docutils` +- **Services:** `fcgiwrap.socket` and `fcgiwrap.service` (active, enabled; socket `/run/fcgiwrap.socket`). +- **System User & Group:** `git` (`UID=999`, `GID=989`, home `/srv/git`, shell `/usr/bin/git-shell`). `www-data` is a member of the `git` group (`989`) to allow `cgit`/`fcgiwrap` read access, with `/var/www/.gitconfig` configuring `safe.directory = *`. +- **Repositories Root:** `/srv/git` (`02750` `git:git`) + - `/srv/git/.ssh/authorized_keys` (`0600` `git:git`): Contains authorized SSH public keys. + - `/srv/git/git-shell-commands/`: Custom `git-shell` helper commands (`init`, `list`, `no-interactive-login`) allowing remote creation of bare repositories via `ssh git@miguelpedro.xyz.br init <repo>.git "<description>"`. +- **Configuration:** `/etc/cgitrc` (enables `enable-http-clone=1`, syntax highlighting via Pygments, README rendering, and `scan-path=/srv/git`). + +--- + ## 3. SearXNG, uWSGI & Valkey SearXNG was installed using the official SearXNG installation script (`utils/searxng.sh`), running natively via `uwsgi` and backed by `valkey-server`. @@ -121,7 +140,8 @@ SearXNG was installed using the official SearXNG installation script (`utils/sea | Component | Critical Path on VPS | Purpose | | :--- | :--- | :--- | | **Nginx Core** | `/etc/nginx/nginx.conf` | Global Nginx settings (`server_tokens off`, TLS 1.2/1.3) | -| **Nginx VHosts** | `/etc/nginx/sites-available/default`<br>`/etc/nginx/sites-available/searxng.conf`<br>`/etc/nginx/sites-available/miguelpedro.xyz.br` | Main domain vhost, SearXNG reverse proxy vhost, and stub config | +| **Nginx VHosts** | `/etc/nginx/sites-available/default`<br>`/etc/nginx/sites-available/searxng.conf`<br>`/etc/nginx/sites-available/cgit.conf` | Main domain vhost, SearXNG reverse proxy vhost, and cgit vhost | +| **cgit & Git Repos** | `/etc/cgitrc`<br>`/srv/git/`<br>`/srv/git/git-shell-commands/`<br>`/run/fcgiwrap.socket` | cgit configuration, bare Git repositories (`git:git`), `git-shell` helpers, and FastCGI socket | | **Nginx App Snippet** | `/etc/nginx/default.apps-available/searxng.conf` | `/searxng` sub-path snippet symlinked in `/etc/nginx/default.d/` | | **Web Root** | `/var/www/html/`<br>`/var/www/miguelpedro.xyz.br/html/` | Static web roots | | **SearXNG Config** | `/etc/searxng/settings.yml`<br>`/etc/searxng/limiter.toml` | SearXNG instance settings, secret key, Valkey URL, and bot limiter | |