blob: f454d931bf86468e43117c94ce58fa6d3699a619 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
|
---
- name: Install cgit and FastCGI dependencies
ansible.builtin.apt:
name:
- cgit
- fcgiwrap
- git
- python3-docutils
- python3-markdown
- python3-pygments
state: present
- name: Ensure dedicated git system group exists
ansible.builtin.group:
name: "{{ cgit_group }}"
system: true
state: present
- name: Ensure dedicated git system user exists
ansible.builtin.user:
name: "{{ cgit_user }}"
group: "{{ cgit_group }}"
home: "{{ cgit_repos_path }}"
shell: /usr/bin/git-shell
comment: "Git version control user"
system: true
create_home: true
state: present
- name: Add www-data to git group so Nginx/fcgiwrap can read repositories
ansible.builtin.user:
name: www-data
groups: "{{ cgit_group }}"
append: true
notify: Restart fcgiwrap
- name: Ensure Git repositories root directory permissions (setgid for group inheritance)
ansible.builtin.file:
path: "{{ cgit_repos_path }}"
state: directory
owner: "{{ cgit_user }}"
group: "{{ cgit_group }}"
mode: "02750"
- name: Configure git user safe.directory for cgit (www-data)
ansible.builtin.copy:
dest: /var/www/.gitconfig
owner: www-data
group: www-data
mode: "0644"
content: |
[safe]
directory = *
- name: Ensure git-shell-commands directory exists (disables interactive shell login and provides helpers)
ansible.builtin.file:
path: "{{ cgit_repos_path }}/git-shell-commands"
state: directory
owner: root
group: "{{ cgit_group }}"
mode: "0755"
- name: Deploy git-shell helper commands (no-interactive-login, init, list)
ansible.builtin.copy:
dest: "{{ cgit_repos_path }}/git-shell-commands/{{ item.name }}"
owner: root
group: "{{ cgit_group }}"
mode: "0755"
content: "{{ item.content }}"
loop:
- name: no-interactive-login
content: |
#!/bin/sh
printf '%s\n' "Hi! You've successfully authenticated as '{{ cgit_user }}', but interactive shell access is disabled."
printf '%s\n' "Tip: Run 'ssh {{ cgit_user }}@{{ primary_domain }} init <repo>.git [description]' to create a new repository."
exit 128
- name: list
content: |
#!/bin/sh
find "{{ cgit_repos_path }}" -maxdepth 2 -name "*.git" -type d -printf "%P\n" | sort
- name: init
content: |
#!/bin/sh
set -e
REPO="$1"
DESC="$2"
if [ -z "$REPO" ]; then
echo "Usage: ssh {{ cgit_user }}@{{ primary_domain }} init <repo-name>.git [description]"
exit 1
fi
case "$REPO" in
*.git) ;;
*) REPO="${REPO}.git" ;;
esac
TARGET="{{ cgit_repos_path }}/${REPO}"
if [ -d "$TARGET" ]; then
echo "Error: Repository ${REPO} already exists."
exit 1
fi
git init --bare --shared=group "$TARGET"
if [ -n "$DESC" ]; then
echo "$DESC" > "$TARGET/description"
else
echo "${REPO%.git}" > "$TARGET/description"
fi
echo "Initialized bare repository at {{ cgit_user }}@{{ primary_domain }}:${REPO}"
- name: Ensure .ssh directory exists for git user
ansible.builtin.file:
path: "{{ cgit_repos_path }}/.ssh"
state: directory
owner: "{{ cgit_user }}"
group: "{{ cgit_group }}"
mode: "0700"
- name: Configure authorized SSH keys for git user
ansible.builtin.copy:
dest: "{{ cgit_repos_path }}/.ssh/authorized_keys"
owner: "{{ cgit_user }}"
group: "{{ cgit_group }}"
mode: "0600"
content: |
{% for key in cgit_ssh_authorized_keys %}
{{ key }}
{% endfor %}
- name: Deploy /etc/cgitrc configuration
ansible.builtin.template:
src: cgitrc.j2
dest: /etc/cgitrc
owner: root
group: root
mode: "0644"
- name: Ensure fcgiwrap socket and service are enabled and running
ansible.builtin.systemd:
name: "{{ item }}"
enabled: true
state: started
loop:
- fcgiwrap.socket
- fcgiwrap.service
- name: Check if TLS certificate exists for {{ cgit_domain }}
ansible.builtin.stat:
path: "/etc/letsencrypt/live/{{ cgit_domain }}/fullchain.pem"
register: cgit_tls_cert
- name: Deploy Nginx virtual host for cgit
ansible.builtin.template:
src: site-cgit.conf.j2
dest: /etc/nginx/sites-available/cgit.conf
owner: root
group: root
mode: "0644"
notify: Reload nginx
- name: Enable Nginx virtual host for cgit
ansible.builtin.file:
src: /etc/nginx/sites-available/cgit.conf
dest: /etc/nginx/sites-enabled/cgit.conf
state: link
notify: Reload nginx
|
