options, git

3 files changed, 75 insertions, 4 deletions

diff --git a/configuration.nix b/configuration.nix
index 8335278..dfdbb64 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -2,6 +2,8 @@
   imports = [
     ./hardware-configuration.nix
     ./minecraft.nix
+    ./options.nix
+    ./git.nix
   ];
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
@@ -12,10 +14,11 @@
 
   services.openssh = {
     enable = true;
+    authorizedKeysInHomedir = false; # trust only /etc/ssh/authorized_keys.d/%u
     settings = {
       PasswordAuthentication = false;
       PermitRootLogin = "no";
-      AllowUsers = [ "kassouni" ];
+      AllowUsers = [ "kassouni" "git" ];
       KbdInteractiveAuthentication = false;
       PubkeyAuthentication = true;
     };
@@ -24,9 +27,7 @@
   users.users.kassouni = {
     extraGroups = [ "wheel" ];
     isNormalUser = true;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBmhTnNG0ym84RJzbIcDCwGmPFVaFPkSYiUtNQrrnV6"
-    ];
+    openssh.authorizedKeys.keys = config.my.adminKeys;
   };
 
   system.stateVersion = "26.05";
diff --git a/git.nix b/git.nix
new file mode 100644
index 0000000..b94c713
--- /dev/null
+++ b/git.nix
@@ -0,0 +1,41 @@
+{config, pkgs, ...}: let
+  domain = "git.kassouni.net";
+  repoRoot = "/srv/git";
+in {
+  users.users.git = {
+    isSystemUser = true;
+    group = "git";
+    home = repoRoot;
+    createHome = true;
+    homeMode = "755";
+    shell = "${pkgs.git}/bin/git-shell";
+    openssh.authorizedKeys.keys = config.my.gitKeys;
+  };
+  users.groups.git = { };
+
+  services.openssh.extraConfig = ''
+    Match user git
+      AllowTcpForwarding no
+      AllowAgentForwarding no
+      PermitTTY no
+  '';
+
+  services.cgit.${domain} = {
+    enable = true;
+    scanPath = repoRoot;
+    gitHttpBackend.checkExportOkFiles = true;
+    settings.strict-export = "git-daemon-export-ok";
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "alex@kassouni.net";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
diff --git a/options.nix b/options.nix
new file mode 100644
index 0000000..ad62721
--- /dev/null
+++ b/options.nix
@@ -0,0 +1,29 @@
+{config, lib, ...}: let
+  alex = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBmhTnNG0ym84RJzbIcDCwGmPFVaFPkSYiUtNQrrnV6";
+in {
+  options.my = {
+    adminKeys = lib.mkOption {
+      type = with lib.types; listOf singleLineStr;
+      description = ''
+        Keys granted an interactive shell in the wheel group, i.e. root by way
+        of sudo. Only add a key you would trust with the whole machine.
+      '';
+    };
+
+    gitKeys = lib.mkOption {
+      type = with lib.types; listOf singleLineStr;
+      description = ''
+        Keys granted git-shell access to the repositories under /srv/git.
+        No interactive shell and no sudo, so this is the list to grow when
+        someone needs to push.
+      '';
+    };
+  };
+
+  config.my = {
+    adminKeys = [ alex ];
+
+    # Admins push too; collaborator keys belong here and nowhere else.
+    gitKeys = config.my.adminKeys;
+  };
+}