From 505db4048338db9a5115526054b79e20fde7b25a Mon Sep 17 00:00:00 2001
From: Alexander Kassouni <alex@kassouni.net>
Date: Fri, 25 Sep 2026 22:40:15 -0700
Subject: options, git

---
 git.nix | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 git.nix

(limited to 'git.nix')

diff --git a/git.nix b/git.nix
new file mode 100644
index 0000000..b94c713
--- /dev/null
+++ b/git.nix
@@ -0,0 +1,41 @@
+{config, pkgs, ...}: let
+  domain = "git.kassouni.net";
+  repoRoot = "/srv/git";
+in {
+  users.users.git = {
+    isSystemUser = true;
+    group = "git";
+    home = repoRoot;
+    createHome = true;
+    homeMode = "755";
+    shell = "${pkgs.git}/bin/git-shell";
+    openssh.authorizedKeys.keys = config.my.gitKeys;
+  };
+  users.groups.git = { };
+
+  services.openssh.extraConfig = ''
+    Match user git
+      AllowTcpForwarding no
+      AllowAgentForwarding no
+      PermitTTY no
+  '';
+
+  services.cgit.${domain} = {
+    enable = true;
+    scanPath = repoRoot;
+    gitHttpBackend.checkExportOkFiles = true;
+    settings.strict-export = "git-daemon-export-ok";
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "alex@kassouni.net";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
-- 
cgit v1.3.1