aboutsummaryrefslogtreecommitdiff
path: root/nix/git.nix
diff options
context:
space:
mode:
authorAlexander Kassouni <alex@kassouni.net>2026-09-29 23:29:28 -0700
committerAlexander Kassouni <alex@kassouni.net>2026-09-29 23:29:28 -0700
commit52cdeaf4cc9da9d32926821c78fd331bc8d2f14a (patch)
tree1b57b1c4d7c4e70202d9f07bab8a8e1a477078b9 /nix/git.nix
parenta570da443586fa3b3490b5add88ea5932456a5b3 (diff)
restructure for cgit css
Diffstat (limited to 'nix/git.nix')
-rw-r--r--nix/git.nix51
1 files changed, 0 insertions, 51 deletions
diff --git a/nix/git.nix b/nix/git.nix
deleted file mode 100644
index 4b3b493..0000000
--- a/nix/git.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{config, pkgs, ...}: let
- domain = "git.kassouni.net";
- repoRoot = "/srv/git";
-in {
- users.users.git = {
- isSystemUser = true;
- group = "git";
- home = repoRoot;
- createHome = true;
- homeMode = "750";
- shell = "${pkgs.git}/bin/git-shell";
- openssh.authorizedKeys.keys = config.my.gitKeys;
- };
- users.groups.git = { };
-
- environment.systemPackages = [ pkgs.git ];
-
- services.openssh.extraConfig = ''
- Match user git
- AllowTcpForwarding no
- AllowAgentForwarding no
- PermitTTY no
- '';
-
- services.cgit.${domain} = {
- enable = true;
- scanPath = repoRoot;
- group = "git"; # so cgit can traverse a non-world-readable repoRoot
- gitHttpBackend.checkExportOkFiles = true;
- settings = {
- strict-export = "git-daemon-export-ok";
- remove-suffix = true;
- readme = [ ":README.md" ":README" ":readme.md" ];
- clone-url = "git@${domain}:$CGIT_REPO_URL https://${domain}/$CGIT_REPO_URL";
- source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
- about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
- };
- };
-
- services.nginx.virtualHosts.${domain} = {
- forceSSL = true;
- enableACME = true;
- };
-
- security.acme = {
- acceptTerms = true;
- defaults.email = "alex@kassouni.net";
- };
-
- networking.firewall.allowedTCPPorts = [ 80 443 ];
-}