3 files changed, 98 insertions, 0 deletions
diff --git a/git/cgit.scss b/git/cgit.scss
new file mode 100644
index 0000000..3d0c4fb
--- /dev/null
+++ b/git/cgit.scss
@@ -0,0 +1,27 @@
+// Stylesheet for cgit on git.kassouni.net, layered over cgit's stock cgit.css.
+// Rules here have to match `div#cgit ...` to win on specificity, so they nest
+// under the same id. Compiled by ./theme.nix.
+@use "fonts";
+
+div#cgit {
+  font-family: fonts.$mono;
+
+  // cgit.css asks for generic `monospace` on these; point them at the webfont
+  a.ls-blob,
+  a.ls-dir,
+  .ls-mod,
+  .oid,
+  div.commit-msg,
+  div.notes,
+  table.bin-blob th,
+  table.bin-blob td,
+  table.diff td,
+  table.list td.commitgraph,
+  table.list td.logmsg,
+  table.list td.logsubject,
+  table.ssdiff td,
+  td.ls-mode,
+  td.ls-size {
+    font-family: fonts.$mono;
+  }
+}
diff --git a/git/default.nix b/git/default.nix
new file mode 100644
index 0000000..f46c3ab
--- /dev/null
+++ b/git/default.nix
@@ -0,0 +1,51 @@
+{config, inputs, pkgs, ...}: let
+  domain = "git.kassouni.net";
+  repoRoot = "/srv/git";
+  theme = inputs.self.packages.${pkgs.stdenv.hostPlatform.system}.cgit-theme;
+in {
+  users.users.git = {
+    isSystemUser = true;
+    group = "git";
+    home = repoRoot;
+    createHome = true;
+    homeMode = "750"; 
+    shell = "${pkgs.git}/bin/git-shell";
+    openssh.authorizedKeys.keys = config.my.gitKeys;
+  };
+  users.groups.git = { };
+
+  environment.systemPackages = [ pkgs.git ];
+
+  services.openssh.extraConfig = ''
+    Match user git
+      AllowTcpForwarding no
+      AllowAgentForwarding no
+      PermitTTY no
+  '';
+
+  services.cgit.${domain} = {
+    enable = true;
+    scanPath = repoRoot;
+    group = "git"; # so cgit can traverse a non-world-readable repoRoot
+    gitHttpBackend.checkExportOkFiles = true;
+    settings = {
+      # cgit adds one <link> per css entry, in order
+      css = [ "/cgit.css" "/theme.css" ];
+      strict-export = "git-daemon-export-ok";
+      remove-suffix = true;
+      readme = [ ":README.md" ":README" ":readme.md" ];
+      clone-url = "git@${domain}:$CGIT_REPO_URL https://${domain}/$CGIT_REPO_URL";
+      source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
+      about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+    locations = {
+      "= /theme.css".alias = "${theme}/theme.css";
+      "/fonts/".alias = "${theme}/fonts/";
+    };
+  };
+}
diff --git a/git/theme.nix b/git/theme.nix
new file mode 100644
index 0000000..4d4a395
--- /dev/null
+++ b/git/theme.nix
@@ -0,0 +1,20 @@
+{ pkgs }:
+
+# The extra stylesheet for cgit, served next to cgit's stock cgit.css, plus the
+# webfont it references. Fonts ship here rather than being pulled from
+# kassouni.net so they stay same-origin and need no CORS headers.
+pkgs.runCommand "cgit-theme"
+  {
+    nativeBuildInputs = [ pkgs.dart-sass ];
+
+    meta = {
+      description = "cgit stylesheet matching kassouni.net";
+      license = pkgs.lib.licenses.mit;
+      platforms = pkgs.lib.platforms.all;
+    };
+  }
+  ''
+    mkdir -p $out
+    sass --no-source-map --load-path=${../style} ${./cgit.scss} $out/theme.css
+    cp -r ${../site/static/fonts} $out/fonts
+  ''