]>
Commit | Line | Data |
---|---|---|
1 | { lib, pkgs, config, ... }: | |
2 | let | |
3 | cfg = config.myServices.gitolite; | |
4 | in { | |
5 | options.myServices.gitolite = { | |
6 | enable = lib.mkEnableOption "my gitolite service"; | |
7 | gitoliteDir = lib.mkOption { | |
8 | type = lib.types.str; | |
9 | default = "/var/lib/gitolite"; | |
10 | }; | |
11 | }; | |
12 | ||
13 | config = lib.mkIf cfg.enable { | |
14 | services.borgBackup.profiles.global.ignoredPaths = [ | |
15 | "gitolite/.nix-.*" | |
16 | "gitolite/.ssh" | |
17 | "gitolite/.vim.*" | |
18 | "gitolite/.bash_history" | |
19 | ]; | |
20 | services.borgBackup.profiles.global.includedPaths = [ | |
21 | "gitolite/gitolite_ldap_groups.sh" | |
22 | "gitolite/projects.list" | |
23 | "gitolite/.gitolite.rc" | |
24 | "gitolite/.gitolite" | |
25 | "gitolite/repositories/github" | |
26 | "gitolite/repositories/testing.git" | |
27 | "gitolite/repositories/gitolite-admin.git" | |
28 | ||
29 | ]; | |
30 | myServices.dns.zones."immae.eu".subdomains.git = | |
31 | with config.myServices.dns.helpers; ips servers.eldiron.ips.main; | |
32 | ||
33 | myServices.chatonsProperties.services.gitolite = { | |
34 | file.datetime = "2022-08-21T10:01:00"; | |
35 | service = { | |
36 | name = "Gitolite"; | |
37 | description = "Gitolite allows you to setup git hosting on a central server, with fine-grained access control and many more powerful features."; | |
38 | website = "https://git.immae.eu"; | |
39 | logo = "https://git.immae.eu/cgit-css/favicon.ico"; | |
40 | status.level = "OK"; | |
41 | status.description = "OK"; | |
42 | registration."" = ["MEMBER" "CLIENT"]; | |
43 | registration.load = "OPEN"; | |
44 | install.type = "PACKAGE"; | |
45 | guide.user = "https://www.immae.eu/docs/forge-logicielle.html"; | |
46 | }; | |
47 | software = { | |
48 | name = "Gitolite"; | |
49 | website = "https://gitolite.com/gitolite/"; | |
50 | license.url = "https://github.com/sitaramc/gitolite/blob/master/COPYING"; | |
51 | license.name = "GNU General Public License v2.0"; | |
52 | version = pkgs.gitolite.version; | |
53 | source.url = "https://github.com/sitaramc/gitolite"; | |
54 | }; | |
55 | }; | |
56 | myServices.ssh.modules.gitolite = { | |
57 | snippet = builtins.readFile ./ldap_gitolite.sh; | |
58 | dependencies = [ pkgs.gitolite ]; | |
59 | vars.ldap_group = "cn=users,cn=gitolite,ou=services,dc=immae,dc=eu"; | |
60 | vars.shell_path = "${pkgs.gitolite}/bin/gitolite-shell"; | |
61 | vars.services = let | |
62 | toLine = login: key: ''command="${pkgs.gitolite}/bin/gitolite-shell ${login}",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ${key}''; | |
63 | in builtins.concatStringsSep "\n" [ | |
64 | (toLine "naemon" config.myEnv.monitoring.ssh_public_key) | |
65 | (toLine "buildbot" config.myEnv.buildbot.ssh_key.public) | |
66 | ]; | |
67 | }; | |
68 | networking.firewall.allowedTCPPorts = [ 9418 ]; | |
69 | ||
70 | secrets.keys."gitolite/ldap_password" = { | |
71 | user = "gitolite"; | |
72 | group = "gitolite"; | |
73 | permissions = "0400"; | |
74 | text = config.myEnv.tools.gitolite.ldap.password; | |
75 | }; | |
76 | ||
77 | services.gitDaemon = { | |
78 | enable = true; | |
79 | user = "gitolite"; | |
80 | group = "gitolite"; | |
81 | basePath = "${cfg.gitoliteDir}/repositories"; | |
82 | }; | |
83 | ||
84 | system.activationScripts.gitolite = let | |
85 | deps = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ]; | |
86 | gitolite_ldap_groups = pkgs.runCommand "gitolite_ldap_groups.sh" { | |
87 | buildInputs = [ pkgs.makeWrapper ]; | |
88 | } '' | |
89 | makeWrapper "${./gitolite_ldap_groups.sh}" "$out" \ | |
90 | --prefix PATH : ${lib.makeBinPath deps} \ | |
91 | --set LDAP_PASS_PATH ${config.secrets.fullPaths."gitolite/ldap_password"} | |
92 | ''; | |
93 | in { | |
94 | deps = [ "users" ]; | |
95 | text = '' | |
96 | if [ -d ${cfg.gitoliteDir} ]; then | |
97 | ln -sf ${gitolite_ldap_groups} ${cfg.gitoliteDir}/gitolite_ldap_groups.sh | |
98 | chmod g+rx ${cfg.gitoliteDir} | |
99 | fi | |
100 | if [ -f ${cfg.gitoliteDir}/projects.list ]; then | |
101 | chmod g+r ${cfg.gitoliteDir}/projects.list | |
102 | fi | |
103 | ''; | |
104 | }; | |
105 | ||
106 | users.users.wwwrun.extraGroups = [ "gitolite" ]; | |
107 | users.users.gitolite.extraGroups = [ "keys" ]; | |
108 | ||
109 | users.users.gitolite.packages = let | |
110 | python-packages = python-packages: with python-packages; [ | |
111 | simplejson | |
112 | apprise | |
113 | sleekxmpp | |
114 | urllib3 | |
115 | pyyaml | |
116 | ]; | |
117 | in | |
118 | [ | |
119 | # For some reason it absolutely wants to include "doc" output | |
120 | ((pkgs.python39.withPackages python-packages) // { doc = ""; }) | |
121 | pkgs.nettools | |
122 | pkgs.findutils | |
123 | ]; | |
124 | # Installation: https://git.immae.eu/mantisbt/view.php?id=93 | |
125 | services.gitolite = { | |
126 | enable = true; | |
127 | adminPubkey = config.myEnv.sshd.rootKeys.immae_dilion; | |
128 | }; | |
129 | myServices.monitoring.fromMasterActivatedPlugins = [ "git" ]; | |
130 | myServices.monitoring.fromMasterObjects.service = [ | |
131 | { | |
132 | service_description = "gitolite is working"; | |
133 | host_name = config.hostEnv.fqdn; | |
134 | use = "external-web-service"; | |
135 | check_command = "check_git"; | |
136 | ||
137 | servicegroups = "webstatus-remote-services"; | |
138 | _webstatus_name = "Git"; | |
139 | _webstatus_url = "git.immae.eu"; | |
140 | } | |
141 | ]; | |
142 | }; | |
143 | } |