+ # "connexionswing" = {
+ # webroot = "/var/lib/acme/acme-challenge";
+ # email = "ismael@bouya.org";
+ # domain = "connexionswing.com";
+ # plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
+ # postRun = ''
+ # systemctl reload httpd.service
+ # '';
+ # extraDomains = {
+ # "www.connexionswing.com" = null;
+ # "sandetludo.com" = null;
+ # "www.sandetludo.com" = null;
+ # };
+ # };
+ };
+
+ services.openssh.extraConfig = ''
+ AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys
+ AuthorizedKeysCommandUser nobody
+ '';
+
+ users.users.wwwrun.extraGroups = [ "gitolite" ];
+
+ users.users.gitolite.packages = let
+ python-packages = python-packages: with python-packages; [
+ simplejson
+ urllib3
+ ];
+ in
+ [
+ (pkgs.python3.withPackages python-packages)
+ ];
+ # FIXME: after initial install, need to
+ # (1) copy rc file (adjust gitolite_ldap_groups.sh)
+ # (2) (mark old readonly and) sync repos except gitolite-admin
+ # rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/
+ # chown -R gitolite:gitolite /var/lib/gitolite
+ # (3) push force the gitolite-admin to new location (from external point)
+ # Don't use an existing key, it will take precedence over
+ # gitolite-admin
+ # (4) su -u gitolite gitolite setup
+ services.gitolite = {
+ enable = true;
+ # FIXME: key from ./ssh
+ adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu";