modules/private/gitolite/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3     cfg = config.myServices.gitolite;
   4 in {
   5   options.myServices.gitolite = {
   6     enable = lib.mkEnableOption "my gitolite service";
   7     gitoliteDir = lib.mkOption {
   8       type = lib.types.str;
   9       default = "/var/lib/gitolite";
  10     };
  11   };
  12
  13   config = lib.mkIf cfg.enable {
  14     myServices.ssh.modules = [{
  15       snippet = builtins.readFile ./ldap_gitolite.sh;
  16       dependencies = [ pkgs.gitolite ];
  17     }];
  18     services.duplyBackup.profiles.gitolite = {
  19       rootDir = cfg.gitoliteDir;
  20       remotes = [ "eriomem" "ovh" ];
  21     };
  22     networking.firewall.allowedTCPPorts = [ 9418 ];
  23
  24     secrets.keys = [{
  25       dest = "gitolite/ldap_password";
  26       user = "gitolite";
  27       group = "gitolite";
  28       permissions = "0400";
  29       text = config.myEnv.tools.gitolite.ldap.password;
  30     }];
  31
  32     services.gitDaemon = {
  33       enable = true;
  34       user = "gitolite";
  35       group = "gitolite";
  36       basePath = "${cfg.gitoliteDir}/repositories";
  37     };
  38
  39     system.activationScripts.gitolite = let
  40       deps = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
  41       gitolite_ldap_groups = pkgs.runCommand "gitolite_ldap_groups.sh" {
  42         buildInputs = [ pkgs.makeWrapper ];
  43       } ''
  44         makeWrapper "${./gitolite_ldap_groups.sh}" "$out" \
  45           --prefix PATH : ${lib.makeBinPath deps} \
  46           --set LDAP_PASS_PATH ${config.secrets.fullPaths."gitolite/ldap_password"}
  47         '';
  48     in {
  49       deps = [ "users" ];
  50       text = ''
  51         if [ -d ${cfg.gitoliteDir} ]; then
  52           ln -sf ${gitolite_ldap_groups} ${cfg.gitoliteDir}/gitolite_ldap_groups.sh
  53           chmod g+rx ${cfg.gitoliteDir}
  54         fi
  55         if [ -f ${cfg.gitoliteDir}/projects.list ]; then
  56           chmod g+r ${cfg.gitoliteDir}/projects.list
  57         fi
  58       '';
  59     };
  60
  61     users.users.wwwrun.extraGroups = [ "gitolite" ];
  62     users.users.gitolite.extraGroups = [ "keys" ];
  63
  64     users.users.gitolite.packages = let
  65       python-packages = python-packages: with python-packages; [
  66         simplejson
  67         urllib3
  68         sleekxmpp
  69       ];
  70     in
  71       [
  72         (pkgs.python3.withPackages python-packages)
  73         pkgs.nettools
  74         pkgs.findutils
  75       ];
  76     # Installation: https://git.immae.eu/mantisbt/view.php?id=93
  77     services.gitolite = {
  78       enable = true;
  79       adminPubkey = config.myEnv.sshd.rootKeys.immae_dilion;
  80     };
  81   };
  82 }