modules/private/gitolite/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3     cfg = config.myServices.gitolite;
   4 in {
   5   options.myServices.gitolite = {
   6     enable = lib.mkEnableOption "my gitolite service";
   7     gitoliteDir = lib.mkOption {
   8       type = lib.types.str;
   9       default = "/var/lib/gitolite";
  10     };
  11   };
  12
  13   config = lib.mkIf cfg.enable {
  14     myServices.ssh.modules = [{
  15       snippet = builtins.readFile ./ldap_gitolite.sh;
  16       dependencies = [ pkgs.gitolite ];
  17     }];
  18     networking.firewall.allowedTCPPorts = [ 9418 ];
  19
  20     secrets.keys."gitolite/ldap_password" = {
  21       user = "gitolite";
  22       group = "gitolite";
  23       permissions = "0400";
  24       text = config.myEnv.tools.gitolite.ldap.password;
  25     };
  26
  27     services.gitDaemon = {
  28       enable = true;
  29       user = "gitolite";
  30       group = "gitolite";
  31       basePath = "${cfg.gitoliteDir}/repositories";
  32     };
  33
  34     system.activationScripts.gitolite = let
  35       deps = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
  36       gitolite_ldap_groups = pkgs.runCommand "gitolite_ldap_groups.sh" {
  37         buildInputs = [ pkgs.makeWrapper ];
  38       } ''
  39         makeWrapper "${./gitolite_ldap_groups.sh}" "$out" \
  40           --prefix PATH : ${lib.makeBinPath deps} \
  41           --set LDAP_PASS_PATH ${config.secrets.fullPaths."gitolite/ldap_password"}
  42         '';
  43     in {
  44       deps = [ "users" ];
  45       text = ''
  46         if [ -d ${cfg.gitoliteDir} ]; then
  47           ln -sf ${gitolite_ldap_groups} ${cfg.gitoliteDir}/gitolite_ldap_groups.sh
  48           chmod g+rx ${cfg.gitoliteDir}
  49         fi
  50         if [ -f ${cfg.gitoliteDir}/projects.list ]; then
  51           chmod g+r ${cfg.gitoliteDir}/projects.list
  52         fi
  53       '';
  54     };
  55
  56     users.users.wwwrun.extraGroups = [ "gitolite" ];
  57     users.users.gitolite.extraGroups = [ "keys" ];
  58
  59     users.users.gitolite.packages = let
  60       python-packages = python-packages: with python-packages; [
  61         simplejson
  62         urllib3
  63         sleekxmpp
  64       ];
  65     in
  66       [
  67         (pkgs.python3.withPackages python-packages)
  68         pkgs.nettools
  69         pkgs.findutils
  70       ];
  71     # Installation: https://git.immae.eu/mantisbt/view.php?id=93
  72     services.gitolite = {
  73       enable = true;
  74       adminPubkey = config.myEnv.sshd.rootKeys.immae_dilion;
  75     };
  76   };
  77 }