virtual/modules/gitolite/default.nix

   1 { lib, pkgs, config, mylibs, ... }:
   2 let
   3     cfg = config.services.myGitolite;
   4 in {
   5   options.services.myGitolite = {
   6     enable = lib.mkEnableOption "my gitolite service";
   7     gitoliteDir = lib.mkOption {
   8       type = lib.types.string;
   9       default = "/var/lib/gitolite";
  10     };
  11   };
  12
  13   config = lib.mkIf cfg.enable {
  14     nixpkgs.config.packageOverrides = oldpkgs: rec {
  15       gitolite = oldpkgs.gitolite.overrideAttrs(old: rec {
  16         name = "gitolite-${version}";
  17         version = "3.6.10";
  18         src = pkgs.fetchFromGitHub {
  19           owner = "sitaramc";
  20           repo = "gitolite";
  21           rev = "v${version}";
  22           sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h";
  23         };
  24       });
  25     };
  26
  27     networking.firewall.allowedTCPPorts = [ 9418 ];
  28
  29     services.gitDaemon = {
  30       enable = true;
  31       user = "gitolite";
  32       group = "gitolite";
  33       basePath = "${cfg.gitoliteDir}/repositories";
  34     };
  35
  36     system.activationScripts.gitolite =
  37       assert mylibs.checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
  38       let
  39       gitolite_ldap_groups = mylibs.wrap {
  40         name = "gitolite_ldap_groups.sh";
  41         file = ./gitolite_ldap_groups.sh;
  42         vars = {
  43           LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
  44         };
  45         paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
  46       };
  47     in {
  48       deps = [ "users" ];
  49       text = ''
  50         if [ -d ${cfg.gitoliteDir} ]; then
  51           ln -sf ${gitolite_ldap_groups} ${cfg.gitoliteDir}/gitolite_ldap_groups.sh
  52           chmod g+rx ${cfg.gitoliteDir}
  53         fi
  54         if [ -f ${cfg.gitoliteDir}/projects.list ]; then
  55           chmod g+r ${cfg.gitoliteDir}/projects.list
  56         fi
  57       '';
  58     };
  59
  60     users.users.wwwrun.extraGroups = [ "gitolite" ];
  61
  62     users.users.gitolite.packages = let
  63       python-packages = python-packages: with python-packages; [
  64         simplejson
  65         urllib3
  66       ];
  67     in
  68       [
  69         (pkgs.python3.withPackages python-packages)
  70       ];
  71     # FIXME: after initial install, need to
  72     # (1) copy rc file (adjust gitolite_ldap_groups.sh)
  73     # (2) (mark old readonly and) sync repos except gitolite-admin
  74     #     rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/
  75     #     chown -R gitolite:gitolite /var/lib/gitolite
  76     # (3) push force the gitolite-admin to new location (from external point)
  77     #     Don't use an existing key, it will take precedence over
  78     #     gitolite-admin
  79     # (4) su -u gitolite gitolite setup
  80     services.gitolite = {
  81       enable = true;
  82       # FIXME: key from ./ssh
  83       adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu";
  84     };
  85   };
  86 }