diff options
Diffstat (limited to 'modules/private/gitolite')
-rw-r--r-- | modules/private/gitolite/default.nix | 77 | ||||
-rwxr-xr-x | modules/private/gitolite/gitolite_ldap_groups.sh | 15 | ||||
-rw-r--r-- | modules/private/gitolite/ldap_gitolite.sh | 33 |
3 files changed, 0 insertions, 125 deletions
diff --git a/modules/private/gitolite/default.nix b/modules/private/gitolite/default.nix deleted file mode 100644 index 6a74734..0000000 --- a/modules/private/gitolite/default.nix +++ /dev/null | |||
@@ -1,77 +0,0 @@ | |||
1 | { lib, pkgs, config, ... }: | ||
2 | let | ||
3 | cfg = config.myServices.gitolite; | ||
4 | in { | ||
5 | options.myServices.gitolite = { | ||
6 | enable = lib.mkEnableOption "my gitolite service"; | ||
7 | gitoliteDir = lib.mkOption { | ||
8 | type = lib.types.str; | ||
9 | default = "/var/lib/gitolite"; | ||
10 | }; | ||
11 | }; | ||
12 | |||
13 | config = lib.mkIf cfg.enable { | ||
14 | myServices.ssh.modules = [{ | ||
15 | snippet = builtins.readFile ./ldap_gitolite.sh; | ||
16 | dependencies = [ pkgs.gitolite ]; | ||
17 | }]; | ||
18 | networking.firewall.allowedTCPPorts = [ 9418 ]; | ||
19 | |||
20 | secrets.keys."gitolite/ldap_password" = { | ||
21 | user = "gitolite"; | ||
22 | group = "gitolite"; | ||
23 | permissions = "0400"; | ||
24 | text = config.myEnv.tools.gitolite.ldap.password; | ||
25 | }; | ||
26 | |||
27 | services.gitDaemon = { | ||
28 | enable = true; | ||
29 | user = "gitolite"; | ||
30 | group = "gitolite"; | ||
31 | basePath = "${cfg.gitoliteDir}/repositories"; | ||
32 | }; | ||
33 | |||
34 | system.activationScripts.gitolite = let | ||
35 | deps = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ]; | ||
36 | gitolite_ldap_groups = pkgs.runCommand "gitolite_ldap_groups.sh" { | ||
37 | buildInputs = [ pkgs.makeWrapper ]; | ||
38 | } '' | ||
39 | makeWrapper "${./gitolite_ldap_groups.sh}" "$out" \ | ||
40 | --prefix PATH : ${lib.makeBinPath deps} \ | ||
41 | --set LDAP_PASS_PATH ${config.secrets.fullPaths."gitolite/ldap_password"} | ||
42 | ''; | ||
43 | in { | ||
44 | deps = [ "users" ]; | ||
45 | text = '' | ||
46 | if [ -d ${cfg.gitoliteDir} ]; then | ||
47 | ln -sf ${gitolite_ldap_groups} ${cfg.gitoliteDir}/gitolite_ldap_groups.sh | ||
48 | chmod g+rx ${cfg.gitoliteDir} | ||
49 | fi | ||
50 | if [ -f ${cfg.gitoliteDir}/projects.list ]; then | ||
51 | chmod g+r ${cfg.gitoliteDir}/projects.list | ||
52 | fi | ||
53 | ''; | ||
54 | }; | ||
55 | |||
56 | users.users.wwwrun.extraGroups = [ "gitolite" ]; | ||
57 | users.users.gitolite.extraGroups = [ "keys" ]; | ||
58 | |||
59 | users.users.gitolite.packages = let | ||
60 | python-packages = python-packages: with python-packages; [ | ||
61 | simplejson | ||
62 | urllib3 | ||
63 | sleekxmpp | ||
64 | ]; | ||
65 | in | ||
66 | [ | ||
67 | (pkgs.python3.withPackages python-packages) | ||
68 | pkgs.nettools | ||
69 | pkgs.findutils | ||
70 | ]; | ||
71 | # Installation: https://git.immae.eu/mantisbt/view.php?id=93 | ||
72 | services.gitolite = { | ||
73 | enable = true; | ||
74 | adminPubkey = config.myEnv.sshd.rootKeys.immae_dilion; | ||
75 | }; | ||
76 | }; | ||
77 | } | ||
diff --git a/modules/private/gitolite/gitolite_ldap_groups.sh b/modules/private/gitolite/gitolite_ldap_groups.sh deleted file mode 100755 index 3d7117e..0000000 --- a/modules/private/gitolite/gitolite_ldap_groups.sh +++ /dev/null | |||
@@ -1,15 +0,0 @@ | |||
1 | #!/usr/bin/env bash | ||
2 | |||
3 | uid_param="$1" | ||
4 | ldap_host="ldap.immae.eu" | ||
5 | ldap_binddn="cn=gitolite,ou=services,dc=immae,dc=eu" | ||
6 | ldap_bindpw="$(cat $LDAP_PASS_PATH)" | ||
7 | ldap_searchbase="dc=immae,dc=eu" | ||
8 | ldap_scope="subtree" | ||
9 | |||
10 | ldap_options="-h ${ldap_host} -ZZ -x -D ${ldap_binddn} -w ${ldap_bindpw} -b ${ldap_searchbase} -s ${ldap_scope}" | ||
11 | |||
12 | ldap_filter="(&(memberOf=cn=groups,cn=gitolite,ou=services,dc=immae,dc=eu)(|(member=uid=${uid_param},ou=users,dc=immae,dc=eu)(member=uid=${uid_param},ou=group_users,dc=immae,dc=eu)))" | ||
13 | ldap_result=$(ldapsearch ${ldap_options} -LLL "${ldap_filter}" cn | grep 'cn:' | cut -d' ' -f2) | ||
14 | |||
15 | echo "$ldap_result" | ||
diff --git a/modules/private/gitolite/ldap_gitolite.sh b/modules/private/gitolite/ldap_gitolite.sh deleted file mode 100644 index 23cb2bf..0000000 --- a/modules/private/gitolite/ldap_gitolite.sh +++ /dev/null | |||
@@ -1,33 +0,0 @@ | |||
1 | ### This snippet is not standalone and must be integrated in the global ldap_authorized_keys.sh | ||
2 | LDAP_GITOLITE_MEMBER="cn=users,cn=gitolite,ou=services,dc=immae,dc=eu" | ||
3 | GITOLITE_SHELL=$(which gitolite-shell) | ||
4 | |||
5 | if [[ $user == gitolite ]]; then | ||
6 | ldap_search '(&(memberOf='$LDAP_GITOLITE_MEMBER')('$KEY'=*))' $KEY | \ | ||
7 | while read line ; | ||
8 | do | ||
9 | if [ ! -z "$line" ]; then | ||
10 | if [[ $line == dn* ]]; then | ||
11 | user=$(sed -n 's/.*uid=\([^,]*\).*/\1/p' <<< "$line") | ||
12 | if [ -n "$user" ]; then | ||
13 | if [[ $user == "immae" ]] || [[ $user == "denise" ]]; then | ||
14 | # Capitalize first letter (backward compatibility) | ||
15 | user=$(sed -r 's/^([a-z])/\U\1/' <<< "$user") | ||
16 | fi | ||
17 | else | ||
18 | # Service fake user | ||
19 | user=$(sed -n 's/.*cn=\([^,]*\).*/\1/p' <<< "$line") | ||
20 | fi | ||
21 | elif [[ $line == $KEY* ]]; then | ||
22 | key=$(clean_key_line git "$line") | ||
23 | if [ ! -z "$key" ]; then | ||
24 | if [[ $key != *$'\n'* ]] && [[ $key == ssh-* ]]; then | ||
25 | echo -n 'command="'$GITOLITE_SHELL' '$user'",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ' | ||
26 | echo $key | ||
27 | fi | ||
28 | fi | ||
29 | fi | ||
30 | fi | ||
31 | done | ||
32 | exit 0 | ||
33 | fi | ||