1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
{ lib, pkgs, config, ... }:
let
cfg = config.myServices.gitolite;
in {
options.myServices.gitolite = {
enable = lib.mkEnableOption "my gitolite service";
gitoliteDir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/gitolite";
};
};
config = lib.mkIf cfg.enable {
services.borgBackup.profiles.global.ignoredPaths = [
"gitolite/.nix-.*"
"gitolite/.ssh"
"gitolite/.vim.*"
"gitolite/.bash_history"
];
services.borgBackup.profiles.global.includedPaths = [
"gitolite/gitolite_ldap_groups.sh"
"gitolite/projects.list"
"gitolite/.gitolite.rc"
"gitolite/.gitolite"
"gitolite/repositories/github"
"gitolite/repositories/testing.git"
"gitolite/repositories/gitolite-admin.git"
];
myServices.dns.zones."immae.eu".subdomains.git =
with config.myServices.dns.helpers; ips servers.eldiron.ips.main;
myServices.chatonsProperties.services.gitolite = {
file.datetime = "2022-08-21T10:01:00";
service = {
name = "Gitolite";
description = "Gitolite allows you to setup git hosting on a central server, with fine-grained access control and many more powerful features.";
website = "https://git.immae.eu";
logo = "https://git.immae.eu/cgit-css/favicon.ico";
status.level = "OK";
status.description = "OK";
registration."" = ["MEMBER" "CLIENT"];
registration.load = "OPEN";
install.type = "PACKAGE";
guide.user = "https://www.immae.eu/docs/forge-logicielle.html";
};
software = {
name = "Gitolite";
website = "https://gitolite.com/gitolite/";
license.url = "https://github.com/sitaramc/gitolite/blob/master/COPYING";
license.name = "GNU General Public License v2.0";
version = pkgs.gitolite.version;
source.url = "https://github.com/sitaramc/gitolite";
};
};
myServices.ssh.modules.gitolite = {
snippet = builtins.readFile ./ldap_gitolite.sh;
dependencies = [ pkgs.gitolite ];
vars.ldap_group = "cn=users,cn=gitolite,ou=services,dc=immae,dc=eu";
vars.shell_path = "${pkgs.gitolite}/bin/gitolite-shell";
vars.services = let
toLine = login: key: ''command="${pkgs.gitolite}/bin/gitolite-shell ${login}",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ${key}'';
in builtins.concatStringsSep "\n" [
(toLine "naemon" config.myEnv.monitoring.ssh_public_key)
(toLine "buildbot" config.myEnv.buildbot.ssh_key.public)
];
};
networking.firewall.allowedTCPPorts = [ 9418 ];
secrets.keys."gitolite/ldap_password" = {
user = "gitolite";
group = "gitolite";
permissions = "0400";
text = config.myEnv.tools.gitolite.ldap.password;
};
services.gitDaemon = {
enable = true;
user = "gitolite";
group = "gitolite";
basePath = "${cfg.gitoliteDir}/repositories";
};
system.activationScripts.gitolite = let
deps = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
gitolite_ldap_groups = pkgs.runCommand "gitolite_ldap_groups.sh" {
buildInputs = [ pkgs.makeWrapper ];
} ''
makeWrapper "${./gitolite_ldap_groups.sh}" "$out" \
--prefix PATH : ${lib.makeBinPath deps} \
--set LDAP_PASS_PATH ${config.secrets.fullPaths."gitolite/ldap_password"}
'';
in {
deps = [ "users" ];
text = ''
if [ -d ${cfg.gitoliteDir} ]; then
ln -sf ${gitolite_ldap_groups} ${cfg.gitoliteDir}/gitolite_ldap_groups.sh
chmod g+rx ${cfg.gitoliteDir}
fi
if [ -f ${cfg.gitoliteDir}/projects.list ]; then
chmod g+r ${cfg.gitoliteDir}/projects.list
fi
'';
};
users.users.wwwrun.extraGroups = [ "gitolite" ];
users.users.gitolite.extraGroups = [ "keys" ];
users.users.gitolite.packages = let
python-packages = python-packages: with python-packages; [
simplejson
apprise
sleekxmpp
urllib3
pyyaml
];
in
[
# For some reason it absolutely wants to include "doc" output
((pkgs.python39.withPackages python-packages) // { doc = ""; })
pkgs.nettools
pkgs.findutils
];
# Installation: https://git.immae.eu/mantisbt/view.php?id=93
services.gitolite = {
enable = true;
adminPubkey = config.myEnv.sshd.rootKeys.immae_dilion;
};
myServices.monitoring.fromMasterActivatedPlugins = [ "git" ];
myServices.monitoring.fromMasterObjects.service = [
{
service_description = "gitolite is working";
host_name = config.hostEnv.fqdn;
use = "external-web-service";
check_command = "check_git";
servicegroups = "webstatus-remote-services";
_webstatus_name = "Git";
_webstatus_url = "git.immae.eu";
}
];
};
}
|
