feat(nixos/roles/git): clone thru http and mirror kore to github
3 files changed, -15/+62
kore.json
@@ -25,7 +25,8 @@ "repos": { "kore": { "write": ["lostduk"],- "description": "my public infrastructure monorepo"+ "description": "my public infrastructure monorepo",+ "mirror": "[email protected]:lostduk/kore.git" }, "greenhouse": { "write": ["lostduk"],
nixos/features/kore.nix
@@ -77,6 +77,10 @@ let type = types.nullOr types.str; default = null; };+ mirror = mkOption {+ type = types.nullOr types.str;+ default = null;+ }; }; hostNames = name: host:
nixos/roles/git.nix
@@ -25,6 +25,36 @@ let safe.directory = map (repo: "${root}/${repo}.git") (lib.attrNames repos); }); + mirrorKey = "${root}/.ssh/mirror";+ mirrors = lib.any (access: access.mirror != null) (lib.attrValues repos);++ mirrorHook = pkgs.writeShellScript "kore-git-mirror" ''+ cat > /dev/null+ url=$(${pkgs.git}/bin/git config --get kore.mirror) || exit 0+ export GIT_SSH_COMMAND="${pkgs.openssh}/bin/ssh -i ${mirrorKey} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=yes"+ if ${pkgs.git}/bin/git push --mirror --quiet "$url"; then+ echo "kore-git: mirrored to $url"+ else+ echo "kore-git: mirror to $url failed" >&2+ fi+ '';++ fastcgi = ''+ fastcgi_param GATEWAY_INTERFACE CGI/1.1;+ fastcgi_param SERVER_PROTOCOL $server_protocol;+ fastcgi_param SERVER_NAME $server_name;+ fastcgi_param SERVER_PORT $server_port;+ fastcgi_param REQUEST_METHOD $request_method;+ fastcgi_param REQUEST_URI $request_uri;+ fastcgi_param QUERY_STRING $query_string;+ fastcgi_param CONTENT_TYPE $content_type;+ fastcgi_param CONTENT_LENGTH $content_length;+ fastcgi_param REMOTE_ADDR $remote_addr;+ fastcgi_param HTTPS $https if_not_empty;+ fastcgi_param HOME ${petalHome};+ fastcgi_pass unix:${config.services.fcgiwrap.instances.petal.socket.address};+ '';+ owner = access: if access.owner != null then access.owner else lib.findFirst (_: true) "" access.write; acl = pkgs.writeText "kore-git-acl" (lib.concatLines (lib.concatLists (lib.mapAttrsToList (repo: access:@@ -100,17 +130,29 @@ in { User = "git"; Group = "git"; };- path = [ pkgs.git pkgs.coreutils ];- script = lib.concatStrings (lib.mapAttrsToList (repo: access: ''+ path = [ pkgs.git pkgs.coreutils pkgs.openssh ];+ script = lib.optionalString mirrors ''+ if [ ! -f '${mirrorKey}' ]; then+ mkdir -p -m 700 '${root}/.ssh'+ ssh-keygen -q -t ed25519 -N "" -C "git@${config.networking.hostName} mirror" -f '${mirrorKey}'+ fi+ '' + lib.concatStrings (lib.mapAttrsToList (repo: access: '' if [ ! -d '${root}/${repo}.git' ]; then mkdir -p "$(dirname '${root}/${repo}.git')" git init --quiet --bare --initial-branch=main '${root}/${repo}.git' fi printf '%s\n' ${lib.escapeShellArg access.description} > '${root}/${repo}.git/description' printf '%s\n' ${lib.escapeShellArg (owner access)} > '${root}/${repo}.git/owner'+ ln -sfn ${mirrorHook} '${root}/${repo}.git/hooks/post-receive'+ ${if access.mirror != null+ then "git -C '${root}/${repo}.git' config kore.mirror ${lib.escapeShellArg access.mirror}"+ else "git -C '${root}/${repo}.git' config --unset kore.mirror || true"} '') repos); }; + programs.ssh.knownHosts."github.com".publicKey =+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";+ systemd.tmpfiles.rules = [ "z ${root} 0750 git git -" ]; users.users.petal = {@@ -131,21 +173,21 @@ in { locations."= /style.css".alias = "${petal}/share/petal/style.css"; - locations."/".extraConfig = ''- fastcgi_param GATEWAY_INTERFACE CGI/1.1;- fastcgi_param SERVER_PROTOCOL $server_protocol;- fastcgi_param SERVER_NAME $server_name;- fastcgi_param SERVER_PORT $server_port;- fastcgi_param REQUEST_METHOD $request_method;- fastcgi_param REQUEST_URI $request_uri;- fastcgi_param QUERY_STRING $query_string;- fastcgi_param REMOTE_ADDR $remote_addr;- fastcgi_param HTTPS $https if_not_empty;+ locations."/".extraConfig = fastcgi + '' fastcgi_param SCRIPT_FILENAME ${petal}/bin/petal; fastcgi_param SCRIPT_NAME ""; fastcgi_param PATH_INFO $uri;- fastcgi_param HOME ${petalHome};- fastcgi_pass unix:${config.services.fcgiwrap.instances.petal.socket.address};+ '';++ locations."~ ^/(.+\\.git/(?:info/refs|git-upload-pack))$".extraConfig = ''+ if ($arg_service = git-receive-pack) {+ return 403;+ }+ '' + fastcgi + ''+ fastcgi_param SCRIPT_FILENAME ${pkgs.git}/libexec/git-core/git-http-backend;+ fastcgi_param PATH_INFO /$1;+ fastcgi_param GIT_PROJECT_ROOT ${root};+ fastcgi_param GIT_HTTP_EXPORT_ALL 1; ''; }; }
greenhouse