Add multi user support to forge

4 files changed, 52 insertions, 11 deletions

diff --git a/roles/jails/22_forge/files/git-mirrors.sh b/roles/jails/22_forge/files/git-mirrors.sh
index c96a000..6de665a 100644
--- a/roles/jails/22_forge/files/git-mirrors.sh
+++ b/roles/jails/22_forge/files/git-mirrors.sh
@@ -1,9 +1,11 @@
 #!/bin/sh
 # Run hourly via cron. Mirrors all repos that have a 'mirror' remote configured.
 
-REPOS_DIR="/home/git"
+REPOS_DIR="/var/db/repos"
 LOG="/var/log/git-mirrors.log"
-export GIT_SSH_COMMAND="ssh -i /home/git/.ssh/forge_deploy -o IdentitiesOnly=yes"
+CONFIG_DIR="/var/db/forge-config/$(whoami)"
+export GIT_SSH_COMMAND="ssh -i $CONFIG_DIR/.ssh/forge_deploy -F $CONFIG_DIR/.ssh/config -o IdentitiesOnly=yes"
+export GIT_CONFIG_GLOBAL="$CONFIG_DIR/.gitconfig"
 
 echo "$(date) Starting mirror run" >> "$LOG"
 
diff --git a/roles/jails/22_forge/files/git-shell-commands/delete b/roles/jails/22_forge/files/git-shell-commands/delete
index 1c1ce0d..78666ed 100644
--- a/roles/jails/22_forge/files/git-shell-commands/delete
+++ b/roles/jails/22_forge/files/git-shell-commands/delete
@@ -7,5 +7,8 @@ if [ ! -d "$1.git" ]; then
     echo "Repository $1 does not exist"
     exit 1
 fi
+
+GROUP="r_$(echo "$1" | sed 's/^\.//' | sha1 -q | cut -c1-14)"
 rm -rf "$1.git"
+pw groupdel "$GROUP" 2>/dev/null || true
 echo "Deleted repository $1"
diff --git a/roles/jails/22_forge/files/git-shell-commands/new b/roles/jails/22_forge/files/git-shell-commands/new
index b8f73a5..331d546 100644
--- a/roles/jails/22_forge/files/git-shell-commands/new
+++ b/roles/jails/22_forge/files/git-shell-commands/new
@@ -1,17 +1,40 @@
 #!/bin/sh
 if [ -z "$1" ]; then
     echo "Usage: new [REPO_NAME]"
-    echo "Tip:   prefix with '.' to make private (e.g. new .dotfiles)"
+    echo "Tip:   prefix with '.' to make private (e.g. new .myrepo)"
     exit 1
 fi
-if [ -d "$1.git" ]; then
-    echo "Repository $1 already exists"
+
+REPO="$1"
+REPO_PATH="$HOME/$REPO.git"
+GROUP="r_$(echo "$REPO" | sed 's/^\.//' | sha1 -q | cut -c1-14)"
+
+if [ -d "$REPO_PATH" ]; then
+    echo "Repository $REPO already exists"
     exit 1
 fi
-git init --bare "$1.git"
-echo "$1" > "$1.git/description"
-echo "Created repository $1"
-echo "Clone: git@forge.jan.systems:$1.git"
-if [ "${1#.}" = "$1" ]; then
-    echo "Web:   https://forge.jan.systems/$1.git"
+
+# Create repo group
+pw groupadd "$GROUP" 2>/dev/null || true
+pw groupmod "$GROUP" -m "$USER" 2>/dev/null || true
+
+# Init bare repo
+git init --bare "$REPO_PATH"
+echo "$REPO" > "$REPO_PATH/description"
+
+# Set ownership and permissions
+chown -R "$USER:$GROUP" "$REPO_PATH"
+
+# Public: rwxr-x--- (group can read, others nothing)
+# Private (dot-prefix): rwx------ (only owner)
+if [ "${REPO#.}" = "$REPO" ]; then
+    chmod -R 2755 "$REPO_PATH"
+else
+    chmod -R 2700 "$REPO_PATH"
+fi
+
+echo "Created repository $REPO"
+echo "Clone: $USER@forge.jan.systems:$REPO.git"
+if [ "${REPO#.}" = "$REPO" ]; then
+    echo "Web:   https://forge.jan.systems/$REPO.git"
 fi
diff --git a/roles/jails/22_forge/files/git-shell-commands/rename b/roles/jails/22_forge/files/git-shell-commands/rename
index 2d1f73e..8586991 100644
--- a/roles/jails/22_forge/files/git-shell-commands/rename
+++ b/roles/jails/22_forge/files/git-shell-commands/rename
@@ -11,5 +11,18 @@ if [ -d "$2.git" ]; then
     echo "Repository $2 already exists"
     exit 1
 fi
+
+OLD_GROUP="r_$(echo "$1" | sed 's/^\.//' | sha1 -q | cut -c1-14)"
+NEW_GROUP="r_$(echo "$2" | sed 's/^\.//' | sha1 -q | cut -c1-14)"
+
 mv "$1.git" "$2.git"
+
+# Rename group
+pw groupmod "$OLD_GROUP" -l "$NEW_GROUP" 2>/dev/null || {
+    pw groupadd "$NEW_GROUP" 2>/dev/null || true
+    pw groupmod "$NEW_GROUP" -m "$USER" 2>/dev/null || true
+    pw groupdel "$OLD_GROUP" 2>/dev/null || true
+}
+
+chown -R "$USER:$NEW_GROUP" "$2.git"
 echo "Renamed $1 to $2"