Add forge jail

3 files changed, 96 insertions, 0 deletions

diff --git a/roles/jails/22_forge/templates/etc_ssh_sshd_config.j2 b/roles/jails/22_forge/templates/etc_ssh_sshd_config.j2
new file mode 100644
index 0000000..c99143c
--- /dev/null
+++ b/roles/jails/22_forge/templates/etc_ssh_sshd_config.j2
@@ -0,0 +1,18 @@
+Port 22
+AddressFamily any
+ListenAddress 0.0.0.0
+
+HostKey /etc/ssh/ssh_host_rsa_key
+HostKey /etc/ssh/ssh_host_ecdsa_key
+HostKey /etc/ssh/ssh_host_ed25519_key
+
+PermitRootLogin no
+PubkeyAuthentication yes
+AuthorizedKeysFile .ssh/authorized_keys
+PasswordAuthentication no
+ChallengeResponseAuthentication no
+
+AllowUsers git
+
+UseDNS no
+PrintMotd no
diff --git a/roles/jails/22_forge/templates/usr_local_etc_cgitrc.j2 b/roles/jails/22_forge/templates/usr_local_etc_cgitrc.j2
new file mode 100644
index 0000000..1fac7f1
--- /dev/null
+++ b/roles/jails/22_forge/templates/usr_local_etc_cgitrc.j2
@@ -0,0 +1,30 @@
+css=/cgit.css
+logo=/cgit.png
+favicon=/favicon.ico
+head-include=/usr/local/etc/cgit/head-include.html
+
+virtual-root=/
+
+# Site settings
+root-title=forge.jan.systems
+root-desc=Jan's personal git repositories
+clone-prefix=git@forge.jan.systems https://forge.jan.systems
+
+# Filters (must appear before scan-path)
+about-filter=/usr/local/lib/cgit/filters/about-formatting.sh
+source-filter=/usr/local/lib/cgit/filters/syntax-highlighting.sh
+
+# Repository display (must appear before scan-path)
+enable-index-owner=0
+enable-commit-graph=1
+enable-log-filecount=1
+enable-log-linecount=1
+max-stats=year
+
+# Render README on summary page
+readme=:README.md
+readme=:README
+readme=:README.txt
+
+# Scan /home/git for bare repositories
+scan-path=/home/git
diff --git a/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 b/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2
new file mode 100644
index 0000000..7baf367
--- /dev/null
+++ b/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2
@@ -0,0 +1,48 @@
+worker_processes 1;
+
+events {
+    worker_connections 1024;
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+    sendfile      on;
+    keepalive_timeout 65;
+
+    server {
+        listen 80;
+        server_name _;
+
+        root /usr/local/www/cgit;
+        try_files $uri @cgit;
+
+        # Anonymous git HTTP clone
+        location ~ ^/(.+\.git)/(HEAD|info/refs|objects/.*|git-upload-pack)$ {
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME /usr/local/bin/git-http-backend;
+            fastcgi_param GIT_HTTP_EXPORT_ALL "";
+            fastcgi_param GIT_PROJECT_ROOT /home/git;
+            fastcgi_param GIT_CONFIG_GLOBAL /usr/local/etc/git/gitconfig-www;
+            fastcgi_param PATH_INFO /$1/$2;
+            fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock;
+        }
+
+        location @cgit {
+            include fastcgi_params;
+            fastcgi_param SCRIPT_FILENAME /usr/local/www/cgit/cgit.cgi;
+            fastcgi_param PATH_INFO $uri;
+            fastcgi_param QUERY_STRING $query_string;
+            fastcgi_param GIT_CONFIG_GLOBAL /usr/local/etc/git/gitconfig-www;
+            fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock;
+        }
+
+        location /cgit.css {
+            root /usr/local/www/cgit;
+        }
+
+        location /cgit.png {
+            root /usr/local/www/cgit;
+        }
+    }
+}