Revert to single forge user, improve

12 files changed, 101 insertions, 141 deletions

diff --git a/roles/jails/22_forge/defaults/main.yml b/roles/jails/22_forge/defaults/main.yml
index 3c4f527..2bc6900 100644
--- a/roles/jails/22_forge/defaults/main.yml
+++ b/roles/jails/22_forge/defaults/main.yml
@@ -2,20 +2,13 @@ userland: "15.1-RELEASE"
 
 zfs:
   - name: forge_repos
-    mode: "0755"
-  - name: forge_config
+    owner: "1000"
+    group: "1000"
     mode: "0755"
 
 nullfs:
   - src: forge_repos
     dst: /var/db/repos
-  - src: forge_config
-    dst: /var/db/forge-config
-
-forge_users:
-  - name: jan
-    uid: 2000
-    authorized_keys: "{{ forge_authorized_keys }}"
 
 pkg:
   - git
diff --git a/roles/jails/22_forge/files/cgit.css b/roles/jails/22_forge/files/cgit.css
index 44371fc..bde051e 100644
--- a/roles/jails/22_forge/files/cgit.css
+++ b/roles/jails/22_forge/files/cgit.css
@@ -479,3 +479,14 @@ table[summary="repository list"] tr th:nth-child(3),
 table[summary="repository list"] tr td:nth-child(3) {
 	display: none;
 }
+
+.pager {
+    margin-top: 20px;
+    list-style: none;
+    padding-left: 0px;
+    text-align: right;
+}
+
+.pager li {
+    display: inline;
+}
diff --git a/roles/jails/22_forge/files/git-mirrors.sh b/roles/jails/22_forge/files/git-mirrors.sh
index df78129..8388d24 100644
--- a/roles/jails/22_forge/files/git-mirrors.sh
+++ b/roles/jails/22_forge/files/git-mirrors.sh
@@ -4,9 +4,8 @@
 
 REPOS_DIR="/var/db/repos"
 LOG="/var/log/git-mirrors.log"
-CONFIG_DIR="/var/db/forge-config/$(whoami)"
-export GIT_SSH_COMMAND="ssh -i $CONFIG_DIR/.ssh/forge_deploy -F $CONFIG_DIR/.ssh/config -o IdentitiesOnly=yes"
-export GIT_CONFIG_GLOBAL="$CONFIG_DIR/.gitconfig"
+export GIT_SSH_COMMAND="ssh -i /var/db/repos/.ssh/forge_deploy -F /var/db/repos/.ssh/config -o IdentitiesOnly=yes"
+export GIT_CONFIG_GLOBAL="/var/db/repos/.gitconfig"
 
 echo "$(date) Starting mirror run" >> "$LOG"
 
diff --git a/roles/jails/22_forge/files/git-shell-commands/delete b/roles/jails/22_forge/files/git-shell-commands/delete
index 78666ed..1251dec 100644
--- a/roles/jails/22_forge/files/git-shell-commands/delete
+++ b/roles/jails/22_forge/files/git-shell-commands/delete
@@ -1,4 +1,5 @@
 #!/bin/sh
+set -e
 if [ -z "$1" ]; then
     echo "Usage: delete [REPO_NAME]"
     exit 1
@@ -7,8 +8,5 @@ if [ ! -d "$1.git" ]; then
     echo "Repository $1 does not exist"
     exit 1
 fi
-
-GROUP="r_$(echo "$1" | sed 's/^\.//' | sha1 -q | cut -c1-14)"
 rm -rf "$1.git"
-pw groupdel "$GROUP" 2>/dev/null || true
 echo "Deleted repository $1"
diff --git a/roles/jails/22_forge/files/git-shell-commands/describe b/roles/jails/22_forge/files/git-shell-commands/describe
index 43f75db..46451bf 100644
--- a/roles/jails/22_forge/files/git-shell-commands/describe
+++ b/roles/jails/22_forge/files/git-shell-commands/describe
@@ -1,4 +1,5 @@
 #!/bin/sh
+set -e
 if [ "$#" -ne 2 ]; then
     echo "Usage: describe [REPO_NAME] [DESCRIPTION]"
     echo "Note: quote the description if it contains spaces"
diff --git a/roles/jails/22_forge/files/git-shell-commands/help b/roles/jails/22_forge/files/git-shell-commands/help
index 0494ae3..8fcad52 100644
--- a/roles/jails/22_forge/files/git-shell-commands/help
+++ b/roles/jails/22_forge/files/git-shell-commands/help
@@ -1,4 +1,5 @@
 #!/bin/sh
+set -e
 cat <<EOF
 Available commands:
 
diff --git a/roles/jails/22_forge/files/git-shell-commands/ls b/roles/jails/22_forge/files/git-shell-commands/ls
index d72fa9a..7fd2dd4 100644
--- a/roles/jails/22_forge/files/git-shell-commands/ls
+++ b/roles/jails/22_forge/files/git-shell-commands/ls
@@ -1,11 +1,12 @@
 #!/bin/sh
-find . -maxdepth 1 -type d -name "*.git" | sort | while read repo; do
+for repo in "$HOME"/*.git "$HOME"/.*.git; do
+    [ -d "$repo" ] || continue
     name="$(basename "$repo" .git)"
     desc="$(cat "$repo/description" 2>/dev/null)"
-    mirror_to="$(git -C "$repo" remote get-url mirror-to 2>/dev/null)"
-    mirror_from="$(git -C "$repo" remote get-url mirror-from 2>/dev/null)"
+    mirror_to="$(git -C "$repo" remote get-url mirror-to 2>/dev/null || true)"
+    mirror_from="$(git -C "$repo" remote get-url mirror-from 2>/dev/null || true)"
 
-    printf "%-30s %s\n" "$name" "$desc"
+    printf "%-30s %s\n" "$name" "${desc:-<no description>}"
     [ -n "$mirror_to" ]   && printf "  %-28s -> %s\n" "" "$mirror_to"
     [ -n "$mirror_from" ] && printf "  %-28s <- %s\n" "" "$mirror_from"
 done
diff --git a/roles/jails/22_forge/files/git-shell-commands/mirror b/roles/jails/22_forge/files/git-shell-commands/mirror
index 30237af..2a488d3 100644
--- a/roles/jails/22_forge/files/git-shell-commands/mirror
+++ b/roles/jails/22_forge/files/git-shell-commands/mirror
@@ -1,4 +1,5 @@
 #!/bin/sh
+set -e
 # mirror [REPO] to [URL]     - set up hourly push mirror
 # mirror [REPO] from [URL]   - set up hourly fetch mirror
 # mirror [REPO] delete       - remove any mirror
diff --git a/roles/jails/22_forge/files/git-shell-commands/new b/roles/jails/22_forge/files/git-shell-commands/new
index 7fdf61e..87d8e62 100644
--- a/roles/jails/22_forge/files/git-shell-commands/new
+++ b/roles/jails/22_forge/files/git-shell-commands/new
@@ -1,4 +1,5 @@
 #!/bin/sh
+set -e
 if [ -z "$1" ]; then
     echo "Usage: new [REPO_NAME]"
     echo "Tip:   prefix with '.' to make private (e.g. new .myrepo)"
@@ -7,26 +8,16 @@ fi
 
 REPO="$1"
 REPO_PATH="$HOME/$REPO.git"
-GROUP="r_$(echo "$REPO" | sed 's/^\.//' | sha1 -q | cut -c1-14)"
 
 if [ -d "$REPO_PATH" ]; then
     echo "Repository $REPO already exists"
     exit 1
 fi
 
-# Create repo group
-pw groupadd "$GROUP" 2>/dev/null || true
-pw groupmod "$GROUP" -m "$USER" 2>/dev/null || true
-
-# Init bare repo
 git init --bare "$REPO_PATH"
 echo "" > "$REPO_PATH/description"
+chown -R git:git "$REPO_PATH"
 
-# Set ownership and permissions
-chown -R "$USER:$GROUP" "$REPO_PATH"
-
-# Public: rwxr-x--- (group can read, others nothing)
-# Private (dot-prefix): rwx------ (only owner)
 if [ "${REPO#.}" = "$REPO" ]; then
     chmod -R 2755 "$REPO_PATH"
 else
@@ -34,7 +25,7 @@ else
 fi
 
 echo "Created repository $REPO"
-echo "Clone: $USER@forge.jan.systems:$REPO.git"
+echo "Clone: git@forge.jan.systems:$REPO.git"
 if [ "${REPO#.}" = "$REPO" ]; then
     echo "Web:   https://forge.jan.systems/$REPO.git"
 fi
diff --git a/roles/jails/22_forge/files/git-shell-commands/rename b/roles/jails/22_forge/files/git-shell-commands/rename
index 8586991..be79192 100644
--- a/roles/jails/22_forge/files/git-shell-commands/rename
+++ b/roles/jails/22_forge/files/git-shell-commands/rename
@@ -1,4 +1,5 @@
 #!/bin/sh
+set -e
 if [ -z "$1" ] || [ -z "$2" ]; then
     echo "Usage: rename [OLD_NAME] [NEW_NAME]"
     exit 1
@@ -11,18 +12,5 @@ if [ -d "$2.git" ]; then
     echo "Repository $2 already exists"
     exit 1
 fi
-
-OLD_GROUP="r_$(echo "$1" | sed 's/^\.//' | sha1 -q | cut -c1-14)"
-NEW_GROUP="r_$(echo "$2" | sed 's/^\.//' | sha1 -q | cut -c1-14)"
-
 mv "$1.git" "$2.git"
-
-# Rename group
-pw groupmod "$OLD_GROUP" -l "$NEW_GROUP" 2>/dev/null || {
-    pw groupadd "$NEW_GROUP" 2>/dev/null || true
-    pw groupmod "$NEW_GROUP" -m "$USER" 2>/dev/null || true
-    pw groupdel "$OLD_GROUP" 2>/dev/null || true
-}
-
-chown -R "$USER:$NEW_GROUP" "$2.git"
 echo "Renamed $1 to $2"
diff --git a/roles/jails/22_forge/tasks/main.yml b/roles/jails/22_forge/tasks/main.yml
index 24fe362..92a29c8 100644
--- a/roles/jails/22_forge/tasks/main.yml
+++ b/roles/jails/22_forge/tasks/main.yml
@@ -2,133 +2,111 @@
     name: jail
     tasks_from: jail_setup
 
-# --- Shared git-shell-commands ---
+# --- git user ---
 
-- name: Create /usr/local/libexec/git-shell-commands directory
-  file:
-    path: /var/db/repos/git-shell-commands
-    state: directory
-    owner: root
-    group: wheel
-    mode: "0755"
-
-- name: Deploy git-shell-commands
-  copy:
-    src: "{{ jail_role_dir }}/files/git-shell-commands/{{ item }}"
-    dest: "/var/db/repos/git-shell-commands/{{ item }}"
-    owner: root
-    group: wheel
-    mode: "0755"
-  loop:
-    - help
-    - new
-    - ls
-    - delete
-    - rename
-    - describe
-    - mirror
-
-# --- Forge users ---
-
-- name: Create forge user groups
+- name: Create git group
   group:
-    name: "{{ item.name }}"
-    gid: "{{ item.uid }}"
-  loop: "{{ forge_users }}"
-  loop_control:
-    label: "{{ item.name }}"
+    name: git
+    gid: 1000
 
-- name: Create forge users
+- name: Create git user
   user:
-    name: "{{ item.name }}"
-    uid: "{{ item.uid }}"
-    group: "{{ item.name }}"
+    name: git
+    uid: 1000
+    group: git
     home: /var/db/repos
     shell: /usr/local/bin/git-shell
+    comment: "Git Server"
     create_home: false
-  loop: "{{ forge_users }}"
-  loop_control:
-    label: "{{ item.name }}"
 
-- name: Create per-user config directories
+- name: Create .ssh directory for git user
   file:
-    path: "/var/db/forge-config/{{ item.name }}"
+    path: /var/db/repos/.ssh
     state: directory
-    owner: "{{ item.name }}"
-    group: "{{ item.name }}"
+    owner: git
+    group: git
     mode: "0700"
-  loop: "{{ forge_users }}"
-  loop_control:
-    label: "{{ item.name }}"
 
-- name: Create .ssh directories for forge users
-  file:
-    path: "/var/db/forge-config/{{ item.name }}/.ssh"
-    state: directory
-    owner: "{{ item.name }}"
-    group: "{{ item.name }}"
-    mode: "0700"
-  loop: "{{ forge_users }}"
-  loop_control:
-    label: "{{ item.name }}"
-
-- name: Deploy authorized_keys for forge users
+- name: Deploy authorized_keys
   copy:
-    content: "{{ item.authorized_keys }}\n"
-    dest: "/var/db/forge-config/{{ item.name }}/.ssh/authorized_keys"
-    owner: "{{ item.name }}"
-    group: "{{ item.name }}"
+    content: "{{ forge_authorized_keys }}\n"
+    dest: /var/db/repos/.ssh/authorized_keys
+    owner: git
+    group: git
     mode: "0600"
-  loop: "{{ forge_users }}"
-  loop_control:
-    label: "{{ item.name }}"
 
-- name: Deploy gitconfig for primary forge user (jan)
+- name: Deploy gitconfig for git user
   copy:
     content: |
       [init]
           defaultBranch = main
-    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.gitconfig"
-    owner: "{{ forge_users[0].name }}"
-    group: "{{ forge_users[0].name }}"
+    dest: /var/db/repos/.gitconfig
+    owner: git
+    group: git
     mode: "0644"
 
+- name: Deploy SSH config for git user
+  copy:
+    content: |
+      Host *
+          IdentityFile ~/.ssh/forge_deploy
+          IdentitiesOnly yes
+          StrictHostKeyChecking=accept-new
+    dest: /var/db/repos/.ssh/config
+    owner: git
+    group: git
+    mode: "0600"
+
 - name: Deploy forge deploy private key
   copy:
     content: "{{ forge_deploy_key.private }}"
-    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.ssh/forge_deploy"
-    owner: "{{ forge_users[0].name }}"
-    group: "{{ forge_users[0].name }}"
+    dest: /var/db/repos/.ssh/forge_deploy
+    owner: git
+    group: git
     mode: "0600"
 
 - name: Deploy forge deploy public key
   copy:
     content: "{{ forge_deploy_key.public }}"
-    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.ssh/forge_deploy.pub"
-    owner: "{{ forge_users[0].name }}"
-    group: "{{ forge_users[0].name }}"
+    dest: /var/db/repos/.ssh/forge_deploy.pub
+    owner: git
+    group: git
     mode: "0644"
 
-- name: Deploy SSH config for primary forge user
+# --- git-shell-commands ---
+
+- name: Create git-shell-commands directory
+  file:
+    path: /var/db/repos/git-shell-commands
+    state: directory
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Deploy git-shell-commands
   copy:
-    content: |
-      Host *
-          IdentityFile /var/db/forge-config/{{ forge_users[0].name }}/.ssh/forge_deploy
-          IdentitiesOnly yes
-          StrictHostKeyChecking=accept-new
-    dest: "/var/db/forge-config/{{ forge_users[0].name }}/.ssh/config"
-    owner: "{{ forge_users[0].name }}"
-    group: "{{ forge_users[0].name }}"
-    mode: "0600"
+    src: "{{ jail_role_dir }}/files/git-shell-commands/{{ item }}"
+    dest: "/var/db/repos/git-shell-commands/{{ item }}"
+    owner: root
+    group: wheel
+    mode: "0755"
+  loop:
+    - help
+    - new
+    - ls
+    - delete
+    - rename
+    - describe
+    - mirror
 
-# --- Git mirrors ---
+# --- git mirrors ---
 
 - name: Create git-mirrors log file
   file:
     path: /var/log/git-mirrors.log
     state: touch
-    owner: "{{ forge_users[0].name }}"
-    group: "{{ forge_users[0].name }}"
+    owner: git
+    group: git
     mode: "0644"
 
 - name: Deploy git-mirrors script
@@ -139,13 +117,13 @@
     group: wheel
     mode: "0755"
 
-- name: Deploy crontab for primary forge user
+- name: Deploy crontab for git user
   copy:
     content: |
       SHELL=/bin/sh
       PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
       0 * * * * /usr/local/bin/git-mirrors
-    dest: "/var/cron/tabs/{{ forge_users[0].name }}"
+    dest: /var/cron/tabs/git
     owner: root
     group: wheel
     mode: "0600"
@@ -251,6 +229,7 @@
     group: wheel
     mode: "0644"
   notify: Restart sshd
+
 - import_role:
     name: jail
     tasks_from: jail_launch
diff --git a/roles/jails/22_forge/templates/etc_ssh_sshd_config.j2 b/roles/jails/22_forge/templates/etc_ssh_sshd_config.j2
index 11cf4a7..c99143c 100644
--- a/roles/jails/22_forge/templates/etc_ssh_sshd_config.j2
+++ b/roles/jails/22_forge/templates/etc_ssh_sshd_config.j2
@@ -8,14 +8,11 @@ HostKey /etc/ssh/ssh_host_ed25519_key
 
 PermitRootLogin no
 PubkeyAuthentication yes
-AuthorizedKeysFile /var/db/forge-config/%u/.ssh/authorized_keys
+AuthorizedKeysFile .ssh/authorized_keys
 PasswordAuthentication no
 ChallengeResponseAuthentication no
 
+AllowUsers git
+
 UseDNS no
 PrintMotd no
-
-{% for user in forge_users %}
-Match User {{ user.name }}
-    SetEnv GIT_CONFIG_GLOBAL=/var/db/forge-config/{{ user.name }}/.gitconfig
-{% endfor %}