diff options
| -rw-r--r-- | roles/host/templates/usr_local_bin_update_ports.sh.j2 | 3 | ||||
| -rw-r--r-- | roles/jails/01_ingress/defaults/main.yml | 1 | ||||
| -rw-r--r-- | roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 | 26 |
3 files changed, 16 insertions, 14 deletions
diff --git a/roles/host/templates/usr_local_bin_update_ports.sh.j2 b/roles/host/templates/usr_local_bin_update_ports.sh.j2 index 1a512af..7f6522e 100644 --- a/roles/host/templates/usr_local_bin_update_ports.sh.j2 +++ b/roles/host/templates/usr_local_bin_update_ports.sh.j2 @@ -10,7 +10,7 @@ usage() { BASEDIR=/usr/ports REMOTE_QUARTERLY="https://github.com/freebsd/freebsd-ports.git" -REMOTE_CUSTOM="https://github.com/jantuomi/freebsd-ports-custom.git" +REMOTE_CUSTOM="http://{{ jail_ips.forge }}/freebsd-ports-custom.git" case "$1" in quarterly) @@ -46,6 +46,7 @@ custom) # Clone or update if [ -d "${BASEDIR}/custom/.git" ]; then echo "Updating custom ports overlay..." + git -C "${BASEDIR}/custom" remote set-url origin "$REMOTE_CUSTOM" git -C "${BASEDIR}/custom" fetch origin git -C "${BASEDIR}/custom" reset --hard origin/main else diff --git a/roles/jails/01_ingress/defaults/main.yml b/roles/jails/01_ingress/defaults/main.yml index 1e96656..5a187a1 100644 --- a/roles/jails/01_ingress/defaults/main.yml +++ b/roles/jails/01_ingress/defaults/main.yml @@ -53,6 +53,7 @@ pkg: - nginx - py312-certbot - py312-certbot-nginx + - curl files: - src: acme-dns-auth.py diff --git a/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 b/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 index c154f2c..d8c44eb 100644 --- a/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 +++ b/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 @@ -15,19 +15,27 @@ http { server_name _; root /usr/local/www/cgit; - try_files $uri @cgit; + + # Block HTTP access to private (dot-prefixed) repos + location ~ ^/\..+ { + return 403; + } # Anonymous git HTTP clone - location ~ ^/(.+\.git)/(HEAD|info/refs|objects/.*|git-upload-pack)$ { + location ~ ^/(.+\.git)/(info/refs|git-upload-pack)$ { include fastcgi_params; - fastcgi_param SCRIPT_FILENAME /usr/local/bin/git-http-backend; - fastcgi_param GIT_HTTP_EXPORT_ALL ""; + fastcgi_param SCRIPT_FILENAME /usr/local/libexec/git-core/git-http-backend; + fastcgi_param GIT_HTTP_EXPORT_ALL 1; fastcgi_param GIT_PROJECT_ROOT /var/db/repos; fastcgi_param GIT_CONFIG_GLOBAL /usr/local/etc/git/gitconfig-www; - fastcgi_param PATH_INFO /$1/$2; + fastcgi_param PATH_INFO $uri; fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock; } + location / { + try_files $uri @cgit; + } + location @cgit { include fastcgi_params; fastcgi_param SCRIPT_FILENAME /usr/local/www/cgit/cgit.cgi; @@ -36,13 +44,5 @@ http { fastcgi_param GIT_CONFIG_GLOBAL /usr/local/etc/git/gitconfig-www; fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock; } - - location /cgit.css { - root /usr/local/www/cgit; - } - - location /cgit.png { - root /usr/local/www/cgit; - } } } |