diff options
Diffstat (limited to 'roles/jails/22_forge')
| -rw-r--r-- | roles/jails/22_forge/files/git-mirrors.sh | 8 | ||||
| -rw-r--r-- | roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 | 26 |
2 files changed, 18 insertions, 16 deletions
diff --git a/roles/jails/22_forge/files/git-mirrors.sh b/roles/jails/22_forge/files/git-mirrors.sh index 8388d24..c15e532 100644 --- a/roles/jails/22_forge/files/git-mirrors.sh +++ b/roles/jails/22_forge/files/git-mirrors.sh @@ -4,7 +4,7 @@ REPOS_DIR="/var/db/repos" LOG="/var/log/git-mirrors.log" -export GIT_SSH_COMMAND="ssh -i /var/db/repos/.ssh/forge_deploy -F /var/db/repos/.ssh/config -o IdentitiesOnly=yes" +export GIT_SSH_COMMAND="ssh -i /var/db/repos/.ssh/forge_deploy -F /var/db/repos/.ssh/config -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new" export GIT_CONFIG_GLOBAL="/var/db/repos/.gitconfig" echo "$(date) Starting mirror run" >> "$LOG" @@ -13,11 +13,13 @@ for repo in "$REPOS_DIR"/*.git "$REPOS_DIR"/.*.git; do [ -d "$repo" ] || continue name="$(basename "$repo" .git)" - # mirror-to: push all refs to remote + # mirror-to: push branches and tags to remote (explicit refspecs to avoid pushing remote-tracking refs) if git -C "$repo" remote get-url mirror-to >/dev/null 2>&1; then remote=$(git -C "$repo" remote get-url mirror-to) echo "$(date) [push] $name -> $remote" >> "$LOG" - if git -C "$repo" push --mirror mirror-to >> "$LOG" 2>&1; then + if git -C "$repo" push mirror-to \ + '+refs/heads/*:refs/heads/*' \ + '+refs/tags/*:refs/tags/*' >> "$LOG" 2>&1; then echo "$(date) [push] OK $name" >> "$LOG" else echo "$(date) [push] FAILED $name" >> "$LOG" diff --git a/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 b/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 index c154f2c..d8c44eb 100644 --- a/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 +++ b/roles/jails/22_forge/templates/usr_local_etc_nginx_nginx.conf.j2 @@ -15,19 +15,27 @@ http { server_name _; root /usr/local/www/cgit; - try_files $uri @cgit; + + # Block HTTP access to private (dot-prefixed) repos + location ~ ^/\..+ { + return 403; + } # Anonymous git HTTP clone - location ~ ^/(.+\.git)/(HEAD|info/refs|objects/.*|git-upload-pack)$ { + location ~ ^/(.+\.git)/(info/refs|git-upload-pack)$ { include fastcgi_params; - fastcgi_param SCRIPT_FILENAME /usr/local/bin/git-http-backend; - fastcgi_param GIT_HTTP_EXPORT_ALL ""; + fastcgi_param SCRIPT_FILENAME /usr/local/libexec/git-core/git-http-backend; + fastcgi_param GIT_HTTP_EXPORT_ALL 1; fastcgi_param GIT_PROJECT_ROOT /var/db/repos; fastcgi_param GIT_CONFIG_GLOBAL /usr/local/etc/git/gitconfig-www; - fastcgi_param PATH_INFO /$1/$2; + fastcgi_param PATH_INFO $uri; fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock; } + location / { + try_files $uri @cgit; + } + location @cgit { include fastcgi_params; fastcgi_param SCRIPT_FILENAME /usr/local/www/cgit/cgit.cgi; @@ -36,13 +44,5 @@ http { fastcgi_param GIT_CONFIG_GLOBAL /usr/local/etc/git/gitconfig-www; fastcgi_pass unix:/var/run/fcgiwrap/fcgiwrap.sock; } - - location /cgit.css { - root /usr/local/www/cgit; - } - - location /cgit.png { - root /usr/local/www/cgit; - } } } |