From a8d027dc7c6312969fa91165e0e99676f23eb6e4 Mon Sep 17 00:00:00 2001
From: Jan Sydänviita <jan@sydanviita.fi>
Date: Wed, 19 Aug 2026 16:39:03 +0300
Subject: Improve forge

---
 roles/jails/22_forge/defaults/main.yml             |  1 +
 roles/jails/22_forge/files/git-mirrors.sh          | 24 ++++++++++
 roles/jails/22_forge/files/git-shell-commands/help | 11 +++--
 .../22_forge/files/git-shell-commands/mirror-to    | 39 +++++++++++++++
 roles/jails/22_forge/tasks/main.yml                | 56 ++++++++++++++++++++++
 5 files changed, 126 insertions(+), 5 deletions(-)
 create mode 100644 roles/jails/22_forge/files/git-mirrors.sh
 create mode 100644 roles/jails/22_forge/files/git-shell-commands/mirror-to

diff --git a/roles/jails/22_forge/defaults/main.yml b/roles/jails/22_forge/defaults/main.yml
index c459f43..3065221 100644
--- a/roles/jails/22_forge/defaults/main.yml
+++ b/roles/jails/22_forge/defaults/main.yml
@@ -24,6 +24,7 @@ services:
   - sshd
   - nginx
   - fcgiwrap
+  - cron
 
 sysrc:
   - name: fcgiwrap_socket_owner
diff --git a/roles/jails/22_forge/files/git-mirrors.sh b/roles/jails/22_forge/files/git-mirrors.sh
new file mode 100644
index 0000000..c96a000
--- /dev/null
+++ b/roles/jails/22_forge/files/git-mirrors.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+# Run hourly via cron. Mirrors all repos that have a 'mirror' remote configured.
+
+REPOS_DIR="/home/git"
+LOG="/var/log/git-mirrors.log"
+export GIT_SSH_COMMAND="ssh -i /home/git/.ssh/forge_deploy -o IdentitiesOnly=yes"
+
+echo "$(date) Starting mirror run" >> "$LOG"
+
+for repo in "$REPOS_DIR"/*.git; do
+    [ -d "$repo" ] || continue
+    name="$(basename "$repo" .git)"
+
+    remote=$(git -C "$repo" remote get-url mirror-to 2>/dev/null) || continue
+
+    echo "$(date) Mirroring $name -> $remote" >> "$LOG"
+    if git -C "$repo" push --mirror mirror-to >> "$LOG" 2>&1; then
+        echo "$(date) OK $name" >> "$LOG"
+    else
+        echo "$(date) FAILED $name" >> "$LOG"
+    fi
+done
+
+echo "$(date) Mirror run complete" >> "$LOG"
diff --git a/roles/jails/22_forge/files/git-shell-commands/help b/roles/jails/22_forge/files/git-shell-commands/help
index fd0690d..e8f2631 100644
--- a/roles/jails/22_forge/files/git-shell-commands/help
+++ b/roles/jails/22_forge/files/git-shell-commands/help
@@ -2,10 +2,11 @@
 cat <<EOF
 Available commands:
 
-  new [REPO_NAME]                       - create a new bare repository
-  ls                                    - list repositories
-  describe [REPO_NAME] [DESCRIPTION]    - set repository description
-  rename [OLD_NAME] [NEW_NAME]          - rename a repository
-  delete [REPO_NAME]                    - delete a repository
+  new [REPO_NAME]                            create a new bare repository
+  ls                                         list repositories
+  describe [REPO_NAME] [DESCRIPTION]         set repository description
+  rename [OLD_NAME] [NEW_NAME]               rename a repository
+  delete [REPO_NAME]                         delete a repository
+  mirror-to [REPO_NAME] [GIT_URL]            set up hourly mirror to a remote git URL
 
 EOF
diff --git a/roles/jails/22_forge/files/git-shell-commands/mirror-to b/roles/jails/22_forge/files/git-shell-commands/mirror-to
new file mode 100644
index 0000000..d161283
--- /dev/null
+++ b/roles/jails/22_forge/files/git-shell-commands/mirror-to
@@ -0,0 +1,39 @@
+#!/bin/sh
+# mirror-to [REPO_NAME] [GIT_URL]
+# Configures a repo to be mirrored hourly to a remote git URL.
+# Example: mirror-to myrepo git@example.com:user/myrepo.git
+if [ -z "$1" ]; then
+    echo "Usage: mirror-to [REPO_NAME] [GIT_URL]"
+    echo "       mirror-to [REPO_NAME]           - remove mirror"
+    echo "Example: mirror-to myrepo git@example.com:user/myrepo.git"
+    exit 1
+fi
+if [ ! -d "$1.git" ]; then
+    echo "Repository $1 does not exist"
+    exit 1
+fi
+
+REPO="$1"
+REMOTE="$2"
+REPO_PATH="$HOME/$REPO.git"
+
+cd "$REPO_PATH" || exit 1
+
+if [ -z "$REMOTE" ]; then
+    if git remote get-url mirror-to >/dev/null 2>&1; then
+        git remote remove mirror-to
+        echo "Removed mirror for $REPO"
+    else
+        echo "No mirror configured for $REPO"
+    fi
+    exit 0
+fi
+
+if git remote get-url mirror-to >/dev/null 2>&1; then
+    git remote set-url mirror-to "$REMOTE"
+else
+    git remote add mirror-to "$REMOTE"
+fi
+
+echo "Configured $REPO to mirror to $REMOTE"
+echo "Mirrors run hourly. Logs: /var/log/git-mirrors.log"
diff --git a/roles/jails/22_forge/tasks/main.yml b/roles/jails/22_forge/tasks/main.yml
index 4fd426d..cf1e9c6 100644
--- a/roles/jails/22_forge/tasks/main.yml
+++ b/roles/jails/22_forge/tasks/main.yml
@@ -53,6 +53,34 @@
     group: git
     mode: "0700"
 
+- name: Deploy forge deploy private key
+  copy:
+    content: "{{ forge_deploy_key.private }}"
+    dest: /home/git/.ssh/forge_deploy
+    owner: git
+    group: git
+    mode: "0600"
+
+- name: Deploy forge deploy public key
+  copy:
+    content: "{{ forge_deploy_key.public }}"
+    dest: /home/git/.ssh/forge_deploy.pub
+    owner: git
+    group: git
+    mode: "0644"
+
+- name: Deploy SSH config for git user
+  copy:
+    content: |
+      Host *
+          IdentityFile ~/.ssh/forge_deploy
+          IdentitiesOnly yes
+          StrictHostKeyChecking=accept-new
+    dest: /home/git/.ssh/config
+    owner: git
+    group: git
+    mode: "0600"
+
 - name: Deploy authorized_keys
   copy:
     content: "{{ forge_authorized_keys }}\n"
@@ -83,6 +111,7 @@
     - delete
     - rename
     - describe
+    - mirror-to
 
 - name: Create /usr/local/etc/cgit directory
   file:
@@ -92,6 +121,33 @@
     group: wheel
     mode: "0755"
 
+- name: Create git-mirrors log file
+  file:
+    path: /var/log/git-mirrors.log
+    state: touch
+    owner: git
+    group: git
+    mode: "0644"
+
+- name: Deploy git-mirrors script
+  copy:
+    src: "{{ jail_role_dir }}/files/git-mirrors.sh"
+    dest: /usr/local/bin/git-mirrors
+    owner: root
+    group: wheel
+    mode: "0755"
+
+- name: Deploy crontab for git user
+  copy:
+    content: |
+      SHELL=/bin/sh
+      PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
+      0 * * * * /usr/local/bin/git-mirrors
+    dest: /var/cron/tabs/git
+    owner: root
+    group: wheel
+    mode: "0600"
+
 - name: Deploy cgit head-include
   copy:
     src: "{{ jail_role_dir }}/files/head-include.html"
-- 
cgit v1.3