mugit @ da15464

{

  description = "a git server that your cow will love";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs";

  outputs = { self, nixpkgs }:

    let

      systems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];

      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});

    in {

      packages = forAllSystems (pkgs:

        let version = self.rev or "dev";

        in {

          default = self.packages.${pkgs.stdenv.hostPlatform.system}.mugit;

          mugit = pkgs.buildGo126Module {

            pname = "mugit";

            version = version;

            src = ./.;

            vendorHash = "sha256-qVvVlS0RgOms6/o6TfGxdQ1DYhr1ouWY7UhAWYN/6ps=";

            ldflags = [ "-s" "-w" "-X main.version=${version}" ];

            nativeCheckInputs = [ pkgs.git ];

            meta = with pkgs.lib; {

              homepage = "https://git.olexsmir.xyz/mugit";

              license = licenses.mit;

            };

          };

        }

      );

      nixosModules.default = { config, lib, pkgs, ... }:

        with lib;

        let

          cfg = config.services.mugit;

          format = pkgs.formats.yaml { };

          sshUser = if cfg.config.ssh.user != "" then cfg.config.ssh.user else cfg.user;

          configFile  = if cfg.configFile != null

            then cfg.configFile

            else format.generate "config.yaml" cfg.config;

        in {

          options.services.mugit = {

            enable = mkEnableOption "mugit service";

            package = mkOption {

              type = types.package;

              default = self.packages.${pkgs.stdenv.hostPlatform.system}.mugit;

              defaultText = literalExpression "self.packages.\${pkgs.stdenv.hostPlatform.system}.mugit";

              description = "The mugit package to use.";

            };

            exposeCli = mkOption {

              type = types.bool;

              default = false;

              description = "Whether to expose a mugit CLI wrapper to all system users, runs as the mugit user/group.";

            };

            configFile = mkOption {

              type = types.nullOr types.path;

              default = null;

              description = "Path to an existing mugit configuration file. Mutually exclusive with `config`.";

            };

            user = mkOption {

              type = types.str;

              default = "git";

              description = "User account under which mugit runs.";

            };

            group = mkOption {

              type = types.str;

              default = "git";

              description = "Group under which mugit runs.";

            };

            config = mkOption {

              default = {};

              description = ''

                The primary mugit configuration.

                See [docs](https://github.com/olexsmir/mugit) for possible values.

              '';

              example = literalExpression ''

                {

                  meta.host = "git.example.org";

                  repo.dir = "/var/lib/mugit";

                  ssh = {

                    enable = true;

                    host_key = "/var/lib/mugit/key";

                  };

                }

              '';

              type = types.submodule {

                options.meta = {

                  title = mkOption {

                    type = types.str;

                    default = "mugit";

                    description = "Website title";

                  };

                  description = mkOption {

                    type = types.str;

                    default = "";

                    description = "Website description";

                  };

                  host = mkOption {

                    type = types.str;

                    default = "";

                    description = "Website CNAME (required)";

                  };

                };

                options.server = {

                  host = mkOption {

                    type = types.str;

                    default = "";

                    description = "Host address";

                  };

                  port = mkOption {

                    type = types.port;

                    default = 8080;

                    description = "Website port";

                  };

                };

                options.repo = {

                  dir = mkOption {

                    type = types.str;

                    default = "";

                    description = "Directory which mugit will scan for repositories (required)";

                  };

                  masters = mkOption {

                    type = types.listOf types.str;

                    default = ["master" "main"];

                    description = "Master branch to look for";

                  };

                  readmes = mkOption {

                    type = types.listOf types.str;

                    default = ["README.md" "readme.md" "README.html" "readme.html" "README.txt" "readme.txt" "readme"];

                    description = "Readme files to look for";

                  };

                };

                options.ssh = {

                  enable = mkOption {

                    type = types.bool;

                    default = false;

                    description = "Whether to enable SSH git access";

                  };

                  user = mkOption {

                    type = types.str;

                    default = "";

                    description = "User used for git access. Defaults to the main user option.";

                  };

                  host_key = mkOption {

                    type = types.str;

                    default = "";

                    description = "Path to ssh private key (required if ssh enabled)";

                  };

                  keys = mkOption {

                    type = types.listOf types.str;

                    default = [];

                    description = "List of public ssh keys which are allows to do git pushes, and access private repositories";

                  };

                };

                options.mirror = {

                  enable = mkOption {

                    type = types.bool;

                    default = false;

                    description = "Wharever to run mirroring worker";

                  };

                  interval = mkOption {

                    type = types.str;

                    default = "8h";

                    description = "Interval in which mirroring will happen";

                  };

                  github_token = mkOption {

                    type = types.str;

                    default = "";

                    description = "Github token for pulling from github repos";

                  };

                };

                options.cache = {

                  home_page = mkOption {

                    type = types.str;

                    default = "5m";

                    description = "For how long index page is cached";

                  };

                  readme = mkOption {

                    type = types.str;

                    default = "1m";

                    description = "For how long repos readme is cached";

                  };

                };

              };

            };

          };

          config = mkIf cfg.enable {

            assertions = [

              {

                assertion = !cfg.config.ssh.enable || (cfg.config.ssh.keys != []);

                message = "SSH is enabled but no SSH keys provided. Please add keys to services.mugit.config.ssh.keys";

              }

            ];

            users.groups.${cfg.group} = { };

            users.users.${cfg.user} = {

              isSystemUser = true;

              useDefaultShell = true;

              group = cfg.group;

              home = cfg.config.repo.dir;

              createHome = true;

              description = "mugit service user";

            };

            services.openssh = mkIf cfg.config.ssh.enable {

              enable = true;

              extraConfig = ''

                Match User ${sshUser}

                    AuthorizedKeysCommand /etc/ssh/mugit_authorized_keys

                    AuthorizedKeysCommandUser ${sshUser}

                    ChallengeResponseAuthentication no

                    PasswordAuthentication no

                    AllowUsers ${sshUser}

              '';

            };

            environment.etc."ssh/mugit_authorized_keys" = mkIf cfg.config.ssh.enable {

              mode = "0555";

              text = ''

                #!${pkgs.stdenv.shell}

                ${cfg.package}/bin/mugit --config ${configFile} shell keys "$1"

              '';

            };

            environment.systemPackages = lib.mkIf cfg.exposeCli [

              (pkgs.runCommandLocal "mugit-completions" {} ''

                mkdir -p $out/share/bash-completion/completions

                mkdir -p $out/share/zsh/site-functions

                mkdir -p $out/share/fish/vendor_completions.d

                ${cfg.package}/bin/mugit completion bash > $out/share/bash-completion/completions/mugit

                ${cfg.package}/bin/mugit completion zsh  > $out/share/zsh/site-functions/_mugit

                ${cfg.package}/bin/mugit completion fish > $out/share/fish/vendor_completions.d/mugit.fish

              '')

            ];

            security.wrappers = lib.mkIf cfg.exposeCli {

              mugit = {

                source =

                  let

                    mugitWrapped = pkgs.writeScriptBin "mugit" ''

                      #!${pkgs.bash}/bin/bash

                      exec ${cfg.package}/bin/mugit --config ${configFile} "$@"

                    '';

                  in

                  "${mugitWrapped}/bin/mugit";

                owner = cfg.user;

                group = cfg.group;

                setuid = true;

                setgid = true;

                permissions = "u+rx,g+rx,o+rx";

              };

            };

            systemd.services.mugit = {

              description = "mugit service";

              wantedBy = [ "multi-user.target" ];

              after = [ "network.target" ] ++ lib.optionals cfg.config.ssh.enable [ "sshd.service" ];

              path = [ pkgs.git ];

              serviceConfig = {

                Type = "simple";

                User = cfg.user;

                Group = cfg.group;

                WorkingDirectory = cfg.config.repo.dir;

                StateDirectory = "mugit";

                ExecStart = "${cfg.package}/bin/mugit serve --config ${configFile}";

                Restart = "on-failure";

                RestartSec = "5s";

                NoNewPrivileges = true;

                PrivateTmp = true;

                ProtectSystem = "strict";

                ProtectHome = true;

                ReadWritePaths = [ cfg.config.repo.dir ];

                ProtectKernelTunables = true;

                ProtectKernelModules = true;

                ProtectControlGroups = true;

              };

            };

          };

        };

    };

}