blob: ee576e58064a2fa0e18d877496891b3d120d424f (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
|
#!/bin/sh
: ${git_public_fqdn:="$fqdn"}
: ${git_basic_auth:='on'}
: ${gitolite_username:='s-gitolite'}
: ${gitolite_access_role:='gitolite-access'}
: ${gitolite_admin_role:='gitolite-admin'}
: ${cgit_clone_urls:="https://${fqdn} ssh://git@${fqdn}"}
: ${cgit_root_title:="${site} Git Repo"}
: ${cgit_root_desc:="Source code for various ${site} projects."}
: ${cgit_pygments_style:='default'}
: ${cgit_cache_size:='16000'}
gitolite_dn="uid=${gitolite_username},${robots_basedn}"
git_keytab="${keytab_dir}/nginx.keytab"
git_https_cert="${nginx_conf_dir}/git.crt"
git_https_key="${nginx_conf_dir}/git.key"
gitolite_home=/usr/local/git
gitolite_client_keytab="${keytab_dir}/gitolite.client.keytab"
gitolite_fcgiwrap_socket=/var/run/fcgiwrap/gitolite.sock
cgit_cache_dir=/var/cache/cgit
cgit_fcgiwrap_socket=/var/run/fcgiwrap/cgit.sock
cgit_webroot=/usr/local/www/cgit
# Install packages.
pkg install -y \
python \
nginx \
cgit \
gitolite \
fcgiwrap \
ca_root_nss \
py${python_version}-pygments \
py${python_version}-docutils \
py${python_version}-markdown
# Create ZFS dataset for gitolite repositories.
create_dataset -o "mountpoint=${gitolite_home}" "${state_dataset}/git"
zfs set \
com.sun:auto-snapshot:hourly=true \
com.sun:auto-snapshot:daily=true \
com.sun:auto-snapshot:weekly=true \
com.sun:auto-snapshot:monthly=true \
"${state_dataset}/git"
# Set ownership on gitolite dataset.
install_directory -o "$gitolite_local_user" -g "$gitolite_local_user" -m 0700 "$gitolite_home"
# Add www user to git group, so it can read git repositories.
pw groupmod "$gitolite_local_user" -m "$nginx_user"
# Create gitolite principal and keytab.
ldap_add "$gitolite_dn" <<EOF
objectClass: account
uid: ${gitolite_username}
EOF
add_principal -nokey -x "dn=${gitolite_dn}" "$gitolite_username"
ktadd -k "$gitolite_client_keytab" "$gitolite_username"
chgrp "$gitolite_local_user" "$gitolite_client_keytab"
chmod 640 "$gitolite_client_keytab"
gitolite_uid=$(id -u "$gitolite_local_user")
install_directory -o "$gitolite_local_user" -m 0700 "/var/krb5/user/${gitolite_uid}"
ln -snfv "$gitolite_client_keytab" "/var/krb5/user/${gitolite_uid}/client.keytab"
# Generate gitolite configuration.
install_directory -o "$gitolite_local_user" -g "$gitolite_local_user" -m 0750 \
"$gitolite_home" \
"${gitolite_home}/.gitolite" \
"${gitolite_home}/.gitolite/conf" \
"${gitolite_home}/.gitolite/logs"
install_file -o "$gitolite_local_user" -g "$gitolite_local_user" -m 0600 "${gitolite_home}/.gitolite.rc"
[ -f "${gitolite_home}/.gitolite/conf/gitolite.conf" ] \
|| install_template -o "$gitolite_local_user" -g "$gitolite_local_user" -m 0640 "${gitolite_home}/.gitolite/conf/gitolite.conf"
[ -f "${gitolite_home}/.gitolite/conf/gitolite.conf-compiled.pm" ] \
|| su "$gitolite_local_user" -c 'gitolite setup'
install_file -m 0555 \
/usr/local/libexec/gitolite-grouplist \
/usr/local/libexec/gitolite-authorizedkeys
# Generate cgit configuration.
install_template -m 0644 /usr/local/etc/cgitrc
install_template -m 0555 /usr/local/lib/cgit/filters/syntax-highlighting-custom.py
# Create cgit cache directory.
install_directory -o root -g "$nginx_user" -m 0770 "$cgit_cache_dir"
# Copy custom assets.
install_file -m 0644 \
"${cgit_webroot}/custom-style.css" \
"${cgit_webroot}/custom-favicon.ico" \
"${cgit_webroot}/custom-logo.png" \
"${cgit_webroot}/custom-robots.txt" \
"${cgit_webroot}/custom-head-include.html" \
"${cgit_webroot}/custom-header.html"
# Generate nginx configuration.
install_file -m 0644 /usr/local/etc/nginx/fastcgi_params
install_template -m 0644 /usr/local/etc/nginx/nginx.conf
[ -f "${nginx_conf_dir}/vhosts.conf" ] || install -Cv -m 0644 /dev/null "${nginx_conf_dir}/vhosts.conf"
sysrc -v nginx_enable=YES
service nginx restart
install_file -m 0644 /etc/newsyslog.conf.d/nginx.conf
if [ "$git_public_fqdn" != "$fqdn" ]; then
# Acquire public TLS certificate.
install_template -m 0600 /usr/local/etc/sudoers.d/acme
acme_install_certificate \
-g "$nginx_user" \
-r 'sudo service nginx reload' \
nginx \
"$git_public_fqdn"
else
# Copy local TLS certificate for nginx.
install_certificate -m 0644 nginx "$git_https_cert"
install_certificate_key -m 0600 nginx "$git_https_key"
fi
# Generate nginx vhosts (once certificate is acquired).
install_template -m 0644 /usr/local/etc/nginx/vhosts.conf
service nginx restart
# Create HTTP principal and keytab.
nginx_uid=$(id -u "$nginx_user")
add_principal -nokey -x "containerdn=${services_basedn}" "HTTP/${fqdn}"
ktadd -k "$git_keytab" "HTTP/${fqdn}"
chgrp "$nginx_user" "$git_keytab"
chmod 640 "$git_keytab"
install_directory -o "$nginx_user" -m 0700 "/var/krb5/user/${nginx_uid}"
ln -snfv "$git_keytab" "/var/krb5/user/${nginx_uid}/keytab"
# Generate sshd configuration.
install_template -m 0600 /usr/local/etc/ssh/sshd_config.d/gitolite.conf
# Enable and start daemons.
sysrc -v \
fcgiwrap_enable=YES \
fcgiwrap_profiles+='cgit gitolite' \
fcgiwrap_cgit_flags='-f' \
fcgiwrap_cgit_user="$nginx_user" \
fcgiwrap_cgit_group="$nginx_user" \
fcgiwrap_cgit_socket_owner="$nginx_user" \
fcgiwrap_cgit_socket_group="$nginx_user" \
fcgiwrap_cgit_socket="unix:${cgit_fcgiwrap_socket}" \
fcgiwrap_gitolite_flags='-f' \
fcgiwrap_gitolite_user="$gitolite_local_user" \
fcgiwrap_gitolite_group="$gitolite_local_user" \
fcgiwrap_gitolite_socket_owner="$nginx_user" \
fcgiwrap_gitolite_socket_group="$nginx_user" \
fcgiwrap_gitolite_socket="unix:${gitolite_fcgiwrap_socket}"
service fcgiwrap restart
service openssh restart
# Create access role.
for role in "$gitolite_access_role" "$gitolite_admin_role"; do
ldap_add "cn=${role},${roles_basedn}" <<EOF
objectClass: groupOfMembers
cn: ${role}
EOF
done
|
