diff options
| -rwxr-xr-x | cgit/ssh/git-shell-commands/fork | 1 | ||||
| -rwxr-xr-x | cgit/ssh/git-shell-commands/new | 1 | ||||
| -rwxr-xr-x | cgit/ssh/git-shell-commands/set-description | 1 | ||||
| -rwxr-xr-x | setup.sh | 37 | ||||
| -rw-r--r-- | ssh/sshd-config/git.conf | 6 | ||||
| -rw-r--r-- | ssh/sshd-config/host.conf | 4 |
6 files changed, 41 insertions, 9 deletions
diff --git a/cgit/ssh/git-shell-commands/fork b/cgit/ssh/git-shell-commands/fork index 52803d3..c2bc799 100755 --- a/cgit/ssh/git-shell-commands/fork +++ b/cgit/ssh/git-shell-commands/fork @@ -12,6 +12,7 @@ fi repo_name="$1"; shift 1; [ -z "$repo_name" ] && echo "Error: empty repo name" 1>&2 && exit 1 +(echo "$repo_name" | grep -q "^[A-Za-z0-9_-]\+$" 2>/dev/null) || (echo "Error: invalid repo name" 1>&2 && exit 1) remote_repo_url="$1"; shift 1; [ -z "$remote_repo_url" ] && echo "Error: empty repo url" 1>&2 && exit 1 diff --git a/cgit/ssh/git-shell-commands/new b/cgit/ssh/git-shell-commands/new index ec2d8ca..6b5a03d 100755 --- a/cgit/ssh/git-shell-commands/new +++ b/cgit/ssh/git-shell-commands/new @@ -12,6 +12,7 @@ fi repo_name="$1"; shift 1; [ -z "$repo_name" ] && echo "Error: empty repo name" 1>&2 && exit 1 +(echo "$repo_name" | grep -q "^[A-Za-z0-9_-]\+$" 2>/dev/null) || (echo "Error: invalid repo name" 1>&2 && exit 1) # Stupid cmdline parsing means I can't do $1 here for space separated stuff description="$*" diff --git a/cgit/ssh/git-shell-commands/set-description b/cgit/ssh/git-shell-commands/set-description index a120fa0..ea0e52e 100755 --- a/cgit/ssh/git-shell-commands/set-description +++ b/cgit/ssh/git-shell-commands/set-description @@ -9,6 +9,7 @@ fi repo_name="$1"; shift 1; [ -z "$repo_name" ] && echo "Error: empty repo name" 1>&2 && exit 1 +(echo "$repo_name" | grep -q "^[A-Za-z0-9_-]\+$" 2>/dev/null) || (echo "Error: invalid repo name" 1>&2 && exit 1) description="$*"; [ -z "$description" ] && echo "Error: empty description" 1>&2 && exit 1 @@ -5,7 +5,7 @@ set -eu ROOT_DIR=${ROOT_DIR:-"/opt/project"} configure() { - configure_user && configure_fs && configure_packages && configure_git && configure_firewall + configure_user && configure_fs && configure_packages && configure_git && configure_ssh && configure_firewall } services() { cd "$ROOT_DIR"; docker compose --profile services "$@"; } @@ -14,43 +14,62 @@ core() { cd "$ROOT_DIR"; docker compose --profile core "$@"; } # TODO: use --wait and add health checks start() { - stop || true; services up -d "$@" + services build --pull + stop || true + services up -d "$@" core down nginx core up nginx -d } -startfg() { stop || true; services up "$@"; } +startfg() { + services build --pull + stop || true + services up "$@" +} stop() { services down; } configure_packages() { + echo "== Packages ==" apt install \ docker.io docker-buildx docker-compose-v2 \ git ufw } configure_git() { + echo "== Git ==" sudo -u git git config --global init.defaultBranch main - # kept explicit shell setup - chsh -s "$(which git-shell)" git - ln -sf "$ROOT_DIR/cgit/ssh/git-shell-commands" /home/git/ + sudo -u git git config --global receive.fsckObjects true + sudo -u git git config --global core.sharedRepository group + chsh -s "$(which git-shell)" git # kept explicit shell setup + ln -sf "$ROOT_DIR/cgit/ssh/git-shell-commands" /git/ +} + +configure_ssh() { + echo "== Git ==" + ln -sf "$ROOT_DIR/ssh/sshd-config/host.conf" /etc/ssh/sshd_config.d/100-host.conf + ln -sf "$ROOT_DIR/ssh/sshd-config/git.conf" /etc/ssh/sshd_config.d/110-git.conf + # Set up authorized keys for git? } configure_firewall() { + echo "== Firewall ==" ufw allow 443/tcp ufw allow 80/tcp - ufw allow 22 - ufw enable + ufw limit 22/tcp } configure_user() { + echo "== User ==" + mkdir -p /home/git groupadd -f -g 1001 git - useradd --shell /usr/sbin/nologin git --uid 1001 --gid 1001 || true + useradd --shell /usr/sbin/nologin --home-dir /home/git git --uid 1001 --gid 1001 || true groupadd -f -g 1002 send useradd --shell /usr/sbin/nologin --no-create-home send --uid 1002 --gid 1002 || true } configure_fs() { + echo "== File system ==" mkdir -p /git chown -R git:git /git mkdir -p /uploads diff --git a/ssh/sshd-config/git.conf b/ssh/sshd-config/git.conf new file mode 100644 index 0000000..102725a --- /dev/null +++ b/ssh/sshd-config/git.conf @@ -0,0 +1,6 @@ +Match Group git + X11Forwarding no + AllowTcpForwarding no + PermitTunnel no + AllowAgentForwarding no + GatewayPorts no diff --git a/ssh/sshd-config/host.conf b/ssh/sshd-config/host.conf new file mode 100644 index 0000000..851b876 --- /dev/null +++ b/ssh/sshd-config/host.conf @@ -0,0 +1,4 @@ +MaxAuthTries 3 +LoginGraceTime 20 +PasswordAuthentication no +KbdInteractiveAuthentication no |