blob: 3e39d40a4719b7a42a4d08f43cb0a344e1525494 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
#!/usr/bin/env sh
set -eu
ROOT_DIR=${ROOT_DIR:-"/opt/project"}
configure() {
configure_user && configure_fs && configure_packages && configure_git && configure_ssh && configure_firewall
}
dc() { cd "$ROOT_DIR"; docker compose "$@"; }
services() { dc --profile services "$@"; }
core() { dc --profile core "$@"; }
# TODO: use --wait and add health checks
start() {
services build
stop || true
services up -d "$@"
# dc down nginx-proxy
# sleep 0.1
# dc up nginx-proxy -d
}
cache_clear() { services exec cgit sh -c 'rm -rf /var/cache/cgit/*'; }
startfg() {
services build --pull
stop || true
services up "$@"
}
stop() { services down; }
configure_packages() {
echo "== Packages =="
apt install \
docker.io docker-buildx docker-compose-v2 \
git ufw
}
configure_git() {
echo "== Git =="
sudo -u git git config --global init.defaultBranch main
sudo -u git git config --global receive.fsckObjects true
sudo -u git git config --global core.sharedRepository group
chsh -s "$(which git-shell)" git # kept explicit shell setup
ln -sf "$ROOT_DIR/cgit/ssh/git-shell-commands" /git/
}
configure_ssh() {
echo "== Git =="
ln -sf "$ROOT_DIR/ssh/sshd-config/host.conf" /etc/ssh/sshd_config.d/100-host.conf
ln -sf "$ROOT_DIR/ssh/sshd-config/git.conf" /etc/ssh/sshd_config.d/110-git.conf
# Set up authorized keys for git?
}
configure_firewall() {
echo "== Firewall =="
ufw allow 443/tcp
ufw allow 80/tcp
ufw limit 22/tcp
}
configure_user() {
echo "== User =="
mkdir -p /home/git
groupadd -f -g 1001 git
useradd --shell /usr/sbin/nologin --home-dir /home/git git --uid 1001 --gid 1001 || true
groupadd -f -g 1002 send
useradd --shell /usr/sbin/nologin --no-create-home send --uid 1002 --gid 1002 || true
}
configure_fs() {
echo "== File system =="
mkdir -p /git
chown -R git:git /git
mkdir -p /uploads
chown -R send:send /uploads
}
update() {
apt update
services build --pull
}
cmd="$1"; shift;
case "$cmd" in
update|start|startfg|stop|services|core|cache_clear) "$cmd" "$@" ;;
configure|configure_firewall|configure_user|configure_fs|configure_packages|configure_git) "$cmd" "$@" ;;
*) echo "Invalid command: $cmd"; exit 1 ;;
esac
|
