1 files changed, 68 insertions, 0 deletions
diff --git a/modules/cgit.nix b/modules/cgit.nix
new file mode 100644
index 0000000..90cf21b
--- /dev/null
+++ b/modules/cgit.nix
@@ -0,0 +1,68 @@
+{ config, pkgs, lib, ... }:
+
+# cgit - fast web interface for git repositories.
+#
+# Repositories live in /srv/git/<repo>.git (bare repos).
+# Access model:
+#   - Web browsing:  public, no auth  (https://git.karanj.com)
+#   - git clone/pull over HTTPS: public, read-only via git-http-backend
+#   - git push:      SSH only, using the "git" user + your authorized keys
+#
+# Caddy routes:
+#   /git/*  -> fcgiwrap serving git-http-backend (port 8085 via nginx shim)
+#   /*      -> cgit (port 8086 via nginx shim)
+#
+# Both cgit and git-http-backend are served through a minimal nginx instance
+# bound to localhost, which Caddy then reverse-proxies.
+{
+  # Dedicated git user for SSH push access
+  users.users.git = {
+    isSystemUser = true;
+    group = "git";
+    home = "/srv/git";
+    shell = pkgs.git;
+    # Allow pushing from both your devices
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwAgL0o4NVonSG07Xu4Eai84ns4AjoZj2V7dGC9nXit karanjayachandra@Einstein.local"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH+qnLTnorv+I2rSSfGjNiCuX/W5AxoNgAdu+cTOyKzW Galileo"
+    ];
+  };
+  users.groups.git = {};
+
+  # Repository root
+  systemd.tmpfiles.rules = [
+    "d /srv/git 0755 git git -"
+  ];
+
+  # cgit web interface served via nginx + fcgiwrap
+  services.cgit."git.karanj.com" = {
+    enable = true;
+    settings = {
+      # Repository root
+      scan-path = "/srv/git";
+
+      # Site branding
+      root-title = "karanj.com git";
+      root-desc = "personal git repositories";
+
+      # Enable common features
+      enable-index-links = 1;
+      enable-commit-graph = 1;
+      enable-log-filecount = 1;
+      enable-log-linecount = 1;
+      enable-blame = 1;
+      enable-http-clone = 1; # show clone URL in UI
+
+      # Public clone URL prefix shown in the cgit UI
+      clone-url = "https://git.karanj.com/$CGIT_REPO_URL";
+
+      # Syntax highlighting
+      source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
+      about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
+    };
+  };
+
+  # fcgiwrap is needed to run cgit's CGI scripts; the cgit module enables it
+  # automatically, but we make it explicit here for clarity.
+  services.fcgiwrap.enable = true;
+}