diff options
Diffstat (limited to 'modules/cgit.nix')
| -rw-r--r-- | modules/cgit.nix | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/modules/cgit.nix b/modules/cgit.nix index de15e08..1ea78cc 100644 --- a/modules/cgit.nix +++ b/modules/cgit.nix @@ -32,8 +32,24 @@ users.groups.git = {}; # Repository root + # + # The git-shell-commands lines below add Git LFS support. git-shell's own + # hardcoded allowlist is exactly three commands - git-receive-pack, + # git-upload-pack, git-upload-archive (confirmed from git's own shell.c) - + # so a plain LFS-tracked push fails with "unrecognized command + # 'git-lfs-authenticate ...'" otherwise. The documented extension point is + # an executable file matching the command name in ~/git-shell-commands + # (~ being /srv/git, the git user's home above). Symlinking git-lfs-transfer + # there - nixpkgs' server-side implementation of Git LFS's pure-SSH + # protocol - is enough: git-lfs clients (v3.0+) already try this command + # automatically for SSH remotes before falling back to the HTTP-based + # git-lfs-authenticate flow, so nothing needs configuring client-side. This + # keeps LFS on the same SSH-only path as normal pushes, with no HTTP LFS + # server or tokens involved. systemd.tmpfiles.rules = [ "d /srv/git 0755 git git -" + "d /srv/git/git-shell-commands 0750 git git -" + "L+ /srv/git/git-shell-commands/git-lfs-transfer - - - - ${pkgs.git-lfs-transfer}/bin/git-lfs-transfer" ]; # cgit web interface served via nginx + fcgiwrap |