cgit: Protect with Anubis.

2 files changed, 51 insertions, 39 deletions

diff --git a/doc/forge.skb b/doc/forge.skb
index 4f184ae..7a41487 100644
--- a/doc/forge.skb
+++ b/doc/forge.skb
@@ -243,7 +243,9 @@ programming languages using ,(ref :url "https://pygments.org/" :text
 "Pygments")])
             (item [rendering markdown, org mode, reStructuredText, man
 page, HTML or plain text README files in the ,(emph [About]) page])
-            (item [hiding full email addresses on cgit web pages]))
+            (item [hiding full email addresses on cgit web pages])
+            (item [,(ref :url "https://anubis.techaro.lol/" :text "Anubis")
+protection for expensive endpoints]))
            [Note that this service is different from the cgit service
 of the same name in Guix upstream.])
         (description
diff --git a/guix/forge/cgit.scm b/guix/forge/cgit.scm
index 2f6598f..94a62ee 100644
--- a/guix/forge/cgit.scm
+++ b/guix/forge/cgit.scm
@@ -30,7 +30,8 @@
   #:use-module (gnu services)
   #:use-module ((gnu services web) #:select (nginx-server-configuration
                                              nginx-location-configuration
-                                             nginx-named-location-configuration))
+                                             nginx-named-location-configuration
+                                             nginx-named-location-configuration-body))
   #:use-module (gnu system file-systems)
   #:use-module (guix gexp)
   #:use-module (guix records)
@@ -252,47 +253,56 @@ configured in @var{config}."
 (define cgit-nginx-server-block
   (match-record-lambda <cgit-configuration>
     (cgit git server-name socket repository-directory)
-    (nginx-server-configuration
+    (forge-nginx-server-configuration
      (server-name (list server-name))
      ;; cgit static files
      (root (file-append cgit "/share/cgit"))
+     (anubis? #t)
      (locations
-      (list
-       ;; git-http-backend for the smart HTTP protocol
-       (nginx-location-configuration
-         (uri "~ ^/.*/(HEAD|info/refs|git-receive-pack|git-upload-pack).*$")
-         (body (list "fastcgi_param SCRIPT_FILENAME "
-                     (file-append git "/libexec/git-core/git-http-backend;")
-                     (string-append "fastcgi_param GIT_PROJECT_ROOT "
-                                    repository-directory
-                                    ";")
-                     "fastcgi_param GIT_HTTP_EXPORT_ALL yes;"
-                     "fastcgi_param PATH_INFO $uri;"
-                     "fastcgi_param QUERY_STRING $query_string;"
-                     "fastcgi_param REQUEST_METHOD $request_method;"
-                     "fastcgi_param CONTENT_TYPE $content_type;"
-                     (string-append "fastcgi_pass "
-                                    (nginx-socket->string socket)
-                                    ";"))))
-       ;; cgit web interface
-       (nginx-named-location-configuration
-         (name "cgit")
-         (body (list
-                #~(string-append "fastcgi_param SCRIPT_FILENAME "
-                                 #$(file-append cgit "/lib/cgit/cgit.cgi")
-                                 ";")
-                "fastcgi_param PATH_INFO $uri;"
-                "fastcgi_param QUERY_STRING $query_string;"
-                "fastcgi_param HTTP_HOST $server_name;"
-                (string-append "fastcgi_pass "
-                               (nginx-socket->string socket)
-                               ";"))))
-       ;; On other URIs, try a file before falling back to @cgit. This try_files
-       ;; cannot be in the server context because it would then apply to
-       ;; git-http-backend, etc.
-       (nginx-location-configuration
-         (uri "/")
-         (body (list "try_files $uri @cgit;"))))))))
+      (let ((cgit-location
+             (nginx-named-location-configuration
+               (name "cgit")
+               (body (list
+                      #~(string-append "fastcgi_param SCRIPT_FILENAME "
+                                       #$(file-append cgit "/lib/cgit/cgit.cgi")
+                                       ";")
+                      "fastcgi_param PATH_INFO $uri;"
+                      "fastcgi_param QUERY_STRING $query_string;"
+                      "fastcgi_param HTTP_HOST $server_name;"
+                      (string-append "fastcgi_pass "
+                                     (nginx-socket->string socket)
+                                     ";"))))))
+        (list
+         ;; git-http-backend for the smart HTTP protocol
+         (nginx-location-configuration
+           (uri "~ ^/.*/(HEAD|info/refs|git-receive-pack|git-upload-pack).*$")
+           (body (list "fastcgi_param SCRIPT_FILENAME "
+                       (file-append git "/libexec/git-core/git-http-backend;")
+                       (string-append "fastcgi_param GIT_PROJECT_ROOT "
+                                      repository-directory
+                                      ";")
+                       "fastcgi_param GIT_HTTP_EXPORT_ALL yes;"
+                       "fastcgi_param PATH_INFO $uri;"
+                       "fastcgi_param QUERY_STRING $query_string;"
+                       "fastcgi_param REQUEST_METHOD $request_method;"
+                       "fastcgi_param CONTENT_TYPE $content_type;"
+                       (string-append "fastcgi_pass "
+                                      (nginx-socket->string socket)
+                                      ";"))))
+         ;; cgit web interface
+         cgit-location
+         ;; Protect the commit, diff and tree URIs behind Anubis.
+         (nginx-location-configuration
+           (uri "~ ^/.*/(diff|tree)/")
+           (body (cons* "auth_request /.within.website/x/cmd/anubis/api/check;"
+                        "error_page 401 = @redirectToAnubis;"
+                        (nginx-named-location-configuration-body cgit-location))))
+         ;; On other URIs, try a file before falling back to @cgit. This
+         ;; try_files cannot be in the server context because it would then
+         ;; apply to git-http-backend, etc.
+         (nginx-location-configuration
+           (uri "/")
+           (body (list "try_files $uri @cgit;")))))))))
 
 (define cgit-service-type
   (service-type